Normally they are sanitized by the `link_directories` command before populating the property, but projects may set the property directly.