More paranoia against directory traversal