def _get_object_element(dataset, seq_no, rel_path, download_link):
    """If rel_path and download_link are not None, we are called from scope.
    Otherwise we are called from ID and need to run SQL query to fetch these attrs."""

    if rel_path is None:
        query = "SELECT rel_path, download_link FROM " + \
        dataset + \
        " WHERE sequence_no = %s"

        cnx = mysql.connector.connect(user=DB_USER,
                                    password=DB_PASSWORD,
                                    host=DB_HOST,
                                    database=DB_DBNAME,
                                    port=DB_PORT)
        cursor = cnx.cursor()
        cursor.execute(query, (seq_no,))

        row = cursor.fetchone()

        if not row:
            return None

        rel_path, download_link = row[0], row[1]

    if LOCAL_OBJ_URI:
        src_uri = 'file://' + os.path.join(DATAROOT, dataset, rel_path)
    else:
        src_uri = url_for('.get_object_src_http', dataset=dataset, rel_path=rel_path)

    return '<object id={} src={} hyperfind.external-link={} />' \
        .format(
        quoteattr(url_for('.get_object_id', dataset=dataset, seq_no=seq_no)),
        quoteattr(src_uri),
        quoteattr(download_link))
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.