comment from upstream:
"The pathname is something you can trust, whereas the name is whatever the app sent, so if we drop the pathname there is zero security."
comment from upstream:
"The pathname is something you can trust, whereas the name is whatever the app
sent, so if we drop the pathname there is zero security."