> On Windows, decoded segment contains any of: '\'

And on Japanese and Korean windows? It uses the yen symbol as path separator. Depending on how the path is read or interpreted, filtering the yen may be necessary.

https://msdn.microsoft.com/en-us/library/dd374047(v=vs.85).a...

Afaik remember windows will parse additional dots beyond the two first as another level up? Cross-platform secure coding is hard... (Not sure about this code though, just making an observation).