How to resolve sobelow flagging out file paths thats coming from external environment

Questions / Help
,
1

I have a phoenix endpoint which allows users to upload file and system will ingest the files contents

def ingest_csv(conn, %{"csv" => %Plug.Upload{} = upload}) do
  csv_data = upload.path |> File.stream!() |> CSV.parse_stream() |> Enum.to_list()
  ...
end

sobelow is flagging this out Traversal.FileModule: Directory Traversal in File.stream!- High Confidence

Ensure that the path passed to File functions is not user-controlled.

It seems is is flagging this out as the file path is coming from external environment.

So how else can i implement this feature without triggering sobelow?

2

Just as an update: I have marked out the above code as false positive via comment and used --skip option to skip false positives