Sonar still complains about security:S2083

[biiyamn]

I’ve to resolve this owasp vulnerability ‘Change this code to not construct the path from user-controlled data.’ i’ve tried to use ESAPI library but sonar still shows the vulnerability, then i managed to solve this using regex and sonar no more shows the issue but if i extract the regex code into a function and call it , sonar shows again the vulnerability. images below depicts this:

• Try to fix issue with ESAPI

• Try to fix issue with regex
  

  

• export regex into function
  

  

[ganncamp (G Ann Campbell)]

Hi,

What version of SonarQube are you using? You can find the version number in the page footer if you’re unsure.

 
Ann

[biiyamn]

it’s 9.5 (build 56709)

[ganncamp (G Ann Campbell)]

Hi,

SonarQube 9.5 is a bit dusty at this point, and in fact, we just announced SonarQube 9.9 LTS yesterday.

Can you upgrade and see if this is replicable?

 
Ann