Change this code to not construct the path from user-controlled data

SonarQube Server / Community Build
1

Below is the code snippet , i am getting sonar qube issue on the line 3 (FileUtilits.copy…). Could you please help me to resolve this issue.

ResponseEntity<Resource> response=//get response from other source
InputStream is = resource.getInputStream();
FileUtils.copyInputStreamToFile(is, new File(fileName));
 is.close();
2

Hey there.

As noted in the template post, what version of SonarQube are you using?

3

Hi Colin,
We are using SonarQube version v4.7.0.

4

The version of SonarQube can be found in the footer of your SonarQube instance.

5

Thanks I can find the version in the footer - which is version 8.9.7 .

6

Hi,

Your version is past EOL. You should upgrade to either the latest version or the current LTS at your earliest convenience. Your upgrade path is:

8.9.7 → 9.9 → 10.0 (last step optional)

You may find these resources helpful:

If you have questions about upgrading, feel free to open a new thread for that here.

If your error persists after upgrade, please come back to us.

7

HI Colin,

Sure we will upgrade but can you help on to find the resolution for the above issue?

8

Hi,
Can anyone help me why we are getting “Change this code to not construct the path from user-controlled data.” in the below line of code
FileUtils.copyInputStreamToFile(is, new File(fileName));

Please help to resolve above issue.