Repository: dotnet/runtime
File: src/mono/wasm/host/DevServer/DevServerStartup.cs (C#)

Code before:
                if (!Directory.Exists(fileUploadPath))
                {
                    Directory.CreateDirectory(fileUploadPath!);
                }
                Regex fileFilter = new Regex(fileUploadPattern!);

                // Route with filename parameter
                endpoints.MapPost("/upload/{filename}", async context =>
                {
                    try
                    {
                        // Get the filename from the route
                        var routeValues = context.Request.RouteValues;
                        string? rawFileName = routeValues["filename"]?.ToString();

                        // skip upload if no name provided or invalid
                        if (string.IsNullOrEmpty(rawFileName) || !fileFilter.IsMatch(rawFileName!))
                        {
                            return;
                        }

                        // Sanitize filename - IMPORTANT: Only use GetFileName to strip any path components
                        // This prevents directory traversal attacks like "../../../etc/passwd"
                        string fileName = Path.GetFileName(rawFileName);

                        if (string.IsNullOrEmpty(fileName))
                        {
                            fileName = $"upload_{Guid.NewGuid():N}";
                        }

                        string filePath = Path.Combine(fileUploadPath!, fileName);

                        using (var outputStream = new FileStream(filePath, FileMode.Create))
                        {
                            await context.Request.Body.CopyToAsync(outputStream);
                        }

                        await context.Response.WriteAsync($"File saved to {filePath}");
                    }
                    catch (Exception ex)
                    {
                        context.Response.StatusCode = 500;
                        await context.Response.WriteAsync($"Error processing upload: {ex.Message}");
                    }
                });
            }

        });

        ServerURLsProvider.ResolveServerUrlsOnApplicationStarted(app, logger, applicationLifetime, realUrlsAvailableTcs, "/_framework/debug");
    }

Review comment (suggestion):
Early return on invalid or missing filename (lines 142-145) exits without setting an explicit status code or body, producing a default 200/empty response that can mislead clients into assuming success. Previously a missing filename resulted in a generated unique name, so this is also a behavior change. Recommend responding with a 400 (Bad Request) and an explanatory message (e.g., context.Response.StatusCode = 400; await context.Response.WriteAsync("Invalid filename");) or restoring unique-name generation for the empty case while still rejecting invalid patterns.
```suggestion
                        {
                            context.Response.StatusCode = 400;
                            await context.Response.WriteAsync("Invalid or missing filename for upload.");
```

Code after:
                if (!Directory.Exists(fileUploadPath))
                {
                    Directory.CreateDirectory(fileUploadPath!);
                }
                Regex fileFilter;
                try
                {
                    fileFilter = new Regex(fileUploadPattern!, RegexOptions.Compiled | RegexOptions.CultureInvariant);
                }
                catch (Exception ex)
                {
                    throw new InvalidOperationException($"DEVSERVER_UPLOAD_PATTERN value '{fileUploadPattern}' is not a valid regular expression: {ex.Message}", ex);
                }

                // Route with filename parameter
                endpoints.MapPost("/upload/{filename}", async context =>
                {
                    try
                    {
                        // Get the filename from the route
                        var routeValues = context.Request.RouteValues;
                        string? rawFileName = routeValues["filename"]?.ToString();

                        // skip upload if no name provided or invalid
                        if (string.IsNullOrEmpty(rawFileName) || !fileFilter.IsMatch(rawFileName!))
                        {
                            context.Response.StatusCode = 403; // Forbidden
                            await context.Response.WriteAsync("Invalid or missing filename for upload.");
                            return;
                        }

                        // Sanitize filename - IMPORTANT: Only use GetFileName to strip any path components
                        // This prevents directory traversal attacks like "../../../etc/passwd"
                        string fileName = Path.GetFileName(rawFileName);

                        if (string.IsNullOrEmpty(fileName))
                        {
                            fileName = $"upload_{Guid.NewGuid():N}";
                        }

                        string filePath = Path.Combine(fileUploadPath!, fileName);

                        using (var outputStream = new FileStream(filePath, FileMode.Create))
                        {
                            await context.Request.Body.CopyToAsync(outputStream);
                        }

                        await context.Response.WriteAsync($"File saved to {filePath}");
                    }
                    catch (Exception ex)
                    {