The test doesn't catch strings that only have one ".." at the beginning. So "../foo" passes the test while "../../foo" is caught by it.
The test doesn't catch strings that only have one ".." at the beginning.
So "../foo" passes the test while "../../foo" is caught by it.