avoid potential path traversal.