I'm enabling sandboxing in my OS X app to resubmit to the app store and I'm trying to find the most elegant way to make sure the user can only select resources my app has permissions to change. 

Stripped down scenario: 

1. user selects a picture on the file system via an `NSOpenPanel`
2. user clicks the `Process Picture` button on the app
3. app retrieves information from the internet
4. app alters the picture's metadata.

After the user is done selecting the pictures, I want to make sure each one is located under the Pictures folder otherwise my write to the physical file will simply silently fail.

Apple [recommends the following to determine the Pictures folder's location:](http://developer.apple.com/library/mac/#documentation/General/Conceptual/MOSXAppProgrammingGuide/AppRuntime/AppRuntime.html)

> 
> The Pictures directory contains the user’s images and photos. To get
>  the path to this directory use the NSPicturesDirectory search path key
>  with the NSUserDomainMask domain.
> 
> 
> 

Implementing the above gives me a path that looks like this:
`/Users/thomas/Library/Containers/com.blazingfrog.latipics/Data/Pictures/picture1.jpg`

But when I want to see what pictures the user selected,`[myOpenPanel URLs]` returns `/Users/thomas/Pictures/picture1.jpg`

**These two paths are logically identical but look very different. How can I compare them in way that works every time?**

In case it helps, to prepare my app for sandboxing I did the following

* enabled Entitlements in XCode
* enabled App Sandboxing
* enabled File System (Read)
* enabled allowing Incoming/Outgoing Network Connections
* enabled Pictures Folder access (Read/Write)