This is the documented intention of this variable and protects against
path traversal attacks, which are low-risk though because the variable
is only used in a Rake task and under administrator control.