Example of how to sanitize file names (base, without path) to avoid any malicious actions

sanitize.rb

# help to avoid path traversal, and execution of anything on a machine
# due to file name
def escape_file_name(name)
  # regex is a s follows:
  # if it's the begining of the string, or there is no escape char
  # for the following chars,
  # add an escape for that char
  name.gsub(/(^|[^\\])([\s\!\'\"#$&\^\*\`\/\(\)\[\]\?\{\}\|\~])/) do |match|
    "\\#{match[1]}"
  end
end