312-96: Certified Application Security Engineer (Java)

Alice is a Java developer at Fygo Software Services Ltd. He has been assigned responsibility for designing a bookstore website for one of its clients. The website is intended to store articles in .pdf format. Alice’s superior advises him to design the ArticlesList.jsp page so that it displays a list of all articles on one page and sends a selected filename as a query string to redirect users to the articledetails.jsp page.

Alice wrote the following code on page load to read the filename.

String myfilename = request.getParameter("filename");  
String txtFileNameVariable = myfilename;  
String locationVariable = request.getServletContext().getRealPath("/");  
String PathVariable = "";  
PathVariable = locationVariable + txtFileNameVariable;  
BufferedInputStream bufferedInputStream = null;  
Path filepath = Paths.get(PathVariable);  

After reviewing this code, Alice’s superior identified a security mistake and instructed him not to repeat it in future. Can you identify the type of vulnerability that may exist in the code?