It would be nice to have the path sanity checking logic introduced for runtime in https://github.com/envoyproxy/envoy/pull/3165 plumbed across various sites where we access files via path.