LGTM.com - false positive in path sanitization code

In order to provide path sanitization for some of API controllers used in OpenGrok (reported by both Sonar and LGTM), a change was made to verify the path supplied in the request does not point to outside the expected directory tree:
https://github.com/oracle/opengrok/commit/5082f8ec5e11b8259d833bfd5e6749eb0030ddad#diff-4357c5e759897ec6f09fb7ef09c661bf2719fda58ed0155d2737380a5fd5aee4

Even though this was changed according to the recommendations on https://snyk.io/research/zip-slip-vulnerability , LGTM still reports this as *Uncontrolled data used in path expression* problem in the method that actually performs the sanitization.

The LGTM URL for this alert is https://lgtm.com/projects/g/oracle/opengrok/snapshot/ed926a38faaf0796db709bf2ad62f8c4204690c1/files/opengrok-web/src/main/java/org/opengrok/web/util/FileUtil.java?sort=name&dir=ASC&mode=heatmap#x96d75c2f94454f17:1

I believe this is false positive, however if someone believes this can be done in better way, I am open to suggestions.