ninja-core/src/main/java/ninja/AssetsControllerHelper.java
public String normalizePathWithoutLeadingSlash(String fileName, boolean enforceUnixSeparator) {
        String fileNameNormalized = enforceUnixSeparator
                ? FilenameUtils.normalize(fileName, true)
                : FilenameUtils.normalize(fileName);
        return StringUtils.removeStart(fileNameNormalized, "/");
    }
public String normalizePathWithoutLeadingSlash(String fileName, boolean enforceUnixSeparator) {
        String fileNameNormalized = enforceUnixSeparator
                ? FilenameUtils.normalize(fileName, true)
                : FilenameUtils.normalize(fileName);
        return StringUtils.removeStart(fileNameNormalized, "/");
    }
If we get - for whatever reason - a relative URL like
assets/../conf/application.conf we expand that to the "real" path. In the
above case conf/application.conf.

You should then add the assets prefix.

Otherwise someone can create an attack and read all resources of our app.
If we expand and normalize the incoming path this is no longer possible.

@param fileName A potential "fileName"
@param enforceUnixSeparator If true it will force the usage of the unix separator '/'
If false it will use the separator of the underlying system.
usually '/' in case of unix and '\' in case of windows.
@return A normalized fileName.