Since this is being built into a server-side filename (the template file), it needs to be whitelisted or otherwise validated.