ENT-653: fix external control of file name or path (CWE ID 73).