    private String getSkinResourcePath(String resource)
    {
        String skinFolder = getSkinFolder();
        String resourcePath = skinFolder + resource;

        // Prevent inclusion of templates from other directories
        Path normalizedResource = Paths.get(resourcePath).normalize();
        // Protect against directory attacks.
        if (!normalizedResource.startsWith(skinFolder)) {
            LOGGER.warn("Direct access to skin file [{}] refused. Possible break-in attempt!", normalizedResource);
            return null;
        }

        return resourcePath;
    }
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.