we could probably use a regexpr to check if path ist valid and not an code injection attack