Language: Python
Label: vulnerable
CWE: CWE-23 \u2014 Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Code:
async def test_io_failure(forbidden_shadow_path, manager, caplog):
    file_uri = (forbidden_shadow_path / "test.py").as_uri()

    shadow = setup_shadow_filesystem(forbidden_shadow_path.as_uri())

    def send_change():
        message = did_open(file_uri, "content")
        return shadow("client", message, "python-lsp-server", manager)

    with caplog.at_level(logging.WARNING):
        assert await send_change() is None
        assert await send_change() is None
    # no message should be emitted during the first two attempts
    assert caplog.text == ""

    # a wargning should be emitted on third failure
    with caplog.at_level(logging.WARNING):
        assert await send_change() is None
    assert "initialization of shadow filesystem failed three times" in caplog.text
    assert "PermissionError" in caplog.text
    caplog.clear()

    # no message should be emitted in subsequent attempts
    with caplog.at_level(logging.WARNING):
        assert await send_change() is None
    assert caplog.text == ""