Sanitize buffered upload filenames

[harsh21234i]

Description

close #6752
Buffered uploads previously preserved client-supplied path segments in UploadFile.path, while streamed uploads
normalized filenames to a basename.

This made rx.upload_files and rx.upload_files_chunk expose different filename/path behavior for the same multipart
filename, for example ../secret.txt.

This PR adds one shared filename sanitizer and uses it for both upload paths.

Changes

• Add _sanitize_upload_filename to strip path segments from upload filenames.
• Add _upload_file_from_starlette so buffered upload file construction is directly testable.
• Use the shared sanitizer in both buffered and streamed upload handling.
• Add tests for POSIX-style and Windows-style path segment filenames.

Checks

• uv run pytest tests/units/components/core/test_upload.py -q
• uv run ruff check packages/reflex-components-core/src/reflex_components_core/core/_upload.py tests/units/ components/core/test_upload.py
• uv run ruff format --check packages/reflex-components-core/src/reflex_components_core/core/_upload.py tests/units/ components/core/test_upload.py
• uv run pyright packages/reflex-components-core/src/reflex_components_core/core/_upload.py tests/units/components/ core/test_upload.py

[greptile-apps]

Greptile Summary

This PR aligns filename handling for buffered and streamed uploads. The main changes are:

• Adds a shared upload filename sanitizer.
• Preserves safe relative directory paths.
• Normalizes POSIX and Windows path segments.
• Adds focused tests for both upload paths.

Confidence Score: 4/5

A contained filename edge case should be fixed before merging.

• Buffered and streamed uploads now share the same sanitizer.
• Normal path segments and safe relative directories are handled consistently.
• Reserved dot-only names can still resolve to directories instead of files.

packages/reflex-components-core/src/reflex_components_core/core/_upload.py

Important Files Changed

Filename	Overview
packages/reflex-components-core/src/reflex_components_core/core/_upload.py	Adds shared filename sanitization and applies it to buffered and streamed uploads.
tests/units/components/core/test_upload.py	Adds coverage for POSIX paths, Windows paths, and preserved relative directories.
packages/reflex-components-core/news/6753.bugfix.md	Documents the unified filename sanitization behavior.

_{Reviews (3): Last reviewed commit: "Preserve safe upload directory paths" | Re-trigger Greptile}

[codspeed-hq]

Merging this PR will not alter performance

✅ 26 untouched benchmarks
⏩ 8 skipped benchmarks¹

---

_{Comparing harsh21234i:fix/upload-filename-basename-buffered (a828910) with main (32cc257)}

Footnotes

1. 8 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[masenf]

it seems like this breaks directory upload.

if you make an upload component, then drag a whole directory onto it and upload it, i would expect the path segments to be retained.

[harsh21234i]

Good catch. I adjusted the sanitizer so directory uploads keep safe relative paths instead of flattening everything to
a basename.

Current behavior:

• photos/2026/image.png is preserved for directory uploads.
• ../secret.txt is normalized to secret.txt.
• absolute / drive paths still collapse to basename.

I added coverage for both buffered uploads and streamed upload chunks to make sure safe directory paths are retained
consistently.