question: public String resolvePath ( String pathInfo ) { if ( ( pathInfo == null ) || ( pathInfo . indexOf ( ".." ) != - 1 ) ) { return null ; } int libStart = pathInfo . indexOf ( '/' ) + 1 ; int libEnd = pathInfo . indexOf ( '/' , libStart ) ; if ( libEnd == - 1 ) { libEnd = pathInfo . length ( ) ; } String libname = pathInfo . substring ( libStart , libEnd ) ; String subpath = pathInfo . substring ( libEnd ) ; String lib_home = getPath ( libname ) ; if ( lib_home == null ) { return null ; } return lib_home + "/" + subpath ; }
target:  Return a file object that the path resolves to. Performs some minimal checks to try and prevent an attacker from feeding in urls that cause the servlets to climb out of their sandbox. A better option is to use a servlet container with the ability to restrict servlet file access. For example, Apache Software Foundation's Tomcat 5 Servlet/JSP Container running with the -security flag.