Language: Python
Label: vulnerable
CWE: CWE-29 \u2014 Path Traversal: '\..\filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.

Code:
def _validate_source(source: str, run_id: str) -> None:
    if not is_local_uri(source):
        return

    if run_id:
        store = _get_tracking_store()
        run = store.get_run(run_id)
        source = pathlib.Path(local_file_uri_to_path(source)).resolve()
        run_artifact_dir = pathlib.Path(local_file_uri_to_path(run.info.artifact_uri)).resolve()
        if run_artifact_dir in [source, *source.parents]:
            return

    raise MlflowException(
        f"Invalid source: '{source}'. To use a local path as source, the run_id request parameter "
        "has to be specified and the local path has to be contained within the artifact directory "
        "of the run specified by the run_id.",
        INVALID_PARAMETER_VALUE,
    )