Function valid_attachment_id 

pub fn valid_attachment_id(id: &str) -> bool

Is id a shape put_attachment could have produced? 32 lowercase hex digits and nothing else, checked before an id that came from the client is ever allowed to build a path - so .. and a path separator are never even possible.