I had only the "../" case in mind but I wanted to avoid to introduce a major security gap with my first contribution so I chose the safest variant. If you are sure that there are no other possibilities to leave a given path by appending something and if you think it's worth to use only a single regex here I'll change it.