fix: decode path to avoid bypassing security checks

fix: decode path to avoid bypassing security checks #15