Can we do something like `if os.path.exists(name)` first, to avoid injection attacks?