../ is never allowed in the path