in src/main/java/com/googlesource/gerrit/plugins/serverconfig/ServerConfigServlet.java [172:178]
private boolean isAllowedPath(HttpServletRequest req) throws IOException {
Path p = resolvePath(req);
if (!Files.isRegularFile(p)) {
return false;
}
return isParent(sitePaths.etc_dir, p) || isParent(sitePaths.static_dir, p);
}