Language: TypeScript
Label: safe
CWE: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Code:
  async function getStreamingFile(req, res) {
    try {
      validateSessionId(req.params.folder);
      validateFilename(req.params.file);
      const filePath = path.join(gladys.config.tempFolder, req.params.folder, req.params.file);
      const filestream = fs.createReadStream(filePath);
      filestream.on('error', (err) => {
        res.status(404).end();
      });
      filestream.pipe(res);
    } catch (e) {
      if (e instanceof Error400) {
        throw e;
      }
      logger.warn(e);
      throw new Error404('FILE_NOT_FOUND');
    }
  }