Java Trust Boundary Violation in checkmarx

I'm getting some issues with checkmarx Trust Boundary Violation.

I have a method that generates word of .PDF document from .DOCX template. I’m sending template id and parameter list with their values as arguments for method.

I have already tried to sanitize the inputs like report suggest but nothing seems to work.

The key parameter allowed values can be alphanumeric characters and dot characters. And the contents of value parameters can be full sentences with symbols etc.

The text from checkmarx I'm gettin is following:

Method createDocumentFromTemplate at line 110 of ... gets user input from element parameterList. This element’s value flows through the code without being properly sanitized or validated and is eventually stored in the server-side Session object, in createDocumentFromTemplate at line 182 of .. This constitutes a Trust Boundary Violation.

The flagged code in the report is method createDocumentFromTemplate + whole for loop and method removeNonAlphanumericValuesLeaveDot.

Parameters object looks something like this:

@Data
public class DocumentTemplateParameters {
    private boolean isObject;
    private String key;
    private String value;
}

And the method that gets flagged by CheckMarx looks something like this:

public byte[] createDocumentFromTemplate(List<DocumentTemplateParameters> parameterList) {


    List<DocumentTemplateParameters> trustedParamList = new ArrayList<>();

    for (DocumentTemplateParameters parameter : parameterList) {
        DocumentTemplateParameters trustedParam = new DocumentTemplateParameters();
        trustedParam.setJeObjekt(parameter.isObject());
        if (parameter.getKey().matches("^[a-zA-Z0-9.]+$")) {
            trustedParam.setKey(parameter.getKey());
        } else {
            trustedParam.setKey(CommonUtil.removeNonAlphanumericValuesLeaveDot(parameter.getKey()));
        }

        trustedParam.setValue(CommonUtil.removeNonLiteralNonNumericalNonPunctuation(parameter.getValue()));
        if (log.isDebugEnabled()) {
            log.debug(LogCleanup.RemoveNewline(trustedParam.getKey()) + ": " + LogCleanup.RemoveNewline(trustedParam.getValue()));
        }

        trustedParamList.add(trustedParam);
    }

    // do something...

    return document;
}

The common methods look like this:

   public static String removeNonAlphanumericValuesLeaveDot(String value) {

        if (value == null) {
            return null;
        }
        // return value.replaceAll("[^\\p{Alnum}\\.]", "");
        return value.replaceAll("[^A-Za-z0-9.]", "");
    }

And this:

public static String removeNonLiteralNonNumericalNonPunctuation(String value) {
    if (value == null) {
        return null;
    }
    return value.replaceAll("[^\\p{L}\\p{Digit}\\p{Space}\\p{Sc}\\p{Punct}]", "");
}

Any help would be much appreciated. Thanks!