...
Failing to use only the subset of ASCII that is guaranteed to work can result in misinterpreted data.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
MSC09-C | Medium | Unlikely | Medium | P4 | L3 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| LDRA tool suite |
| 113 S | Partially implemented | ||||||
| Parasoft C/C++test |
|
|
|
| CERT_C-MSC09-a | Only use characters defined in ISO C standard | ||||||||
| PRQA QA-C |
| 0285 | Partially implemented | ||||||
| SonarQube C/C++ Plugin |
| S1578 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
| SEI CERT C++ Coding Standard | VOID MSC09-CPP. Character encoding: Use subset of ASCII for safety |
| CERT Oracle Secure Coding Standard for Java | IDS50-J. Use conservative file naming conventions |
| MISRA C:2012 | Directive 1.1 (required) Rule 4.1 (required) |
| MITRE CWE | CWE-116, Improper encoding or escaping of output |
Bibliography
| [ISO/IEC 646-1991] | "ISO 7-Bit Coded Character Set for Information Interchange" |
| [ISO/IEC 9899:2011] | Subclause 5.2.1, "Character Sets" |
| [Kuhn 2006] | "UTF-8 and Unicode FAQ for UNIX/Linux" |
| [VU#439395] |
| [Wheeler 2003 | Section 5.4, "File Names" |
...
...