Manually resolve path relatively to root_dir to prevent escape
#328
+193
−22
root_dir to prevent escape
#328