...
Coonsequently, supplementary characters and combining characters must be taken into account when operating on individual characters.
Noncompliant Code Example
| Wiki Markup |
|---|
This noncompliant code example attempts to trim leading letters from the {{string}}. It fails to accomplish this task because {{Character.isLetter()}} lacks support for supplementary and combining characters \[[Hornig 2007|AA. Bibliography#Hornig 07]\]. |
| Code Block | ||
|---|---|---|
| ||
// Fails for supplementary or combining characters
public static String trim_bad1(String string) {
char ch;
for (int i = 0; i < string.length(); i += 1) {
ch = string.charAt(i);
if (!Character.isLetter(ch)) {
break;
}
}
return string.substring(i);
}
|
Noncompliant Code Example
| Wiki Markup |
|---|
This noncompliant code example attempts to fix the problem by using the {{String.codePointAt()}} method, which accepts an {{int}} argument. This works for supplementary characters but fails for combining characters \[[Hornig 2007|AA. Bibliography#Hornig 07]\]. |
| Code Block | ||
|---|---|---|
| ||
// Fails for combining characters
public static String trim_bad2(String string) {
int ch;
for (int i = 0; i < string.length(); i += Character.charCount(ch)) {
int ch = string.codePointAt(i);
if (!Character.isLetter(ch)) {
break;
}
}
return string.substring(i);
}
|
Compliant Solution
| Wiki Markup |
|---|
This compliant solution works both for supplementary and for combining characters \[[Hornig 2007|AA. Bibliography#Hornig 07]\]. According to the Java API \[[API 2006|AA. Bibliography#API 06]\], class {{java.text.BreakIterator}} documentation |
...
To perform locale-sensitive String comparisons for searching and sorting, use the java.text.Collator class.
Risk Assessment
Failure to correctly account for supplementary and combining characters can lead to unexpected behavior.
Guideline | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
IDS13-J | low | unlikely | medium | P2 | L3 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this guideline on the CERT website.
Bibliography
| Wiki Markup |
|---|
\[[API 2006|AA. Bibliography#API 06]\] Classes {{Character}} and {{BreakIterator}}
\[[Hornig 2007|AA. Bibliography#Hornig 07]\] Problem areas: Characters |
...