Hi @srathore (Community Member)​ ,

Veracode Static Analysis reports CWE 73 (External Control of File Name or Path), also called File Path Injection, when it can detect that a file path being accessed is composed using data from outside the application (such as the HTTP request, the database, or the filesystem). The concern is that an attacker might be able to use a dot-dot-slash attack ("../") to traverse through the filesystem and access arbitrary files.

The following Knowledge article describes in detail how to deal with CWE 73 in Java: https://community.veracode.com/s/article/how-do-i-fix-cwe-73-external-control-of-file-name-or-path-in-java .

In a nutshell: The only fixes that Veracode Static Analysis would automatically detect here is hardcoding the file path or validation against an allow-list. In any other case, we would recommend the following:

• If only the filename (and not the whole path) can be controlled from outside the application, apply some dynamic validation on the filename (e.g. in form of a regex). If possible, validate that the filename is alphanumeric. You may want to adapt and use the following regex to your use case: `^[a-zA-Z0-9]{1,50}$` (without the ticks). This particular one would check if the filename is between 1 and 50 alphanumeric characters.
• If the whole path can be controlled from outside the application, we would recommend applying the canonical path check. A code snippet and an explanation can be found in the above Knowledge article.
• Afterwards, please propose a mitigation and discuss it with your Security Team. You can find how to propose a mitigation here: https://help.veracode.com/r/improve_mitigation

Thank you,

Florian Walter