You'll note that I removed the check for `..` in `package_resource` above, because `pkg_resources` already disallows them (https://pythonhosted.org/setuptools/pkg_resources.html#basic-resource-access).