| In an application server, ClassLoader#getResource and ClassLoader#getResourceAsStream can be fooled by path traversal syntaxes (../) to go read files which are not really support to be part of the classloader. To make it easier to avoid this problem, it would be nice to produce a tool with a protection against that. |
