code: private void validatePathname(String pathname) {
      File file = new File(storageDir, pathname);
  
      String canonicalPath;
      try {
        canonicalPath = file.getCanonicalPath();
      } catch (IOException e) {
        throw new UncheckedIOException(e);
      }
      if (!canonicalPath.startsWith(storageDir)) {
        throw new UncheckedIOException(new IOException("File path traversal not allowed"));
      }
    }
docs: http://cwe.mitre.org/data/definitions/22.html