This issue cropped up again in our production environment.

I think you are right, the file name on disk should not be part of the "content type" or any other user supplied data = security risk. Let's have a think about how to deal with this. I like your proposal.

Originally posted by @ioquatix in #1874 (comment)