trim('\') and trim('/') + a validation forbidding ".." might be a good start.  Or some validation where the normalized target path must be child of wwwroot (StartsWith etc).

Other questions, 

  1. who is responsible  to create this target path?
  2. What is the flow?  For instance, there must be an initial full deployment.  Then users set a target path to allow subsequent incremental push to deploy to specific target path.
  3. If there is no initial full deployment, we will still deploy to target path - I guess?