code: protected boolean isInvalidPath(String path) {
  		if (path.contains("WEB-INF") || path.contains("META-INF")) {
  			if (logger.isWarnEnabled()) {
  				logger.warn("Path with \"WEB-INF\" or \"META-INF\": [" + path + "]");
  			}
  			return true;
  		}
  		if (path.contains(":/")) {
  			String relativePath = (path.charAt(0) == '/' ? path.substring(1) : path);
  			if (ResourceUtils.isUrl(relativePath) || relativePath.startsWith("url:")) {
  				if (logger.isWarnEnabled()) {
  					logger.warn(
  							"Path represents URL or has \"url:\" prefix: [" + path + "]");
  				}
  				return true;
  			}
  		}
  		if (path.contains("..") && StringUtils.cleanPath(path).contains("../")) {
  			if (logger.isWarnEnabled()) {
  				logger.warn("Path contains \"../\" after call to StringUtils#cleanPath: ["
  						+ path + "]");
  			}
  			return true;
  		}
  		return false;
  	}
docs: Identifies invalid resource paths. By default rejects:
  <ul>
  <li>Paths that contain "WEB-INF" or "META-INF"
  <li>Paths that contain "../" after a call to
  {@link org.springframework.util.StringUtils#cleanPath}.
  <li>Paths that represent a {@link org.springframework.util.ResourceUtils#isUrl
  valid URL} or would represent one after the leading slash is removed.
  </ul>
  <p>
  <strong>Note:</strong> this method assumes that leading, duplicate '/' or control
  characters (e.g. white space) have been trimmed so that the path starts predictably
  with a single '/' or does not have one.
  @param path the path to validate
  @return {@code true} if the path is invalid, {@code false} otherwise
  @since 3.0.6