This avoids bugs/vulnerability with filenames containing a quote.
Migrated from D474 (view on Phabricator)