Sonarqube Change this code to not construct the path from user-controlled data

Viewed 26

User uploads file from UI and at springboot i check if the file exists and if yes, delete the file or copy the file to File server. I need to save the file with the file name what user has uploaded. But Sonarqube is giving vulnerability error: "Change this code to not construct the path from user-controlled data."

private String processFileUpload(MultipartFile uploadedFile){       
    String filePathName = "/uploaded_files/"+uploadedFile.getOriginalFilename(); //Error at this line
    File file = new File(uploadedFile.getOriginalFilename());
    if (file.exists()) {
     file.delete();
    }
//file transfer code
}

I need the file to be stored with the same name user has uploaded. How to fix this sonarqube error?

0 Answers
Related