in src/main/java/org/apache/sling/scripting/sightly/engine/ResourceResolution.java [145:156]
private static Resource locateInSearchPath(ResourceResolver resourceResolver, String path) {
for (String searchPath : resourceResolver.getSearchPath()) {
String fullPath = ResourceUtil.normalize(searchPath + path);
if (fullPath != null) {
Resource resource = resourceResolver.getResource(fullPath);
if (resource != null && resource.getPath().startsWith(searchPath)) { //prevent path traversal attack
return resource;
}
}
}
return null;
}