1. The standard way to mitigate this kind of thing is to have a list of valid values for the dataSource variable and validate against that list before doing the lookup.

   Theoretically something along these lines would work:

    List<String> lookup = new ArrayList<>();
    lookup.add("datasource1");
    lookup.add("datasource2");
    lookup.add("datasource3");
    ....
   
    if (lookup.contains(userInputDatasource)) {
        doLookup(userInputDatasource);
    } else {
        throw Exception("Datasource not found;")
    }
   

2. JavaScript eval is not recommended:

eval() function is evil, never use it. Needing to use eval usually indicates a problem in your design.

That said a similar approach to the above could be used to verify the input only contains valid values

ObjectMessage objects depend on Java serialization to marshal and unmarshal their object payload. This process is generally considered unsafe, because a malicious payload can exploit the host system. Lots of CVEs have been created for this. For this reason, most JMS providers force users to explicitly whitelist packages that can be exchanged using ObjectMessage messages. For example, here's the related documentation for ActiveMQ Artemis.

There is no magic code fix for this issue that will eliminate the warning from Fortify aside from removing the use of ObjectMessage from your code altogether (which is what I would actually recommend).

There are a number of other issues with using JMS ObjectMessage not related to security that you should read about.