private static @Nullable Set<String> allowedRoots() {
    if (insideGettingRoots) return null;

    Project[] openProjects = ProjectManager.getInstance().getOpenProjects();
    if (openProjects.length == 0) return null;

    Set<String> allowed = CollectionFactory.createFilePathSet();
    allowed.add(FileUtil.toSystemIndependentName(PathManager.getHomePath()));

    // In plugin development environment PathManager.getHomePath() returns path like "~/.IntelliJIdea/system/plugins-sandbox/test" when running tests
    // The following is to avoid errors in tests like "File accessed outside allowed roots: file://C:/Program Files/idea/lib/idea.jar"
    String homePath2 = PathManager.getHomePathFor(Application.class);
    if (homePath2 != null) {
      allowed.add(FileUtil.toSystemIndependentName(homePath2));
    }

    try {
      URL outUrl = Application.class.getResource("/");
      if (outUrl != null) {
        String output = new File(outUrl.toURI()).getParentFile().getParentFile().getPath();
        allowed.add(FileUtil.toSystemIndependentName(output));
      }
    }
    catch (URISyntaxException | IllegalArgumentException ignored) { }

    try {
      allowed.add(FileUtil.toSystemIndependentName(getJavaHome()));
      allowed.add(FileUtil.toSystemIndependentName(FileUtil.getTempDirectory()));
      allowed.add(FileUtil.toSystemIndependentName(System.getProperty("java.io.tmpdir")));
      Arrays.stream(System.getProperty("vfs.additional-allowed-roots", "").split(":"))
        .filter(Predicate.not(String::isBlank))
        .map(FileUtil::toSystemIndependentName)
        .forEach(allowed::add);

      String userHome = FileUtil.toSystemIndependentName(SystemProperties.getUserHome());
      allowed.add(userHome);

      String mavenHome = resolvedPath(userHome + "/.m2");
      if (!mavenHome.startsWith(userHome + '/')) {
        allowed.add(mavenHome);
      }
      mavenHome = resolvedPath(userHome + "/.m2/repository");
      if (!mavenHome.startsWith(userHome + '/')) {
        allowed.add(mavenHome);
      }

      String gradleHome = resolvedPath(userHome + "/.gradle");
      if (gradleHome.startsWith(userHome + '/')) {
        allowed.add(gradleHome);
      }
      gradleHome = System.getenv("GRADLE_USER_HOME");
      if (gradleHome != null) {
        allowed.add(FileUtil.toSystemIndependentName(gradleHome));
      }

      if (SystemInfo.isWindows) {
        String wslName = System.getProperty("wsl.distribution.name");
        if (wslName != null) {
          allowed.add(FileUtil.toSystemIndependentName("\\\\wsl$\\" + wslName));
        }
      }
      else {
        // see IDEA-167037 (The assertion "File accessed outside allowed root" is triggered by files symlinked from a JDK directory)
        allowed.add("/etc");
        allowed.add("/private/etc");
        allowed.add("/usr/lib/jvm");
      }

      for (final Project project : openProjects) {
        if (!project.isInitialized()) {
          return null; // all is allowed
        }
        ReadAction.run(() -> {
          for (String url : ProjectRootManager.getInstance(project).getContentRootUrls()) {
            allowed.add(VfsUtilCore.urlToPath(url));
          }
          for (Module module : ModuleManager.getInstance(project).getModules()) {
            Sdk moduleSdk = ModuleRootManager.getInstance(module).getSdk();
            if (moduleSdk != null) {
              String homePath = moduleSdk.getHomePath();
              if (homePath != null) {
                allowed.add(homePath);
              }
            }
          }
          for (String url : getAllRootUrls(project)) {
            allowed.add(StringUtil.trimEnd(VfsUtilCore.urlToPath(url), JarFileSystem.JAR_SEPARATOR));
          }
          String location = project.getBasePath();
          assert location != null : project;
          allowed.add(FileUtil.toSystemIndependentName(location));
        });
      }
    }
    catch (Error ignored) {
      // sometimes `library.getRoots()` may crash if called during library modification
    }

    synchronized (ourAdditionalRoots) {
      allowed.addAll(ourAdditionalRoots);
    }

    assert !allowed.contains("/"): "Allowed roots should not contain '/'. " +
                                   "You can disable roots access check explicitly if you don't need it.";
    return allowed;
  }
private static @Nullable Set<String> allowedRoots()