Sanitize file-names

Otherwise a DOM-based XSS is possible.