New user of Fast API. I have a common FastAPI POST interface that takes in a user uploaded file:

@app.post("/upload")
async def upload(
    file: UploadFile = File(...),
    ...

Supposely, UploadFile is a temporary file that I could read data from, and closed when this request is done. However, I just learned that if the user specifies a filename in the request, say:

curl -X 'POST' 
    'http://<hostname>/upload/'
    -F '[email protected];filename=./public/test.txt'

The uploaded test.txt will be written to the location workdir/public/test.txt on my host, where workdir is the working directory that runs my code. This happens before my backend code is run, so even I check the file path and throw http error, the file writing still happened.

It is definitely a security hole and I want to block user option filename here to write file to a random path. What is the best practice in such case? Thank you!