FIX: unit test for directory traversal