diff --git a/gyp/mbgl-android.gypi b/gyp/mbgl-android.gypi
index 0725ea3e4..84ec2f99e 100644
--- a/gyp/mbgl-android.gypi
+++ b/gyp/mbgl-android.gypi
@@ -36,7 +36,7 @@
         '../platform/android/cache_database_data.cpp',
         '../platform/android/shader_cache_data.cpp',
         '../platform/android/log_android.cpp',
-        '../platform/android/asset_request_baton_libzip.cpp',
+        '../platform/android/asset_request_libzip.cpp',
         '../platform/default/string_stdlib.cpp',
         '../platform/default/http_request_baton_curl.cpp',
         '../platform/default/image.cpp',
@@ -46,6 +46,7 @@
       ],
       'include_dirs': [
         '../include',
+        '../src',
       ],
       'link_settings': {
         'libraries': [
diff --git a/gyp/mbgl-linux.gypi b/gyp/mbgl-linux.gypi
index 9501950d9..d9268d920 100644
--- a/gyp/mbgl-linux.gypi
+++ b/gyp/mbgl-linux.gypi
@@ -41,7 +41,6 @@
         '../platform/default/image_reader.cpp',
         '../platform/default/png_reader.cpp',
         '../platform/default/jpeg_reader.cpp',
-        '../platform/default/asset_request_baton_noop.cpp',
       ],
       'include_dirs': [
         '../include',
diff --git a/platform/android/asset_request_baton_libzip.cpp b/platform/android/asset_request_baton_libzip.cpp
deleted file mode 100644
index 8984aa58d..000000000
--- a/platform/android/asset_request_baton_libzip.cpp
+++ /dev/null
@@ -1,93 +0,0 @@
-#include <mbgl/mbgl.hpp>
-#include <mbgl/android/jni.hpp>
-#include <mbgl/storage/asset_request_baton.hpp>
-#include <mbgl/storage/response.hpp>
-#include <mbgl/util/std.hpp>
-
-#include <cerrno>
-// NOTE a bug in the Android NDK breaks std::errno
-// See https://code.google.com/p/android/issues/detail?id=72349
-// After this is fixed change usage errno to std::errno
-#include <zip.h>
-
-namespace mbgl {
-
-void AssetRequestBaton::run(AssetRequestBaton *ptr) {
-    assert(std::this_thread::get_id() == ptr->threadId);
-
-    if (ptr->canceled || !ptr->request) {
-        // Either the AssetRequest object has been destructed, or the
-        // request was canceled.
-        cleanup(ptr);
-        return;
-    }
-
-    int error = 0;
-    struct zip *apk = zip_open(mbgl::android::apkPath.c_str(), 0, &error);
-    if ((apk == nullptr) || ptr->canceled || !ptr->request) {
-        // Opening the APK failed or was canceled. There isn't much left we can do.
-        const int messageSize = zip_error_to_str(nullptr, 0, error, errno);
-        const std::unique_ptr<char[]> message = mbgl::util::make_unique<char[]>(messageSize);
-        zip_error_to_str(message.get(), 0, error, errno);
-        notifyError(ptr, 500, message.get());
-        cleanup(ptr);
-        return;
-    }
-
-    std::string apkFilePath = "assets/" + ptr->path;
-    struct zip_file *apkFile = zip_fopen(apk, apkFilePath.c_str(), ZIP_FL_NOCASE);
-    if ((apkFile == nullptr) || ptr->canceled || !ptr->request) {
-        // Opening the asset failed or was canceled. We already have an open file handle
-        // though, which we'll have to close.
-        zip_error_get(apk, &error, nullptr);
-        notifyError(ptr, error == ZIP_ER_NOENT ? 404 : 500, zip_strerror(apk));
-        zip_close(apk);
-        apk = nullptr;
-        cleanup(ptr);
-        return;
-    }
-
-    struct zip_stat stat;
-    if ((zip_stat(apk, apkFilePath.c_str(), ZIP_FL_NOCASE, &stat) != 0) || ptr->canceled || !ptr->request) {
-        // Stating failed or was canceled. We already have an open file handle
-        // though, which we'll have to close.
