The problem is that often you will assume that certain APIs were written with that in mind when they were not. os.path.join for instance looks very innocent. E

The problem is that often you will assume that certain APIs were written with that in mind when they were not. os.path.join for instance looks very innocent. Eh. I'm inclined to offer very little sympathy to anyone who believes that the os module in python provides any web injection protection. The os module is named "miscellaneous operating system interfaces" and anyone who got above a C in their OS course in college should know that no UNIX programmer took web injection vulnerabilities into account when designing the os interface.