BUG,SEC: realpath (path) function OS command injection