fix FS traversal using occamsrazor.js properly