code: private function isValidPath($path)
      {
          $pathParts = explode('/', $path);
  
          if (!strncmp($path, '/', 1) ||
              array_search('..', $pathParts) !== false ||
              strpos($path, ':') !== false)
          {
              return false;
          }
  
          return true;
      }
docs: Test for valid filename path
  
  The .zip file is untrusted input.  We check for absolute path (i.e., leading slash),
  possible directory traversal attack (i.e., '..'), and use of PHP wrappers (i.e., ':').
  
  @param string $path
  
  @return boolean