untaint valid asset names