fix StringIO/BytesIO confusion in in-memory file upload processors.
make sure relative path operator injection in path names don't go to parent directories.