...
| Code Block | ||||
|---|---|---|---|---|
| ||||
public static void processTag(String tag) {
if (tag.equalsIgnoreCase("SCRIPT")) {
return;
}
// Process tag
}
|
This solution is compliant because equalIgnoreCase() compares two strings, one of which is plain ASCII, and therefore its behavior is well-understood, even if the other string is not plain ASCII. Calling equalIgnoreCase() where both strings may not be ASCII is not recommended, simply because equalIgnoreCase() may not behave as expected by the developer.
Noncompliant Code Example (FileReader)
...
Failure to specify the appropriate locale when using locale-dependent methods on local-dependent data without specifying the appropriate locale may result in unexpected behavior.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
STR02-J | Medium | Probable | Medium | P8 | L2 |
Automated Detection
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| The Checker Framework |
| Tainting Checker | Trust and security errors (see Chapter 8) | ||||||
| CodeSonar |
| FB.I18N.DM_CONVERT_CASE FB.I18N.DM_DEFAULT_ENCODING PMD.Design.SimpleDateFormatNeedsLocale PMD.Design.UseLocaleWithCaseConversions | Consider using Locale parameterized version of invoked method Reliance on default encoding Simple date format needs Locale Use Locale with case conversions | ||||||
| Parasoft Jtest |
|
|
| INTER.{CCL,CTLC} | Implemented | |||
| SonarQube |
|
|
| S1449 |
Android Implementation Details
A developer can specify locale on Android using java.util.Locale.
Bibliography
[API 2006] | Class |
| [Seacord 2015] | |
| [Schindler 12] | The Policeman’s Horror: Default Locales, Default Charsets, and Default Timezones |
...
...