Fix vulnerabilities on traversal path

Add validation checks on embedded and external resources.
Patch uses path normalization and validate that the resolved
absolute path stays within a trusted directory.