Agreed. Not a direct answer but this should be interesting: https://github.com/cyphar/filepath-securejoin