Files or Directories Accessible to External Parties

class FileDisclosure extends HttpServlet {
  @throws[IOException]
  override def doGet(request: HttpServletRequest, response: HttpServletResponse): Unit = {
    try {
      val returnURL = request.getParameter("returnURL")
      /** ****Struts ActionForward vulnerable code tests***** */
      // VULNERABLE: Files or Directories Accessible to External Parties
      val forward = new ActionForward(returnURL) //BAD
      // VULNERABLE: Files or Directories Accessible to External Parties
      val forward2 = new ActionForward(returnURL, true)
      // VULNERABLE: Files or Directories Accessible to External Parties
      val forward3 = new ActionForward("name", returnURL, true)
      // VULNERABLE: Files or Directories Accessible to External Parties
      val forward4 = new ActionForward("name", returnURL, true)
      val forward5 = new ActionForward
      // VULNERABLE: Files or Directories Accessible to External Parties
      forward5.setPath(returnURL) //BAD

      //false positive test - returnURL moved from path to name (safe argument)
      val forward6 = new ActionForward(returnURL, "path", true) //OK
      /** ****Spring ModelAndView vulnerable code tests***** */
      // VULNERABLE: Files or Directories Accessible to External Parties
      val mv = new ModelAndView(returnURL)
      val mv4 = new ModelAndView
      // VULNERABLE: Files or Directories Accessible to External Parties
      mv4.setViewName(returnURL)
      //false positive test - returnURL moved from viewName to modelName (safe argument)
    } catch {
      case e: Exception =>
        System.out.println(e)
    }