variable constructed a pathname for a file that exists, leading to a NULL pointer
dereference (CWE-479) in line 7.
For cross-site scripting (CWE-79), there is an attempt to perform input validation on line
8, but this is using an insufficient blacklist (CWE-184). This is an incorrect protection