Language: Python
Label: vulnerable
CWE: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Code:
def test_list_artifacts_malicious_path(http_artifact_repo, path):
    with mock.patch(
        "mlflow.store.artifact.http_artifact_repo.http_request",
        return_value=MockResponse(
            {
                "files": [
                    {"path": path, "is_dir": False, "file_size": 1},
                ]
            },
            200,
        ),
    ):
        with pytest.raises(MlflowException, match=f"Invalid path: {path}"):
            http_artifact_repo.list_artifacts()