I just realized that the logic is not complete. The logic to sanitize the provided path to handle any ".." etc is located https://github.com/xbmc/xbmc/blob/master/xbmc/network/httprequesthandler/HTTPVfsHandler.cpp#L52. URIUtils::GetRealPath() will evaluate any ".." and return the real path which can then be checked against the sources list or whatever other paths we want to allow. So we should probably first call URIUtils::GetRealPath() (and the archive handling logic) on the given path and then check against the allowed paths. Then we also don't need to worry about any ".." anymore because they have been eliminated.