diff --git a/src/main/java/com/googlesource/gerrit/plugins/serverconfig/ServerConfigServlet.java b/src/main/java/com/googlesource/gerrit/plugins/serverconfig/ServerConfigServlet.java
index 7e0e937..b93e2eb 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/serverconfig/ServerConfigServlet.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/serverconfig/ServerConfigServlet.java
@@ -14,6 +14,7 @@
 
 package com.googlesource.gerrit.plugins.serverconfig;
 
+import com.google.common.base.CharMatcher;
 import com.google.common.base.Charsets;
 import com.google.common.collect.LinkedHashMultimap;
 import com.google.common.collect.ListMultimap;
@@ -46,6 +47,8 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.text.MessageFormat;
 
 import javax.servlet.http.HttpServlet;
@@ -58,10 +61,7 @@
   private static final Logger log = LoggerFactory
       .getLogger(ServerConfigServlet.class);
 
-  private final File site_path;
-  private final File etc_dir;
-  private final File static_dir;
-  private final String gerrit_config_path;
+  private final SitePaths sitePaths;
   private final AuditService auditService;
   private final DynamicItem<WebSession> webSession;
   private final String pluginName;
@@ -72,20 +72,13 @@
     this.webSession = webSession;
     this.auditService = auditService;
     this.pluginName = pluginName;
-    this.site_path = sitePaths.site_path.toFile();
-    this.etc_dir = sitePaths.etc_dir.toFile();
-    this.static_dir = sitePaths.static_dir.toFile();
-    try {
-      this.gerrit_config_path = sitePaths.gerrit_config.toFile().getCanonicalPath();
-    } catch (IOException e) {
-      throw new RuntimeException(e);
-    }
+    this.sitePaths = sitePaths;
   }
 
   @Override
   public void doGet(HttpServletRequest req, HttpServletResponse res)
       throws IOException {
-    if (!isValidFile(req)) {
+    if (!isValidPath(req)) {
       res.setStatus(HttpServletResponse.SC_FORBIDDEN);
       return;
     }
@@ -95,7 +88,7 @@
   @Override
   public void doPut(HttpServletRequest req, HttpServletResponse res)
       throws IOException {
-    if (!isValidFile(req)) {
+    if (!isValidPath(req)) {
       res.setStatus(HttpServletResponse.SC_FORBIDDEN);
       return;
     }
@@ -108,7 +101,7 @@
 
   private void writeFileAndFireAuditEvent(HttpServletRequest req,
       HttpServletResponse res) throws IOException {
-    File oldFile = resolveFile(req);
+    File oldFile = resolvePath(req).toFile();
     File dir = oldFile.getParentFile();
     File newFile = File.createTempFile(oldFile.getName(), ".new", dir);
     streamRequestToFile(req, newFile);
@@ -173,31 +166,30 @@
   }
 
   private boolean isGerritConfig(HttpServletRequest req) throws IOException {
-    File f = resolveFile(req);
-    return gerrit_config_path.equals(f.getCanonicalPath());
+    return Files.isSameFile(sitePaths.gerrit_config, resolvePath(req));
   }
 
-  private boolean isValidFile(HttpServletRequest req) throws IOException {
-    File f = resolveFile(req);
-    if (!f.isFile()) {
+  private boolean isValidPath(HttpServletRequest req) throws IOException {
+    Path p = resolvePath(req);
+    if (!Files.isRegularFile(p)) {
       return false;
     }
-    return isParent(etc_dir, f) || isParent(static_dir, f);
+    return isParent(sitePaths.etc_dir, p) || isParent(sitePaths.static_dir, p);
   }
 
-  private File resolveFile(HttpServletRequest req) {
-    return new File(site_path, req.getServletPath() + req.getPathInfo());
+  private Path resolvePath(HttpServletRequest req) {
+    return sitePaths.resolve(CharMatcher.is('/').trimLeadingFrom(
+        req.getServletPath() + req.getPathInfo()));
   }
 
-  private boolean isParent(File parent, File child) throws IOException {
-    File p = parent.getCanonicalFile();
-    File c = child.getCanonicalFile();
+  private boolean isParent(Path parent, Path child) throws IOException {
+    Path p = child;
     for (;;) {
-      c = c.getParentFile();
-      if (c == null) {
+      p = p.getParent();
+      if (p == null) {
         return false;
       }
-      if (c.equals(p)) {
+      if (Files.isSameFile(p, parent)) {
         return true;
       }
     }
@@ -205,7 +197,7 @@
 
   private void streamFile(HttpServletRequest req, HttpServletResponse res)
       throws IOException {
-    File f = resolveFile(req);
+    File f = resolvePath(req).toFile();
     res.setStatus(HttpServletResponse.SC_OK);
     res.setContentType("application/octet-stream");
     res.setContentLength((int) f.length());
@@ -218,7 +210,7 @@
   private void writeFile(HttpServletRequest req, HttpServletResponse res)
       throws IOException {
     res.setStatus(HttpServletResponse.SC_NO_CONTENT);
-    streamRequestToFile(req, resolveFile(req));
+    streamRequestToFile(req, resolvePath(req).toFile());
   }
 
   private void streamRequestToFile(HttpServletRequest req, File file)