fix(security): prevent streaming upload filename path disclosure (#2386)