// https://github.com/tower-rs/tower-http/blob/053f5a5c939dde38cb93404b579854bc8f2fad88/tower-http/src/services/fs/serve_dir.rs#L136-L161
fn build_and_validate_path(base_path: &Path, requested_path: &str) -> anyhow::Result<PathBuf> {
    let path = requested_path.trim_start_matches('/');

    let path_decoded = urlencoding::decode(path)?.into_owned();
    let path_decoded = Path::new(&path_decoded);

    let mut full_path = base_path.to_path_buf();
    for component in path_decoded.components() {
        match component {
            Component::Normal(comp) => {
                // protect against paths like `/foo/c:/bar/baz` (#204)
                if Path::new(&comp)
                    .components()
                    .all(|c| matches!(c, Component::Normal(_)))
                {
                    full_path.push(comp)
                } else {
                    return Err(anyhow!("Bad path component"));
                }
            }
            Component::CurDir => {}
            Component::Prefix(_) | Component::RootDir | Component::ParentDir => return Err(anyhow!("RootDir and ParentDir is not allowed")),
        }
    }
    Ok(full_path)
}