With reference to the following question in veracode community:

https://community.veracode.com/s/question/0D52T00004xSFtDSAW/file-path-new-filestringformatsssdirectory-fileseparator-filename

Its said that @FilePathCleanser does not automatically resolve security flaw CWE-73 and a manual mitigation request needs submitted.

However, I am using @FilePathCleanser successfully with resolved CWE-73 scan in one method that generates and return a URL based on incoming request arguments.

At the same time, this @FilePathCleanser still shows CEW-73 flas in veracode scan for another method in the same class. This other method opens a new file like this:

File file = new File(request.getParameter("fileRequested"))

I have already tried putting validation code for the fileRequested argument but no luck.

I have also observed that using @FilePathCleanser annotation above a method shows the veracode CEW-73 flaw resolved even if no validation code was put in place .

What I am not sure about is that why would this cleanser works for one method and not for the other in my class. If this cleanser does not automatically resolve the flaw then why would this cleanser shows the flaw resolved for the working method.

Cleanser working for the method has following codeline with resolved flaw:

String redirectURL = "redirect:/?someElement=SomeValue#/" + someId;

return redirectURL;

Cleanser NOT working for the method has following codeline with resolved flaw:

File file1 = new File(String.format("/some/hard/coded/dir/%s", fileName));