fix vulnerability identified by Sonar