Patched code sample

from pathlib import Path
from typing import Any, Dict, Optional

import xmlschema
from xmlschema.resources import XMLResource


# This is a simplified representation of the real class structure.
class XMLSchemaParser:
    def __init__(self) -> None:
        self.schema: Optional[xmlschema.XMLSchema] = None

    def parse_raw(
        self,
        raw_text: str,
        *,
        base_path: Optional[Path] = None,
    ) -> None:
        schema_kwargs: Dict[str, Any] = {}
        if base_path:
            def _url_resolver(url: str) -> str:
                # FIX: Resolve the file path and ensure it remains within the base_path
                # directory to prevent path traversal.
                path = (base_path / url).resolve()
                if (
                    path != base_path.resolve()
                    and base_path.resolve() not in path.parents
                ):
                    raise ValueError(f"Path traversal is not allowed: `{url}`")
                return url

            schema_kwargs["base_url"] = base_path.as_uri()
            schema_kwargs["url_resolver"] = _url_resolver
            schema_kwargs["resource"] = XMLResource

        self.schema = xmlschema.XMLSchema(raw_text, **schema_kwargs)