Improve plugin path regex to avoid arbitrary includes

The path and filename components are not allowed to start with a '.',
which prevents uses like ../../../etc/password