> if an attacker can control filenames fully, this is the least of your worries Sure, but practicing defense in depth is often a good idea. Maybe today's versi

> if an attacker can control filenames fully, this is the least of your worries Sure, but practicing defense in depth is often a good idea. Maybe today's version of your application sanitizes user input correctly, but tomorrow's version might suddenly allow funky characters. If your super duper bash backup script doesn't get updated, you might suddenly have a problem.