So you mean the presence of .. in the url should result in an exception?

I don't think that it solves the problem it would be better to write the drivers so that no access to path outside the allowed is possible. This is, however, just my opinion.