Language: JavaScript
Label: safe
CWE: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Code:
usersAPI.generateExport = async (caller, { uid, type }) => {
	const validTypes = ['profile', 'posts', 'uploads'];
	if (!validTypes.includes(type)) {
		throw new Error('[[error:invalid-data]]');
	}
	const count = await db.incrObjectField('locks', `export:${uid}${type}`);
	if (count > 1) {
		throw new Error('[[error:already-exporting]]');
	}

	const child = require('child_process').fork(`./src/user/jobs/export-${type}.js`, [], {
		env: process.env,
	});
	child.send({ uid });
	child.on('error', async (err) => {
		winston.error(err.stack);
		await db.deleteObjectField('locks', `export:${uid}${type}`);
	});
	child.on('exit', async () => {
		await db.deleteObjectField('locks', `export:${uid}${type}`);
		const userData = await user.getUserFields(uid, ['username', 'userslug']);
		const { displayname } = userData;
		const n = await notifications.create({
			bodyShort: `[[notifications:${type}-exported, ${displayname}]]`,
			path: `/api/user/${userData.userslug}/export/${type}`,
			nid: `${type}:export:${uid}`,
			from: uid,
		});
		await notifications.push(n, [caller.uid]);
		await events.log({
			type: `export:${type}`,
			uid: caller.uid,
			targetUid: uid,
			ip: caller.ip,
		});
	});
};