private boolean isInvalidEncodedPath(String path) {
        if (path.contains("%")) {
            try {
                // Use URLDecoder (vs UriUtils) to preserve potentially decoded UTF-8 chars
                String decodedPath = URLDecoder.decode(path, "UTF-8");
                if (isInvalidPath(decodedPath)) {
                    return true;
                }
                decodedPath = processPath(decodedPath);
                if (isInvalidPath(decodedPath)) {
                    return true;
                }
            }
            catch (IllegalArgumentException | UnsupportedEncodingException ex) {
                // Should never happen...
            }
        }
        return false;
    }

protected boolean isInvalidPath(String path) {
        if (path.contains("WEB-INF") || path.contains("META-INF")) {
            if (logger.isWarnEnabled()) {
                logger.warn("Path with \"WEB-INF\" or \"META-INF\": [" + path + "]");
            }
            return true;
        }
        if (path.contains(":/")) {
            String relativePath = (path.charAt(0) == '/' ? path.substring(1) : path);
            if (ResourceUtils.isUrl(relativePath) || relativePath.startsWith("url:")) {
                if (logger.isWarnEnabled()) {
                    logger.warn("Path represents URL or has \"url:\" prefix: [" + path + "]");
                }
                return true;
            }
        }
        if (path.contains("..") && StringUtils.cleanPath(path).contains("../")) {
            if (logger.isWarnEnabled()) {
                logger.warn("Path contains \"../\" after call to StringUtils#cleanPath: [" + path + "]");
            }
            return true;
        }
        return false;
    }

synchronized String retrieve(String name, String profile, String label, String path,
            boolean resolvePlaceholders) throws IOException {
        if (name != null && name.contains("(_)")) {
            // "(_)" is uncommon in a git repo name, but "/" cannot be matched
            // by Spring MVC
            name = name.replace("(_)", "/");
        }
        if (label != null && label.contains("(_)")) {
            // "(_)" is uncommon in a git branch name, but "/" cannot be matched
            // by Spring MVC
            label = label.replace("(_)", "/");
        }

        // ensure InputStream will be closed to prevent file locks on Windows
        try (InputStream is = this.resourceRepository.findOne(name, profile, label, path)
                .getInputStream()) {
            String text = StreamUtils.copyToString(is, Charset.forName("UTF-8"));
            if (resolvePlaceholders) {
                Environment environment = this.environmentRepository.findOne(name,
                        profile, label);
                text = resolvePlaceholders(prepareEnvironment(environment), text);
            }
            return text;
        }
    }

@RequestMapping("/{name}/{profile}/{label}/**")
    public String retrieve(@PathVariable String name, @PathVariable String profile,
            @PathVariable String label, HttpServletRequest request,
            @RequestParam(defaultValue = "true") boolean resolvePlaceholders)
            throws IOException {
        String path = getFilePath(request, name, profile, label);
        return retrieve(name, profile, label, path, resolvePlaceholders);
    }