exports.expressCreateServer = function (hook_name, args, cb) {
  args.app.get('/tests/frontend/specs_list.js', function(req, res){

    async.parallel({
      coreSpecs: function(callback){
        exports.getCoreTests(callback);
      },
      pluginSpecs: function(callback){
        exports.getPluginTests(callback);
      }
    },
    function(err, results){
      var files = results.coreSpecs; // push the core specs to a file object
      files = files.concat(results.pluginSpecs); // add the plugin Specs to the core specs
      console.debug("Sent browser the following test specs:", files.sort());
      res.send("var specs_list = " + JSON.stringify(files.sort()) + ";\n");
    });

  });

  var rootTestFolder = path.join(npm.root, "..", "/tests/frontend/");
  var url2FilePath = function(url){
    var subPath = url.substr("/tests/frontend".length);
    if (subPath == ""){
      subPath = "index.html"
    }
    subPath = subPath.split("?")[0];

    var filePath = path.normalize(path.join(rootTestFolder, subPath));
    // make sure we jail the paths to the test folder, otherwise serve index
    if (filePath.indexOf(rootTestFolder) !== 0) {
      filePath = path.normalize(path.join(rootTestFolder, "index.html"));
    }
    return filePath;
  }

  args.app.get('/tests/frontend/specs/*', function (req, res) {
    var specFilePath = url2FilePath(req.url);
    var specFileName = path.basename(specFilePath);

    fs.readFile(specFilePath, function(err, content){
      if(err){ return res.send(500); }
   
      content = "describe(" + JSON.stringify(specFileName) + ", function(){   " + content + "   });";

      res.send(content);
    }); 
  });

  args.app.get('/tests/frontend/*', function (req, res) {
    var filePath = url2FilePath(req.url);
    res.sendfile(filePath);
  });

  args.app.get('/tests/frontend', function (req, res) {
    res.redirect('/tests/frontend/');
  }); 
}
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.