Below is my existing Java base code and as you can see I am simply downloading files using output stream.

I am only using the request parameter to get browser detail from the header to generate the filename and again I am decoding it.

So now I don't understand how the below code

outputStream.write(data, 0, readed);

can leads to an XSS issue?

And how I can reproduce this issue to understand it better?

OutputStream outputStream = httpResponse.getOutputStream();

InputStream fileInputStream = generateInputStreamObj(user, attachmentObj, false, httpRequest, servletContext, ipAddress);

String userAgent = httpRequest.getHeader("User-Agent");

String encodedFileName = generateFileName(userAgent, attachmentObj);

int downloadBufferSize = Integer.parseInt(CacheManagement.getInstance().getSystemPropertyByAlias().get("DOWNLOAD_BUFFER_SIZE").getPropertyValue());

httpResponse.setContentType("application/x-download");

httpResponse.setHeader("Content-Length", String.valueOf(attachmentObj.getDocumentSize()));

httpResponse.setHeader("Content-Disposition", "attachment; filename=\"" + encodedFileName + "\"");

httpResponse.setBufferSize(downloadBufferSize);

bufferInputStream = new BufferedInputStream(fileInputStream);

byte[] data = new byte[downloadBufferSize];

int readed = 0;

while ((readed = bufferInputStream.read(data)) != -1)

{

outputStream.write(data, 0, readed);

}

I check Stack overflow and Veracode answers but it doesn't help me. Please guide me to reproduce the issue in local and solve it.