I cant see the full context of this function but it appears someone could upload any file and it will just be renamed to raw.