filenames that are controlled by the system and can't be used for command injection