using (HttpClient client = new HttpClient())
{

string FindDocumentURL = string.Concat(internal server URL builder);
response = await client.GetAsync(FindDocumentURL);
if (response.IsSuccessStatusCode)
{
    string DownLoadURL = string.Concat(internal server URL builder);
    response = await client.GetAsync(DownLoadURL);
    if (response.IsSuccessStatusCode)
    {
        HttpContent content = response.Content;
        var contentStream = await content.ReadAsStreamAsync();
        return File(contentStream, "application/pdf");
    }
    else
    {
        //logging
    }
}
else
{
    //logging
}

}

above mentioned is the snippet of the code where a controller is building a URL based on config values and parameters that is calling internal server which reponds with pdf, now it being said in fortify scan that there is vulnerability to Cross Site Scripting(XSS):

• the data is sent at File() can be prone to malicious content.
• the data is included in dynamic content that is sent to Web without validation.

is this a case of False Positive.

I suspect it to be a false positive as the content being returned to it is from our internal server and also since the return is in the format of “application/pdf” I don’t think there is any chance of HTML/XML injection for XSS attack.