Patched code sample

import os
import logging

# This code is a self-contained representation of the logic used
# in the pygeoapi patch. In the actual patch, these components are
# integrated into the existing codebase structure.

LOGGER = logging.getLogger(__name__)

class ProviderConnectionError(Exception):
    """Provider connection error"""
    pass


def get_path_from_provider(data_path: str, safe_path: str) -> str:
    """
    Safely join a path to a provider's data path, preventing path traversal.

    This function resolves the absolute path of the combined path and ensures
    it is located within the intended 'data_path' directory.

    :param data_path: The provider's base data directory.
    :param safe_path: The user-provided path component to be joined.

    :raises ProviderConnectionError: If the resulting path is outside the
                                     base 'data_path' directory (path
                                     traversal detected).

    :returns: The safely resolved, absolute path.
    """

    LOGGER.debug(f'Safely joining {safe_path} to {data_path}')

    # Vulnerable approach (for comparison, not used in fix):
    # vulnerable_path = os.path.join(data_path, safe_path)
    # If safe_path is '../secrets', vulnerable_path could resolve
    # outside data_path.

    # Fixed approach:
    # 1. Join the paths.
    # 2. Get the real, absolute path, resolving any '..' components.
    resolved_path = os.path.abspath(os.path.join(data_path, safe_path))
    
    # 3. Ensure the base data_path is a common prefix of the resolved path.
    #    This confirms the resolved path is still inside the base directory.
    if os.path.commonprefix((resolved_path, data_path)) != data_path:
        msg = 'unsafe path detected'
        LOGGER.error(msg)
        raise ProviderConnectionError(msg)

    return resolved_path