Language: Java
Label: safe
CWE: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Code:
  public static void validateString(final String what, final String s, String specials) {
    if (s == null) {
      throw new BadRequestException("Invalid " + what + ": null");
    } else if ("".equals(s)) {
      throw new BadRequestException("Invalid " + what + ": empty string");
    }
    final int n = s.length();
    for (int i = 0; i < n; i++) {
      final char c = s.charAt(i);
      if (!(('a' <= c && c <= 'z') || ('A' <= c && c <= 'Z')
          || ('0' <= c && c <= '9') || c == '-' || c == '_' || c == '.'
          || c == '/' || Character.isLetter(c) || specials.indexOf(c) != -1)) {
        throw new BadRequestException("Invalid " + what
            + " (\"" + s + "\"): illegal character: " + c);
      }
    }
  }