private boolean leavesRoot(File localBaseDirectory, String key) {
        try {
            Path targetPath = new File(localBaseDirectory, key).getCanonicalFile().toPath();
            Path rootPath = localBaseDirectory.getCanonicalFile().toPath();
            return !targetPath.startsWith(rootPath);
        } catch (IOException e) {
            throw new RuntimeException("Unable to canonicalize paths",  e);
        }
    }
Downloads all objects in the virtual directory designated by the
keyPrefix given to the destination directory given. All virtual
subdirectories will be downloaded recursively.
<p>
If you are downloading <a href="http://aws.amazon.com/kms/">Amazon Web Services
KMS</a>-encrypted objects, you need to specify the correct region of the
bucket on your client and configure Amazon Web Services Signature Version 4 for added
security. For more information on how to do this, see
http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingAWSSDK.html#
specify-signature-version
</p>

@param bucketName
           The bucket containing the virtual directory
@param keyPrefix
           The key prefix for the virtual directory, or null for the
           entire bucket. All subdirectories will be downloaded
           recursively.
@param destinationDirectory
           The directory to place downloaded files. Subdirectories will
           be created as necessary.
@param resumeOnRetry
           If set to true, upon an immediate retry of a failed object
           download, the <code>TransferManager</code> will resume the
           download from the current end of the file on disk.
@param filter
          If set, applies the filter to determine which keys to include
          in the download request. (default is include all).
aws-java-sdk-s3/src/main/java/com/amazonaws/services/s3/transfer/TransferManager.java