...
Two sets of characters and their associated collating sequences shall be defined: the set in which source files are written (the source character set), and the set interpreted in the execution environment (the execution character set). Each set is further divided into a basic character set, whose contents are given by this subclause, and a set of zero or more locale-specific members (which are not members of the basic character set) called extended characters. The combined set is also called the extended character set. The values of the members of the execution character set are implementation-defined.
Wiki Markup @\[\]\{\|\} }} as _national use positions_ \ [[ISO/IEC 646-1991|AA. Bibliography#ISO/IEC 646-1991]\]. It also gives some liberties with the characters {{\#$^`\~}}. In ISO 646, several national variants of ASCII have been defined, assigning different letters and symbols to the national use positions. Consequently, the characters that appear in those positions, including those in US-ASCII, are less portable in international data transfer. Consequently, due to the national variants, some characters are less portable than othersâthey might be transferred or interpreted characters #$^`~. In ISO 646, several national variants of ASCII have been defined, assigning different letters and symbols to the national use positions. Consequently, the characters that appear in those positions, including those in US-ASCII, are less portable in international data transfer. Consequently, due to the national variants, some characters are less portable than othersâ”they might be transferred or interpreted incorrectly.
In addition to the letters of the English alphabet ("A" through "Z" and "a" through "z"), the digits ("0" through "9"), and the space, only the following characters are portable:
...
Most of these characters or patterns are primarily a problem to scripts or automated parsing, but, because they are not commonly used, it is best to disallow their use to reduce potential problems. Interoperability concerns also exist because different operating systems handle file names of this sort in different ways.
Wiki Markup xxxxxxxx.xxx}}, where x denotes an alphanumeric character, are generally supported by modern systems. On some platforms, file names are case sensitive; while on other platforms, they are case insensitive. VU#439395 is an example of a vulnerability resulting from a failure to deal appropriately with case sensitivity issues \[ [VU#439395|AA. Bibliography#VU439395]\].
Noncompliant Code Example: File Name
...
Tool | Version | Checker | Description | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
|
|
...
MITRE CWE: CWE-116, "Improper Encoding or Escaping of Output"
Bibliography
...
\[[Kuhn 2006|AA. Bibliography#Kuhn 06] \] UTF-8 and Unicode FAQ for UNIX/Linux
\
[[Wheeler 2003|AA. Bibliography#Wheeler03] \] 5.4 File Names
\
[[VU#439395|AA. Bibliography#VU439395]\]
...
49. Miscellaneous (MSC) MSC10-C. Character Encoding - UTF8 Related Issues