Rather than modifying the input path, I would check if the `normpath`'d path was in the directory or not. (which is a matter of comparing prefixes).
If it's not in the directory send up a 403 or 404. We don't want to serve some other file if they are *trying* to escape the directory.