Rule Definition
For portability reasons, in Web applications or Application Server, 'java.io.File' should not be used since it means giving an absolute path and therefore being dependent on the environment where the application is deployed.
Remediation
Prefer using RessourceBundle.
Violation Code Sample
File f = new File(request.getParameter("fileName")) --------------- File f = new File(configPath + "avatar." + request.getParameter("extension") )
Reference
https://cwe.mitre.org/data/definitions/576.html https://cwe.mitre.org/data/definitions/73.html
Related Technologies
JEE
Technical Criterion
Architecture - OS and Platform Independence
About CAST Appmarq
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.