-        notifyError(ptr, 500, zip_strerror(apk));
-        zip_fclose(apkFile);
-        apkFile = nullptr;
-        zip_close(apk);
-        apk = nullptr;
-        cleanup(ptr);
-        return;
-    }
-
-    const std::unique_ptr<char[]> data = mbgl::util::make_unique<char[]>(stat.size);
-
-    if (static_cast<zip_uint64_t>(zip_fread(apkFile, reinterpret_cast<void *>(data.get()), stat.size)) != stat.size || ptr->canceled || !ptr->request) {
-        // Reading failed or was canceled. We already have an open file handle
-        // though, which we'll have to close.
-        notifyError(ptr, 500, zip_file_strerror(apkFile));
-        zip_fclose(apkFile);
-        apkFile = nullptr;
-        zip_close(apk);
-        apk = nullptr;
-        cleanup(ptr);
-        return;
-    }
-
-    std::string body(data.get(), stat.size);
-    notifySuccess(ptr, body);
-
-    if (zip_fclose(apkFile) != 0) {
-        // Closing the asset failed. But there isn't anything we can do.
-    }
-    apkFile = nullptr;
-
-    if (zip_close(apk) != 0) {
-        // Closing the APK failed. But there isn't anything we can do.
-    }
-    apk = nullptr;
-
-    cleanup(ptr);
-}
-
-}
diff --git a/platform/android/asset_request_libzip.cpp b/platform/android/asset_request_libzip.cpp
new file mode 100644
index 000000000..77f9ae7da
--- /dev/null
+++ b/platform/android/asset_request_libzip.cpp
@@ -0,0 +1,202 @@
+#include <mbgl/android/jni.hpp>
+#include <mbgl/storage/asset_request.hpp>
+#include <mbgl/storage/response.hpp>
+#include <mbgl/util/uv_detail.hpp>
+#include <mbgl/util/std.hpp>
+
+#include <cerrno>
+// NOTE a bug in the Android NDK breaks std::errno
+// See https://code.google.com/p/android/issues/detail?id=72349
+// After this is fixed change usage errno to std::errno
+#include <zip.h>
+
+namespace mbgl {
+
+struct AssetRequestBaton {
+    AssetRequestBaton(AssetRequest *request_, const std::string &path, uv_loop_t *loop);
+    ~AssetRequestBaton();
+
+    const std::thread::id threadId;
+    AssetRequest *request = nullptr;
+    std::unique_ptr<uv::async> asyncRun;
+    std::string path;
+    bool canceled = false;
+
+    void cancel();
+    static void notifyError(AssetRequestBaton *ptr, const int code, const char *message);
+    static void notifySuccess(AssetRequestBaton *ptr, const std::string body);
+    static void cleanup(AssetRequestBaton *ptr);
+    static void run(AssetRequestBaton *ptr);
+};
+
+AssetRequestBaton::AssetRequestBaton(AssetRequest *request_, const std::string &path_, uv_loop_t *loop)
+: threadId(std::this_thread::get_id()),
+request(request_),
+path(path_) {
+
+    asyncRun = mbgl::util::make_unique<uv::async>(loop,  [this]() {
+        run(this);
+    });
+
+    asyncRun->send();
+}
+
+AssetRequestBaton::~AssetRequestBaton() {
+}
+
+void AssetRequestBaton::cancel() {
+    canceled = true;
+}
+
+void AssetRequestBaton::notifyError(AssetRequestBaton *ptr, const int code, const char *message) {
+    assert(std::this_thread::get_id() == ptr->threadId);
+
+    if (ptr->request && !ptr->canceled) {
+        ptr->request->response = std::unique_ptr<Response>(new Response);
+        ptr->request->response->code = code;
+        ptr->request->response->message = message;
+        ptr->request->notify();
+    }
+}
+
+void AssetRequestBaton::notifySuccess(AssetRequestBaton *ptr, const std::string body) {
+    assert(std::this_thread::get_id() == ptr->threadId);
+
+    if (ptr->request && !ptr->canceled) {
+        ptr->request->response = std::unique_ptr<Response>(new Response);
+        ptr->request->response->code = 200;
+        ptr->request->response->data = body;
+        ptr->request->notify();
+    }
+}
+
+void AssetRequestBaton::cleanup(AssetRequestBaton *ptr) {
+    assert(std::this_thread::get_id() == ptr->threadId);
+
+    if (ptr->request) {
+        ptr->request->ptr = nullptr;
+    }
+
+    ptr->asyncRun.reset();
+
+    delete ptr;
+    ptr = nullptr;
+}
+
+void AssetRequestBaton::run(AssetRequestBaton *ptr) {
+    assert(std::this_thread::get_id() == ptr->threadId);
+
+    if (ptr->canceled || !ptr->request) {
+        // Either the AssetRequest object has been destructed, or the
+        // request was canceled.
