Function safe_file_name 

fn safe_file_name(name: &str, fallback: &str) -> String

A file name that came from Slack is untrusted input: it is whatever the uploader chose to call the file. Take only the final path component, refuse . and .., and fall back to the file id when nothing usable is left - so the result can only ever be one name inside the directory the caller asked for.