static String valueToDateTimeString(double value, AtomicString type)
{
    DateComponents components;
    if (type == InputTypeNames::date)
        components.setMillisecondsSinceEpochForDate(value);
    else if (type == InputTypeNames::datetime_local)
        components.setMillisecondsSinceEpochForDateTimeLocal(value);
    else if (type == InputTypeNames::month)
        components.setMonthsSinceEpoch(value);
    else if (type == InputTypeNames::time)
        components.setMillisecondsSinceMidnight(value);
    else if (type == InputTypeNames::week)
        components.setMillisecondsSinceEpochForWeek(value);
    else
        ASSERT_NOT_REACHED();
    return components.type() == DateComponents::Invalid ? String() : components.toString();
}

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.