+        cleanup(ptr);
+        return;
+    }
+
+    int error = 0;
+    struct zip *apk = zip_open(mbgl::android::apkPath.c_str(), 0, &error);
+    if ((apk == nullptr) || ptr->canceled || !ptr->request) {
+        // Opening the APK failed or was canceled. There isn't much left we can do.
+        const int messageSize = zip_error_to_str(nullptr, 0, error, errno);
+        const std::unique_ptr<char[]> message = mbgl::util::make_unique<char[]>(messageSize);
+        zip_error_to_str(message.get(), 0, error, errno);
+        notifyError(ptr, 500, message.get());
+        cleanup(ptr);
+        return;
+    }
+
+    std::string apkFilePath = "assets/" + ptr->path;
+    struct zip_file *apkFile = zip_fopen(apk, apkFilePath.c_str(), ZIP_FL_NOCASE);
+    if ((apkFile == nullptr) || ptr->canceled || !ptr->request) {
+        // Opening the asset failed or was canceled. We already have an open file handle
+        // though, which we'll have to close.
+        zip_error_get(apk, &error, nullptr);
+        notifyError(ptr, error == ZIP_ER_NOENT ? 404 : 500, zip_strerror(apk));
+        zip_close(apk);
+        apk = nullptr;
+        cleanup(ptr);
+        return;
+    }
+
+    struct zip_stat stat;
+    if ((zip_stat(apk, apkFilePath.c_str(), ZIP_FL_NOCASE, &stat) != 0) || ptr->canceled || !ptr->request) {
+        // Stating failed or was canceled. We already have an open file handle
+        // though, which we'll have to close.
+        notifyError(ptr, 500, zip_strerror(apk));
+        zip_fclose(apkFile);
+        apkFile = nullptr;
+        zip_close(apk);
+        apk = nullptr;
+        cleanup(ptr);
+        return;
+    }
+
+    const std::unique_ptr<char[]> data = mbgl::util::make_unique<char[]>(stat.size);
+
+    if (static_cast<zip_uint64_t>(zip_fread(apkFile, reinterpret_cast<void *>(data.get()), stat.size)) != stat.size || ptr->canceled || !ptr->request) {
+        // Reading failed or was canceled. We already have an open file handle
+        // though, which we'll have to close.
+        notifyError(ptr, 500, zip_file_strerror(apkFile));
+        zip_fclose(apkFile);
+        apkFile = nullptr;
+        zip_close(apk);
+        apk = nullptr;
+        cleanup(ptr);
+        return;
+    }
+
+    std::string body(data.get(), stat.size);
+    notifySuccess(ptr, body);
+
+    if (zip_fclose(apkFile) != 0) {
+        // Closing the asset failed. But there isn't anything we can do.
+    }
+    apkFile = nullptr;
+
+    if (zip_close(apk) != 0) {
+        // Closing the APK failed. But there isn't anything we can do.
