You're right that some APIs just suck. But it's important to recognize that the problem exists. If you notice that you can't perform an action safely, and there

You're right that some APIs just suck. But it's important to recognize that the problem exists. If you notice that you can't perform an action safely, and there's an injection risk, you can usually try and find a safe way that doesn't involve an error-prone approach. Example for the path traversal: generate a filename within the app, and save the original name somewhere. For command injection, it is more variegated. But resorting to launching an external command (rather than an API in the language you're using) should be a niche requirement, not the standard way to go.