fix(path-traversal): add regex to prevent path traversal attack#1828