+    }
+    apk = nullptr;
+
+    cleanup(ptr);
+}
+
+AssetRequest::AssetRequest(const std::string &path_, uv_loop_t *loop)
+: BaseRequest(path_) {
+    if (!path.empty() && path[0] == '/') {
+        // This is an absolute path. We don't allow this. Note that this is not a way to absolutely
+        // prevent access to resources outside the application bundle; e.g. there could be symlinks
+        // in the application bundle that link to outside. We don't care about these.
+        response = util::make_unique<Response>();
+        response->code = 403;
+        response->message = "Path is outside the application bundle";
+        notify();
+    } else {
+        // Note: The AssetRequestBaton object is deleted in AssetRequestBaton::cleanup().
+        ptr = new AssetRequestBaton(this, path, loop);
+    }
+}
+
+void AssetRequest::cancel() {
+    assert(std::this_thread::get_id() == threadId);
+
+    if (ptr) {
+        ptr->cancel();
+
+        // When deleting a AssetRequest object with a uv_fs_* call is in progress, we are making sure
+        // that the callback doesn't accidentally reference this object again.
+        ptr->request = nullptr;
+        ptr = nullptr;
+    }
+
+    notify();
+}
+
+AssetRequest::~AssetRequest() {
+    assert(std::this_thread::get_id() == threadId);
+    cancel();
+
+    // Note: The AssetRequestBaton object is deleted in AssetRequestBaton::cleanup().
+}
+
+}
diff --git a/platform/default/asset_request_baton_noop.cpp b/platform/default/asset_request_baton_noop.cpp
deleted file mode 100644
index 79f69a2da..000000000
--- a/platform/default/asset_request_baton_noop.cpp
+++ /dev/null
@@ -1,22 +0,0 @@
-#include <mbgl/mbgl.hpp>
-#include <mbgl/storage/asset_request_baton.hpp>
-#include <mbgl/storage/response.hpp>
-
-namespace mbgl {
-
-void AssetRequestBaton::run(AssetRequestBaton *ptr) {
-    assert(std::this_thread::get_id() == ptr->threadId);
-
-    if (ptr->canceled || !ptr->request) {
-        // Either the AssetRequest object has been destructed, or the
-        // request was canceled.
-        cleanup(ptr);
-        return;
-    }
-
-    // Just return a 500 error until implemented properly
-    notifyError(ptr, 500, "Assets not implemented on this platform.");
-    cleanup(ptr);
-}
-
-}
diff --git a/platform/default/asset_request_libuv.cpp b/platform/default/asset_request_libuv.cpp
index c77bb57de..0e0b7280a 100644
--- a/platform/default/asset_request_libuv.cpp
+++ b/platform/default/asset_request_libuv.cpp
@@ -30,16 +30,8 @@ struct AssetRequestBaton {
     uv_buf_t buffer;
 };
 
-void AssetRequestBaton::run(AssetRequestBaton *ptr) {
-    assert(std::this_thread::get_id() == ptr->threadId);
-
-    if (ptr->canceled || !ptr->request) {
-        // Either the AssetRequest object has been destructed, or the
-        // request was canceled.
-        cleanup(ptr);
-        return;
-    }
-
+AssetRequestBaton::AssetRequestBaton(AssetRequest *request_, const std::string &path, uv_loop_t *loop)
+    : threadId(std::this_thread::get_id()), request(request_) {
     req.data = this;
     uv_fs_open(loop, &req, path.c_str(), O_RDONLY, S_IRUSR, fileOpened);
 }
@@ -56,17 +48,11 @@ void AssetRequestBaton::cancel() {
     uv_cancel((uv_req_t *)&req);
 }
 
-void AssetRequestBaton::run(AssetRequestBaton *ptr) {
+void AssetRequestBaton::notifyError(uv_fs_t *req) {
+    AssetRequestBaton *ptr = reinterpret_cast<AssetRequestBaton *>(req->data);
     assert(std::this_thread::get_id() == ptr->threadId);
 
-    if (ptr->canceled || !ptr->request) {
-        // Either the AssetRequest object has been destructed, or the
-        // request was canceled.
