I have a Symfonfy framework set up on an Apache server. Suppose that, on the client side, I fabricate a request for file upload and POST it to my designated endpoint. What happens if, in this request, the filename field is set to "../../file.png" provided that the mime type is allowed on the server?
Would it be possible to know if path is removed from filename by the containers or the framework as part of processing request? Do I end up with clean version of $request->files->all() on backend that is safe from path injection or do I have to sanitize it myself?