title: Header Manipulation issue with HP Fortify in HTTP response [java]
body: <p>I'm trying to fix a "Header Manipulation" issue returned bu HP Fortify Scan for this code. I don't know if files are already validated during upload (I think not). I tried to use a RegEx to validate filename with no success.
  Anyone can help me?    </p>
  
  <pre><code>b = uploadedFiles.getFilecontent().getBytes(1,
                          uploadedFiles.getFilesize().intValue());
                  if (b != null) {
                      response.reset();
                      String fileName = uploadedFiles.getFilename();
                      String header = "attachment; filename=\"" + fileName + "\"";
                      String contentType = uploadedFiles.getFilecontenttype();
                      response.setContentType(uploadedFiles.getFilecontenttype());
                      response.addHeader("Content-Transfer-Encoding", "Binary");
                      response.addHeader("Cache-Control", "must-revalidate, private");
                      response.setContentLength(b.length);
                      FileCopyUtils.copy(b, response.getOutputStream());
                      response.getOutputStream().flush();
                      response.getOutputStream().close();
                  }
  </code></pre>
  
  <p>What I tried:</p>
  
  <pre><code>String fileName = uploadedFiles.getFilename();
  String regex = "[a-zA-Z._ ]*";
  if (b != null &amp;&amp; fileName.matches(regex)) {
                  response.reset();
                  // String fileName = uploadedFiles.getFilename();
                  String header = "attachment; filename=\"" + fileName + "\"";
                  String contentType = uploadedFiles.getFilecontenttype();
                  response.setContentType(uploadedFiles.getFilecontenttype());
                  response.addHeader("Content-Transfer-Encoding", "Binary");
                  response.addHeader("Cache-Control", "must-revalidate, private");            
                  response.setHeader("Content-Disposition", header);
                  response.setContentLength(b.length);
                  FileCopyUtils.copy(b, response.getOutputStream());
                  response.getOutputStream().flush();
                  response.getOutputStream().close();
              }
  </code></pre>