  def call(env)
    return @app.call(env) unless env['PATH_INFO'].start_with? "#{@bus.base_route}message-bus/_diagnostics"

    route = env['PATH_INFO'].split("#{@bus.base_route}message-bus/_diagnostics")[1]

    if @bus.is_admin_lookup.nil? || !@bus.is_admin_lookup.call(env)
      return [403, {}, ['not allowed']]
    end

    return index unless route

    if route == '/discover'
      user_id = @bus.user_id_lookup.call(env)
      @bus.publish('/_diagnostics/discover', user_id: user_id)
      return [200, {}, ['ok']]
    end

    if route =~ /^\/hup\//
      hostname, pid = route.split('/hup/')[1].split('/')
      @bus.publish('/_diagnostics/hup', hostname: hostname, pid: pid.to_i)
      return [200, {}, ['ok']]
    end

    asset = route.split('/assets/')[1]
    if asset && !asset !~ /\//
      content = asset_contents(asset)
      return [200, { 'Content-Type' => 'application/javascript;charset=UTF-8' }, [content]]
    end

    [404, {}, ['not found']]
  end
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.