    function getIconHtml(obj, classes) {
        let icon;
        let alt;
        const isCommon = obj && obj.common;

        if (isCommon.icon) {
            if (!isCommon.icon.match(/^data:image\//)) {
                if (isCommon.icon.indexOf('.') !== -1) {
                    let instance;
                    if (obj.type === 'instance') {
                        icon = '/adapter/' + obj.common.name + '/' + obj.common.icon;
                    } else if (obj._id.match(/^system\.adapter\./)) {
                        instance = obj._id.split('.', 3);
                        if (isCommon.icon[0] === '/') {
                            instance[2] += isCommon.icon;
                        } else {
                            instance[2] += '/' + isCommon.icon;
                        }
                        icon = '/adapter/' + instance[2];
                    } else {
                        instance = obj._id.split('.', 2);
                        if (isCommon.icon[0] === '/') {
                            instance[0] += isCommon.icon;
                        } else {
                            instance[0] += '/' + isCommon.icon;
                        }
                        icon = '/adapter/' + instance[0];
                    }
                } else {
                    return '<i class="material-icons ' + (classes || 'treetable-icon') + '">' + isCommon.icon + '</i>';
                }

            } else {
                icon = isCommon.icon;
            }
            alt = obj.type;
        }
        return {icon: icon, alt: alt};
    }
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.