Add note for mg_http_serve_dir()

docs/README.md

@@ -912,6 +912,10 @@ void mg_http_serve_dir(struct mg_connection *c, struct mg_http_message *hm,
 Serve static files according to the given options. Note that in order to
 enable SSI, set a `-DMG_ENABLE_SSI=1` build flag.
 
+<span class="badge bg-danger">NOTE: </span> Avoid double dots `..` in
+the `root_dir`. If you need to
+reference an upper-level directory, use absolute path.
+
 Parameters:
 - `c` - Connection to use
 - `hm` - HTTP message, that should be served

examples/http-server/main.c

@@ -5,7 +5,7 @@
 #include "mongoose.h"
 
 static const char *s_debug_level = "2";
-static const char *s_root_dir = ".";
+static const char *s_root_dir = ".";  // Attention: avoid double-dots, `..` !
 static const char *s_listening_address = "http://localhost:8000";
 static const char *s_enable_hexdump = "no";