    main.navigate = function (options) {
        if (!options) {
            options = {};
        }
        if (typeof options === 'string') {
            options = {
                tab:    options,
                dialog: '',
                params: ''
            };
        }

        // get actual tab
        if (!options.tab) {
            var parts   = decodeURI(window.location.hash).split('/');
            options.tab = parts[0].replace(/^#/, '').replace(/^tab-/, '');
        }

        window.location.hash = '#tab-' + encodeURIComponent(options.tab) + (options.dialog ? '/' + options.dialog + (options.params ? '/' + encodeURIComponent(options.params) : '') : '');
    };
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.