in src/main/java/com/googlesource/gerrit/plugins/serverconfig/ServerConfigServlet.java [79:86]
public void doGet(HttpServletRequest req, HttpServletResponse res)
throws IOException {
if (!isAllowedPath(req)) {
res.setStatus(HttpServletResponse.SC_FORBIDDEN);
return;
}
streamFile(req, res);
}