def boboAwareZopeTraverse(object, path_items, econtext):
    """Traverses a sequence of names, first trying attributes then items.

    This uses zope.traversing path traversal where possible and interacts
    correctly with objects providing OFS.interface.ITraversable when
    necessary (bobo-awareness).
    """
    request = getattr(econtext, 'request', None)
    validate = getSecurityManager().validate
    path_items = list(path_items)
    path_items.reverse()

    while path_items:
        name = path_items.pop()

        if OFS.interfaces.ITraversable.providedBy(object):
            object = object.restrictedTraverse(name)
        else:
            found = traversePathElement(object, name, path_items,
                                        request=request)

            # Special backwards compatibility exception for the name ``_``,
            # which was often used for translation message factories.
            # Allow and continue traversal.
            if name == '_':
                warnings.warn('Traversing to the name `_` is deprecated '
                              'and will be removed in Zope 6.',
                              DeprecationWarning)
                object = found
                continue

            # All other names starting with ``_`` are disallowed.
            # This emulates what restrictedTraverse does.
            if name.startswith('_'):
                raise NotFound(name)

            # traversePathElement doesn't apply any Zope security policy,
            # so we validate access explicitly here.
            try:
                validate(object, object, name, found)
                object = found
            except Unauthorized:
                # Convert Unauthorized to prevent information disclosures
                raise NotFound(name)

    return object
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.