Assuming I'm wish to enforce canonical paths, I believe:

($filename) =   $filename =~ m{\A (/ ([\w./]+) )}smx
    and         $filename !~ m{\.{2}\/}smx
    or die 'Bad filename';
[download]

Covers me. Correct? Is there a more elegant way to do this?