diff --git a/jspm_packages/github/mrdoob/three.js@r73/utils/servers/simplehttpserver.js b/jspm_packages/github/mrdoob/three.js@r73/utils/servers/simplehttpserver.js
index 25af726..edf53f3 100644
--- a/jspm_packages/github/mrdoob/three.js@r73/utils/servers/simplehttpserver.js
+++ b/jspm_packages/github/mrdoob/three.js@r73/utils/servers/simplehttpserver.js
@@ -23,6 +23,12 @@ var port = 8000,
 port = process.argv[2] ? parseInt(process.argv[2], 0) : port;
 
 function handleRequest(request, response) {
+    if (path.normalize(decodeURIComponent(urlObject.pathname)) !== decodeURIComponent(urlObject.pathname)) {
+        response.statusCode = 403;
+        response.end();
+        return;
+    }
+    
 
 	var urlObject = urlParser.parse(request.url, true);
 	var pathname = decodeURIComponent(urlObject.pathname);