...
Two sets of characters and their associated collating sequences shall be defined: the set in which source files are written (the source character set), and the set interpreted in the execution environment (the execution character set). Each set is further divided into a basic character set, whose contents are given by this subclause, and a set of zero or more locale-specific members (which are not members of the basic character set) called extended characters. The combined set is also called the extended character set. The values of the members of the execution character set are implementation-defined.
The character encoding defined by the ASCII standard is the following: code values are assigned to characters consecutively in the order in which the characters are listed as the table below: starting from 32 (assigned to space) and ending up with 126 (assigned to the tilde character ~). Positions 0 through 31 and 127 are reserved for control codes.
...
...
!
...
"
...
#
...
$
...
%
...
&
...
'
...
(
...
)
...
*
...
+
...
,
...
-
...
.
...
/
...
0
...
1
...
2
...
3
...
4
...
5
...
6
...
7
...
8
...
9
...
:
...
;
...
<
...
=
...
>
...
?
...
@
...
A
...
B
...
C
...
D
...
E
...
F
...
G
...
H
...
I
...
J
...
K
...
L
...
M
...
N
...
O
...
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="a1fc223d-1af2-4f2a-bcd9-3a9bcbba8917"><ac:plain-text-body><![CDATA[
...
P
...
Q
...
R
...
S
...
T
...
U
...
V
...
W
...
X
...
Y
...
Z
...
[
...
\
...
]
...
^
...
_
...
]]></ac:plain-text-body></ac:structured-macro>
...
'
...
a
...
b
...
c
...
d
...
e
...
f
...
g
...
h
...
i
...
j
...
k
...
l
...
m
...
n
...
o
...
p
...
q
...
r
...
s
...
t
...
u
...
v
...
w
...
x
...
y
...
z
...
{
...
|
...
}
...
~
| Wiki Markup |
|---|
There are several national variants of ASCII. Therefore, the original ASCII is often referred as *US-ASCII*. The international standard _ISO 646_ defines a character set similar to US-ASCII, but with code positions corresponding to US-ASCII characters {{@\[\]\{\|\}}} as "national use positions". It also gives some liberties with characters {{#$^`~}}. In _ISO 646_, several "national variants of ASCII" have been defined, assigning different letters and symbols to the "national use" positions. Thus, the characters that appear in those positions - including those in *US-ASCII* are somewhat "unsafe" in international data transfer. Thus, due to the "national variants," |
some characters are less "safe" than |
others--they might be transferred or interpreted incorrectly. |
In Addition addition to the letters of the English alphabet ("A" to through "Z" and "a" to through "z"), the digits ("0" to through "9"), and the space, only the following characters can be regarded as really "safe:" in data transmission:
| No Format |
|---|
! " % & ' ( ) * + , - . / : ; < = > ? |
When naming files, variables, etc., it is often best to use only the characters listed aboveonly these characters should be used.
Non-Compliant Coding Example
The characters in the file name should be avoidedIn the following non-compliant code, unsafe characters are used as part of a filename.
| Code Block | ||
|---|---|---|
| ||
#include <fcntl.h>
#include <sys/stat.h>
int main(void) {
char *file_name = "»£???«";
mode_t mode = S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH;
int fd = open(file_name, O_CREAT | O_EXCL | O_WRONLY, mode);
if (fd == -1) {
/* Handle Error */
}
}
|
Clearly this can cause problemsAn implementation is free to define its own mapping of the non-"safe" characters. For example, when tested on a Red Hat Linux distribution, the following filename resulted:
| Code Block |
|---|
% ls
a.out MSC09-A.c ??????
|
Compliant Solution
Use a descriptive file namefilename, containing only the subset of ASCII described above.
| Code Block | ||
|---|---|---|
| ||
#include <fcntl.h>
#include <sys/stat.h>
int main(void) {
char *file_name = "name.ext";
mode_t mode = S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH;
int fd = open(file_name, O_CREAT | O_EXCL | O_WRONLY, mode);
if (fd == -1) {
/* Handle Error */
}
}
|
Risk Assessment
This could Failing to use only the subset of ASCII guaranteed to work can result in misinterpreted data being lost or misinterpreted during transmission.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
MSC09-A | 1 (low) | 1 (unlikely) | 3 (low) | P3 | L3 |
...