diff -r 99a34860c105 -r d938228c382e src/server/safs/pathcheck.c
--- a/src/server/safs/pathcheck.c	Wed Nov 02 19:19:01 2022 +0100
+++ b/src/server/safs/pathcheck.c	Sun Nov 06 15:53:32 2022 +0100
@@ -26,7 +26,7 @@
  * POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <ucx/string.h>
+#include <cx/string.h>
 
 #include "pathcheck.h"
 
@@ -41,6 +41,8 @@
 
 #include "../config/acl.h"
 
+#define PATHCHECK_MAX_TOKENS 2048
+
 int require_auth(pblock *pb, Session *sn, Request *rq) {
     char *user = pblock_findkeyval(pb_key_auth_user, rq->vars);
 
@@ -74,14 +76,13 @@
     }
     
     uint32_t access_mask = 0;
-    ssize_t n = 0;
-    sstr_t *rights = sstrsplit(sstr(mask_str), sstrn(",", 1), &n);
+    cxstring *rights = NULL;
+    ssize_t n = cx_strsplit_a(pool_allocator(sn->pool), cx_str(mask_str), (cxstring){",", 1}, PATHCHECK_MAX_TOKENS, &rights);
     for(int i=0;i<n;i++) {
-        sstr_t right = rights[i];
+        cxstring right = rights[i];
         access_mask = access_mask | accstr2int(right);
-        free(right.ptr);
     }
-    free(rights);
+    pool_free(sn->pool, rights);
     
     rq->aclreqaccess = access_mask;
     
@@ -132,8 +133,8 @@
         return REQ_ABORTED;
     }
     
-    ssize_t ni = 0;
-    sstr_t *names = sstrsplit(sstr(inames), S(","), &ni);
+    cxstring *names = NULL;
+    ssize_t ni = cx_strsplit_a(pool_allocator(sn->pool), cx_str(inames), (cxstring)CX_STR(","), PATHCHECK_MAX_TOKENS, &names);
     if(ni <= 0) {
         log_ereport(
                 LOG_MISCONFIG,
@@ -154,10 +155,10 @@
     
     char *path = pblock_findkeyval(pb_key_path, rq->vars);
     size_t pathlen = strlen(path);
-    sstr_t p = sstrn(path, pathlen);
+    cxstring p = cx_strn(path, pathlen);
     if(path[pathlen-1] == '/') {
         for(int i=0;i<ni;i++) {
-            sstr_t newpath = sstrcat(2, p, sstrtrim(names[i]));
+            cxmutstr newpath = cx_strcat(2, p, cx_strtrim(names[i]));
             struct stat s;
             if(!vfs_stat(vfs, newpath.ptr, &s)) {
                 pblock_kvinsert(
@@ -173,10 +174,7 @@
         }
     }
     
-    for(int i=0;i<ni;i++) {
-        free(names[i].ptr);
-    }
-    free(names);
+    pool_free(sn->pool, names);
     
     return ret;
 }