Description: The method uses unvalidated path components (targetLocation and fileName) to create
directories and write a file (Files.createDirectories(targetLocation) and
targetLocation.resolve(fileName)), which can enable path traversal or arbitrary file write
if either value can be influenced to include .. segments or an absolute path (e.g.,
fileName like ../../.ssh/authorized_keys).
RemoteWebDriver.java [730-739]

public void downloadFile(String fileName, Path targetLocation) throws IOException {
  requireDownloadsEnabled(capabilities);

  Response response = execute(DriverCommand.GET_DOWNLOADED_FILE, Map.of("name", fileName));

  Contents.Supplier content = (Contents.Supplier) response.getValue();
  try (InputStream fileContent = content.get()) {
    Files.createDirectories(targetLocation);
    Files.copy(new BufferedInputStream(fileContent), targetLocation.resolve(fileName));
  }

• Create ticket/issue

Follow the guide to enable codebase context checks.

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
No audit logging: The new file-system action (creating directories before saving a downloaded file) is not
accompanied by any audit log context (actor, action, outcome), which may be required
depending on whether downloads are considered a critical action in this project.

Files.createDirectories(targetLocation);
Files.copy(new BufferedInputStream(fileContent), targetLocation.resolve(fileName));

Learn more about managing compliance generic rules or creating your own custom rules

Instead of creating the targetLocation as a directory, create the parent
directory of the final destination path (targetLocation.resolve(fileName)). This
makes the method more robust if targetLocation is a file path instead of a
directory.

java/src/org/openqa/selenium/remote/RemoteWebDriver.java [737-738]

-Files.createDirectories(targetLocation);
-Files.copy(new BufferedInputStream(fileContent), targetLocation.resolve(fileName));
+Path destination = targetLocation.resolve(fileName);
+Files.createDirectories(destination.getParent());
+Files.copy(new BufferedInputStream(fileContent), destination);

• Apply / Chat

Defensively validate fileName and ensure the resolved destination stays within
targetLocation to prevent ../ traversal or absolute-path writes; then create
directories and copy to the validated path.

java/src/org/openqa/selenium/remote/RemoteWebDriver.java [730-740]

 public void downloadFile(String fileName, Path targetLocation) throws IOException {
   requireDownloadsEnabled(capabilities);
 
   Response response = execute(DriverCommand.GET_DOWNLOADED_FILE, Map.of("name", fileName));
 
+  Path baseDir = Require.nonNull("Target location", targetLocation).toAbsolutePath().normalize();
+  String safeName = Require.nonNull("File name", fileName).trim();
+  if (safeName.isEmpty()) {
+    throw new IllegalArgumentException("File name must not be blank");
+  }
+
+  Path destination = baseDir.resolve(safeName).normalize();
+  if (!destination.startsWith(baseDir) || destination.getFileName() == null) {
+    throw new IllegalArgumentException("Invalid file name: " + fileName);
+  }
+
   Contents.Supplier content = (Contents.Supplier) response.getValue();
   try (InputStream fileContent = content.get()) {
-    Files.createDirectories(targetLocation);
-    Files.copy(new BufferedInputStream(fileContent), targetLocation.resolve(fileName));
+    Files.createDirectories(baseDir);
+    Files.copy(new BufferedInputStream(fileContent), destination);
   }
 }

[To ensure code accuracy, apply this suggestion manually]