If it's `untrusted_filename`, it should at least accept the length of the string as an argument.