    async handler(ctx) {
      ctx.logStream.write(`Writing catalog-info.yaml`);
      const { entity } = ctx.input;

      await fs.writeFile(
        resolvePath(ctx.workspacePath, 'catalog-info.yaml'),
        yaml.stringify(entity),
      );
    },
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.