Cross-site scripting defect in our jersey HTTP server application

Hello,

Jersey 3.0.1
Jetty version: 9.4.11
Java version: OpenJDK11

I'm looking for help in regards to CWE-79 Cross-site scripting defect in our jersey HTTP server application.

Following sample code provides functionality of downloading the certificate from a repo given a certificatelabel:
```
/**
* REST API to download the file given crtLabel
*
*/
@GET
@Path( "/export/{crtLabel}" )
@Produces( "application/octet-stream" )
public Response downloadCertificateFile( @PathParam( "crtLabel" ) String crtLabel, @Context HttpHeaders headers )
{
File certFile = null;

....

// given the input label, we search the repo...
try
{
certFile = m_wrapcertDataManager.exportWrappingCert( crtLabel );
if( certFile == null )
{
throw new Exception( "Internal Error: Export Wrapping Certificate generated no file." );
}
}
catch( Exception ex )
{
}

return Response.ok( certFile ).header( "Content-Disposition",
"attachment; filename=\"" + certFile.getName() + "\"" ).build();
}
```

Coverity shows:
crtLabel as tainted
certFile was considered tainted as well.
Finally at Response.ok( certFile ) : xss_injection_site: Printing certFile to an HTML page allows cross-site scripting, because it was not properly sanitized for context HTML PCDATA block.

Question: can this be considered false positive? File is transferred after the lookup given the name. If incase, crtLable is tainted there's no file.

If it's not false positive, is there a way for me to sanitize Response.ok( certFile ) ?

Any help greatly appreciated !!

Thanks.