Language: Python
Label: vulnerable
CWE: CWE-23 \u2014 Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Code:
def normalized_uri(root_dir):
    """Attempt to make an LSP rootUri from a ContentsManager root_dir

    Special care must be taken around windows paths: the canonical form of
    windows drives and UNC paths is lower case
    """
    root_uri = pathlib.Path(root_dir).expanduser().resolve().as_uri()
    root_uri = re.sub(
        RE_PATH_ANCHOR, lambda m: "file://{}".format(m.group(1).lower()), root_uri
    )
    return root_uri