Language: Java
Label: vulnerable
CWE: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Code:
	private boolean isAllowed(AFile file) throws IOException {
		// ::comment when __CORE__
		if (OptionFlags.ALLOW_INCLUDE)
			return true;

		if (file != null) {
			final SFile folder = file.getSystemFolder();
			// System.err.println("canonicalPath=" + path + " " + folder + " " +
			// INCLUDE_PATH);
			if (includePath().contains(folder))
				return true;

		}
		// ::done
		return false;
	}