Building a File from request-derived input allows reading or writing files outside the intended directory.
Canonicalize the path and verify it stays within an allowed base directory.