I have a table where the machine name, directory path and filenames are stored; when requested, I am supposed to return the content of the file by concatenating the machine_name + '\' + directory_path + '\' + filename but this gets listed as a directory traversal vulnerability. While I see that database table is treated a tainted source, I am wondering how to resolve this situation. I tried to RandomAccessReferenceMap from ESAPI, it works if I swap direct and indirect references but I would like to know if there is any other standard way of forming the paths from the database tables.
If the database is considered a tainted source (which makes sense e.g. if you want to defend against changes in the database performed by SQL injection), you need to follow the standard procedure to sanitize the contents. So you should verify that the machine name contains only allowed characters (and if the dot is allowed: that it does not contain consecutive dots), that the directory path does not contain '/../', start with '../' or ends with '/..' (maybe also stricter validation) and that the file name at least does not contain any slashes.
You likely should read about path traversal attacks and recommended validation and sanitization policies for file and path names instead of blindly following my suggestion, as they are just what occurred to me as minimum requirements.