The maskingfilter still does some processing due to the fact that it accepts relative pathnames. This should ideally done by the core in a controlled manner and for all path parameters.