$filePath = realpath( "$branchDir/$path" );
                if ( !$filePath ) { 
                        continue;
                }   

                if ( strpos( $filePath, $branchDir ) !== 0 ) { 
                        wmfStaticShowError( 'Bad request', 400 );
                        return;
                }
[...]
                wmfStaticShowError( 'Unknown file path', 404, 300 );
                $stats->increment( 'wmfstatic.notfound' );
                return;