fix viewPath' bug, improve code

nobody will use it in unsafe way in their own code, and node process should not have the permission to access the path like `/usr/bin` on any server,  there's no necessary to worry about the "safe" issue.