How can I handle the below coverity scan issue Parameter docId receives the tainted data (taint_path_param)

Question

Please find my code snippet.

@RequestMapping(value="/abc" , Method=RequetMethod.GET)
    public void xxx(@Requestparam("docId") final String docId , @Requestparam("archieveId") final String archieveId){
//Code will be here
}

How can I resolve the coverity scan issues which says "TAINTED_PATH_PARAM" Please help!

Answer 1

As per description provided in link

The program does not have control over the values of the input, and so before using this data, the program must sanitise the data to eliminate system crashes, corruption, escalation of privileges, or denial of service.

@Requestparam("docId") final String docId can be taken as tained_source, which might be sinking at one or multiple places.

Solution : Validation of this variable before "sink" with @NotNull or @NotEmpty or spacial characters validation might resolve this issue.