system: You are an expert security code reviewer. You will be shown a source code file. Your task is to name the single function or class that contains the specified CWE vulnerability.

OUTPUT FORMAT: Respond with the exact function or class name (no parentheses, no qualifiers, no module prefixes), wrapped in \boxed{...}. Example: `\boxed{salted_hmac}`. Output the boxed name ONLY -- no explanation, no other text.

user: ```python
from __future__ import annotations

import os
from io import BytesIO
from typing import List, Optional

import flask
from flask import Flask, redirect, render_template, request
from itsdangerous import URLSafeSerializer
from PIL import Image, ImageDraw, ImageFont

app = Flask(__name__, static_url_path="/media")

SECRET = "changeme"


def try_fonts(name:str, extensions: List[str], default: Optional[str] = None):
    for ext in extensions:
        path = os.path.join('fonts', f'{name}.{ext}')
        if os.path.exists(path):
            return path
    return default


def get_image_response(width, height, background="cccccc", foreground="666666", text=None, font=None, size=16):
    buf = BytesIO()
    img = Image.new("RGB", (width, height), "#" + background)

    # font
    draw = ImageDraw.Draw(img)

    fontfile = try_fonts(font, ['ttf','otf'], default='lobster.ttf')
    try:
        font = ImageFont.truetype(fontfile, size)
    except IOError:
        font = ImageFont.truetype("fonts/lobster.ttf", size)

    lines: List[str] = text.split("\\n")
    _, lines_height = font.getsize(lines[0])
    text_height = (height - (len(lines) * lines_height)) / 2
    for line in lines:
        w, h = font.getsize(line)
        draw.text(((width - w) / 2, text_height), line, "#" + foreground, font=font)
        text_height += lines_height

    img.save(buf, "PNG")

    resp = flask.make_response(buf.getvalue())
    resp.content_type = "image/jpeg"
    return resp


@app.route("/")
def home():
    return render_template("index.html")


@app.route("/c/<path:url>")
def create_short(url):
    s = URLSafeSerializer(SECRET)
    short = s.dumps(url)
    return redirect("/s/" + short)


@app.route("/s/<path:path>/")
def open_short(path):
    s = URLSafeSerializer(SECRET)
    short = s.loads(path)
    return redirect("/" + short)


@app.route(
    "/<int:width>/",
)
@app.route(
    "/<int:width>/<string:background>/",
)
@app.route(
    "/<int:width>/<string:background>/<string:foreground>/",
)
@app.route("/<int:width>x<int:height>/")
@app.route("/<int:width>x<int:height>/<string:background>/")
@app.route("/<int:width>x<int:height>/<string:background>/<string:foreground>/")
def fakeimg(
    width,
    height=None,
    background="cccccc",
    foreground="666666",
):
    if not height:
        height = width
    text = request.args.get("text", u"%s x %s" % (width, height))

    size = int(request.args.get("size", 16))
    font = request.args.get("font", "lobster")

    return get_image_response(width, height, background, foreground, text, font, size)


if __name__ == "__main__":
    app.run(debug=True)

```

Name the function or class in this code that contains a `CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')` vulnerability.
Answer: try_fonts