That's a remarkably terrible way to implement a terminal.
It was never my intent to implement a terminal. The site does not execute any system commands at all on the server side. Pretty much, all commands are 'custom' or invented, to show stuff about me and stuff I've worked on (a long, long time ago). Nothing else.
We (DreamHost) don't have mod_pagespeed support out quite yet, but the feature should be available to our customers by the end of the day today, as soon as I flip the switch to turn it on. :)
Nice. The code was already checking for '..' on the path, but the condition was erroneous. Fixed now.
You might be better off getting the canonical path and then checking against a whitelist. E.g. `strpos(realpath($command_path), '/var/www/html/') === 0`.