Language: Python
Label: vulnerable
CWE: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Code:
    def get_snippet_path(self, path):
        """Get snippet path."""

        snippet = None
        for base in self.base_path:
            if os.path.exists(base):
                if os.path.isdir(base):
                    filename = os.path.join(base, path)
                    if os.path.exists(filename):
                        snippet = filename
                        break
                else:
                    basename = os.path.basename(base)
                    dirname = os.path.dirname(base)
                    if basename.lower() == path.lower():
                        filename = os.path.join(dirname, path)
                        if os.path.exists(filename):
                            snippet = filename
                            break
        return snippet