Page History

...

Any program which invokes local-sensitive methods on untrusted data must explicitly specify the locale to use with these methods.

Noncompliant Code Example

This noncompliant code example uses the locale-sensitive {{String.toUpperCase()}} method to convert an HTML tag to uppercase. While the English locale would convert "title" to "TITLE", the Turkish locale will convert "title" to "T?TLE" where '?' is the Latin capital letter 'I' with a dot above the character \[[API 2006|AA. Bibliography#API 06]\]. 

"title".toUpperCase();

Compliant Solution (Explicit Locale)

This compliant solution explicitly sets the locale to English to avoid unexpected results.

...

This guideline also applies to the String.equalsIgnoreCase() method.

Compliant Solution (Default Locale)

This compliant solution sets the default locale to English before proceeding with string operations.

Locale.setDefault( Locale.ENGLISH);
"title".toUpperCase();

Risk Assessment

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Bibliography

\[[API 2006|AA. Bibliography#API 06]\] Class {{String}}

...