Language: Python
Label: vulnerable
CWE: CWE-29 \u2014 Path Traversal: '\..\filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.

Code:
def is_local_uri(uri, is_tracking_or_registry_uri=True):
    """
    Returns true if the specified URI is a local file path (/foo or file:/foo).

    :param uri: The URI.
    :param is_tracking_uri: Whether or not the specified URI is an MLflow Tracking or MLflow
                            Model Registry URI. Examples of other URIs are MLflow artifact URIs,
                            filesystem paths, etc.
    """
    if uri == "databricks" and is_tracking_or_registry_uri:
        return False

    if is_windows() and uri.startswith("\\\\"):
        # windows network drive path looks like: "\\<server name>\path\..."
        return False

    parsed_uri = urllib.parse.urlparse(uri)
    if parsed_uri.hostname and not (
        parsed_uri.hostname == "."
        or parsed_uri.hostname.startswith("localhost")
        or parsed_uri.hostname.startswith("127.0.0.1")
    ):
        return False

    scheme = parsed_uri.scheme
    if scheme == "" or scheme == "file":
        return True

    if is_windows() and len(scheme) == 1 and scheme.lower() == pathlib.Path(uri).drive.lower()[0]:
        return True

    return False