Update Javadoc of MultipartFile#getOriginalFilename

Closes gh-26299

Author: rstoyanchev

spring-web/src/main/java/org/springframework/web/multipart/MultipartFile.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2018 the original author or authors.
+ * Copyright 2002-2021 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -53,10 +53,16 @@ public interface MultipartFile extends InputStreamSource {
 	 * Return the original filename in the client's filesystem.
 	 * <p>This may contain path information depending on the browser used,
 	 * but it typically will not with any other than Opera.
+	 * <p><strong>Note:</strong> Please keep in mind this filename is supplied
+	 * by the client and should not be used blindly. In addition to not using
+	 * the directory portion, the file name could also contain characters * such
+	 * as ".." and others that can be used maliciously.
 	 * @return the original filename, or the empty String if no file has been chosen
 	 * in the multipart form, or {@code null} if not defined or not available
 	 * @see org.apache.commons.fileupload.FileItem#getName()
 	 * @see org.springframework.web.multipart.commons.CommonsMultipartFile#setPreserveFilename
+	 * @see <a href="https://tools.ietf.org/html/rfc7578#section-4.2">RFC 7578, Section 3.4</a>
+	 * @see <a href="https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload">Unrestricted File Upload</a>
 	 */
 	@Nullable
 	String getOriginalFilename();