Mostly I was trying to figure out what this was doing, and noting that the regex creation each time is a bit complex.  Then I realized what this is trying to catch.  I think just disallowing the ..'s should be the way to go, although maybe we should look at what it does with absolute paths in filename.