Following a FP report, we see that even if the file path is checked for .., an alert is still reported. There should be an additional sanitizing guard such as !var.contains("..") in the query