Contao\Validator::isInsecurePath PHP Method

    public static function isInsecurePath($strPath)
    {
        // Normalize backslashes
        $strPath = strtr($strPath, '\\', '/');
        $strPath = preg_replace('#//+#', '/', $strPath);
        // Equals ..
        if ($strPath == '..') {
            return true;
        }
        // Begins with ./
        if (substr($strPath, 0, 2) == './') {
            return true;
        }
        // Begins with ../
        if (substr($strPath, 0, 3) == '../') {
            return true;
        }
        // Ends with /.
        if (substr($strPath, -2) == '/.') {
            return true;
        }
        // Ends with /..
        if (substr($strPath, -3) == '/..') {
            return true;
        }
        // Contains /../
        if (strpos($strPath, '/../') !== false) {
            return true;
        }
        return false;
    }

 /**
  * Find a particular template file and return its path
  *
  * @param string $strTemplate The name of the template
  * @param string $strFormat   The file extension
  *
  * @return string The path to the template file
  *
  * @throws \InvalidArgumentException If $strFormat is unknown
  * @throws \RuntimeException         If the template group folder is insecure
  */
 public static function getTemplate($strTemplate, $strFormat = 'html5')
 {
     $arrAllowed = trimsplit(',', \Config::get('templateFiles'));
     array_push($arrAllowed, 'html5');
     // see #3398
     if (!in_array($strFormat, $arrAllowed)) {
         throw new \InvalidArgumentException('Invalid output format ' . $strFormat);
     }
     $strTemplate = basename($strTemplate);
     // Check for a theme folder
     if (TL_MODE == 'FE') {
         /** @var \PageModel $objPage */
         global $objPage;
         if ($objPage->templateGroup != '') {
             if (\Validator::isInsecurePath($objPage->templateGroup)) {
                 throw new \RuntimeException('Invalid path ' . $objPage->templateGroup);
             }
             return \TemplateLoader::getPath($strTemplate, $strFormat, $objPage->templateGroup);
         }
     }
     return \TemplateLoader::getPath($strTemplate, $strFormat);
 }