-        cleanup(ptr);
-        return;
-    }
-
-    rf (ptr->request && req->result < 0 && !ptr->canceled && req->result != UV_ECANCELED) {
+    if (ptr->request && req->result < 0 && !ptr->canceled && req->result != UV_ECANCELED) {
         ptr->request->response = util::make_unique<Response>();
         ptr->request->response->code = req->result == UV_ENOENT ? 404 : 500;
 #if UV_VERSION_MAJOR == 0 && UV_VERSION_MINOR <= 10
diff --git a/src/mbgl/storage/asset_request.cpp b/src/mbgl/storage/asset_request.cpp
deleted file mode 100644
index e4684b10f..000000000
--- a/src/mbgl/storage/asset_request.cpp
+++ /dev/null
@@ -1,37 +0,0 @@
-#include <mbgl/storage/asset_request.hpp>
-#include <mbgl/storage/asset_request_baton.hpp>
-#include <mbgl/storage/response.hpp>
-
-#include <uv.h>
-
-#include <cassert>
-
-#include <unistd.h>
-
-namespace mbgl {
-
-AssetRequest::AssetRequest(const std::string &path_, uv_loop_t *loop)
-    : BaseRequest(path_), ptr(new AssetRequestBaton(this, path, loop)) {
-}
-
-void AssetRequest::cancel() {
-    assert(std::this_thread::get_id() == threadId);
-
-    if (ptr) {
-        ptr->cancel();
-
-        // When deleting a AssetRequest object with a uv_fs_* call is in progress, we are making sure
-        // that the callback doesn't accidentally reference this object again.
-        ptr->request = nullptr;
-        ptr = nullptr;
-    }
-
-    notify();
-}
-
-AssetRequest::~AssetRequest() {
-    assert(std::this_thread::get_id() == threadId);
-    cancel();
-}
-
-}
diff --git a/src/mbgl/storage/asset_request_baton.cpp b/src/mbgl/storage/asset_request_baton.cpp
deleted file mode 100644
index 85f3a6ff2..000000000
--- a/src/mbgl/storage/asset_request_baton.cpp
+++ /dev/null
@@ -1,60 +0,0 @@
-#include <mbgl/storage/asset_request_baton.hpp>
-#include <mbgl/storage/asset_request.hpp>
-#include <mbgl/storage/response.hpp>
-#include <mbgl/util/std.hpp>
-#include <mbgl/util/uv_detail.hpp>
-
-namespace mbgl {
-
-AssetRequestBaton::AssetRequestBaton(AssetRequest *request_, const std::string &path_, uv_loop_t *loop)
-    : threadId(std::this_thread::get_id()),
-      request(request_),
-      path(path_) {
-
-    asyncRun = mbgl::util::make_unique<uv::async>(loop,  [this]() {
-        run(this);
-    });
-
-    asyncRun->send();
-}
-
-void AssetRequestBaton::cancel() {
-    canceled = true;
-}
-
-void AssetRequestBaton::notifyError(AssetRequestBaton *ptr, const int code, const char *message) {
-    assert(std::this_thread::get_id() == ptr->threadId);
-
-    if (ptr->request && !ptr->canceled) {
-        ptr->request->response = std::unique_ptr<Response>(new Response);
-        ptr->request->response->code = code;
-        ptr->request->response->message = message;
-        ptr->request->notify();
-    }
-}
-
-void AssetRequestBaton::notifySuccess(AssetRequestBaton *ptr, const std::string body) {
-assert(std::this_thread::get_id() == ptr->threadId);
-
-    if (ptr->request && !ptr->canceled) {
-        ptr->request->response = std::unique_ptr<Response>(new Response);
-        ptr->request->response->code = 200;
-        ptr->request->response->data = body;
-        ptr->request->notify();
-    }
-}
-
-void AssetRequestBaton::cleanup(AssetRequestBaton *ptr) {
-    assert(std::this_thread::get_id() == ptr->threadId);
-
-    if (ptr->request) {
-        ptr->request->ptr = nullptr;
-    }
-
-    ptr->asyncRun.reset();
-
-    delete ptr;
-    ptr = nullptr;
-}
-
-}