An absolute URI isn't necessarily "remote". I assume the allow-remote parameter is meant for extra security, so you couldn't upload a html file to a web ui with references to file:/home/root or something? The relative URI ../../../../../../../../../../../home/root points to the same directory (unless the framework is stored in a really deep directory).

Instead, how about resolving the URI and (1) if it uses the file scheme it must be a descendant of the directory that the HTML file is placed in, or (2) if it does not use the file scheme it must have the same authority component as the URI of the HTML file.

Just some thoughts.