I get it. (may be split('/') the project and deploy directory into an array then loop through the deploy directory array and pop() the project directory array for each '..' and push() an item for everything else, then check the result and see if your still in the project directory.)
However I found myself now saving the XDS file in the httpdocs/v5 folder, so that I dont have to deploy anymore. I dont mind so much having an XDS file viewable for the world. Or should I mind it?