fix path traversal prevention bug