Slightly different patch; don't let GeoServerResourceLoader resolve files outside the search path unless the caller explicitly specified a parent.