title: Cross-Site Scripting: Persistent issue while writing byte array to outputstream
body: <pre><code>public String downloadfile(@RequestParam long id){
      Report report = reportService.getReportDetails(String.valueOf(id));
      ResponseEntity&lt;FileResponse&gt; fileResponse = null;
          String clusterKey = clusterService.getCLusterFromId(report.getId());
  
          File file = new File(report.getFilePath());
      fileResponse  = restClient.getFileData(report.getFilePath(), clusterKey);
      response.setContentType("application/vnd.ms-excel ");
          response.setHeader("Content-disposition", "inline; filename=" + file.getName());
          try (InputStream is = new ByteArrayInputStream(fileResponse.getBody().getResponseFile());
                      OutputStream out = response.getOutputStream();)
              {
  
  
                      byte[] buffer = new byte[1024];
                      int bytesRead = 0;
  
                      while ((bytesRead = is.read(buffer)) != -1)
                      {
                           out.write(buffer, 0, bytesRead);
  
                      }
  </code></pre>
  
  <p>I am getting Cross-Site Scripting: Persistent issue in fortify tool  for above piece of code  out.write(buffer, 0, bytesRead) line. As per suggestion they are telling that we need to validate data before sending it back to browser. I am not sure how to validate byte array. After doing some search I found that we can use getVAlidatedFileContent() method of  esapi validator but not sure  how to use it. </p>