Language: TypeScript
Label: vulnerable
CWE: CWE-23 \u2014 Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Code:
export async function requestTranslationsAPI<T>(
  translationsUrl: string = '',
  locale = '',
  init: RequestInit = {},
  serverSettings: ServerConnection.ISettings | undefined = undefined
): Promise<T> {
  // Make request to Jupyter API
  const settings = serverSettings ?? ServerConnection.makeSettings();
  translationsUrl =
    translationsUrl || `${settings.appUrl}/${TRANSLATIONS_SETTINGS_URL}`;
  const requestUrl = URLExt.join(settings.baseUrl, translationsUrl, locale);
  let response: Response;
  try {
    response = await ServerConnection.makeRequest(requestUrl, init, settings);
  } catch (error) {
    throw new ServerConnection.NetworkError(error);
  }

  let data: any = await response.text();

  if (data.length > 0) {
    try {
      data = JSON.parse(data);
    } catch (error) {
      console.error('Not a JSON response body.', response);
    }
  }

  if (!response.ok) {
    throw new ServerConnection.ResponseError(response, data.message || data);
  }

  return data;
}