Path traversal
Constructing path names with unsanitized user input can lead to path traversal attacks (for example, `../../..`) that allow an attacker access to file system resources.
def verify_file_path_noncompliant():
    from flask import request
    file_path = request.args["file"]
    # Noncompliant: user input file path is not sanitized.
    file = open(file_path)
    file.close()
def verify_file_path_compliant():
    from flask import request
    base_path = "/var/data/images/"
    file_path = request.args["file"]
    allowed_path = ["example_path1", "example_path2"]
    # Compliant: user input file path is sanitized.
    if file_path in allowed_path:
        file = open(base_path + file_path)
        file.close()