def _validate_untrusted_args(argv):
    # NOTE: Do not use f-strings here, as this should run with older Python
    # versions (so that a proper error can be displayed)
    try:
        untrusted_idx = argv.index('--untrusted-args')
    except ValueError:
        return

    rest = argv[untrusted_idx + 1:]
    if len(rest) > 1:
        sys.exit(
            "Found multiple arguments ({}) after --untrusted-args, "
            "aborting.".format(' '.join(rest)))

    for arg in rest:
        if arg.startswith(('-', ':')):
            sys.exit("Found {} after --untrusted-args, aborting.".format(arg))
The application constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name.