Using local sensitive methods on data that should be interpreted locale independently can produce unexpected results. Locale independent data includes programming language identifiers, protocol keys and HTML tags. It may even be possible to bypass input filters by supplying locale specific data. For example, if a string is converted to uppercase, it may be declared valid; however, further down when changed to lower case, it may result in a black-listed string.
Noncompliant Code Example
| Wiki Markup |
|---|
This noncompliant code example uses the locale sensitive {{String.toUpperCase()}} method to convert an html tag to uppercase. This produces the string "T?TLE" in the Turkish locale wherein '?' is the Latin capital letter 'I' with a dot above the character \[[API 2006|AA. Java References#API 06]\]. |
| Code Block | ||
|---|---|---|
| ||
"title".toUpperCase(); |
Compliant Solution
This compliant solution explicitly sets the locale to English to avoid the unexpected result.
| Code Block | ||
|---|---|---|
| ||
"title".toUpperCase(Locale.ENGLISH); |
This advice also applies to the String.equalsIgnoreCase() method.
Risk Assessment
Guideline | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
IDS16-J | medium | probable | medium | P8 | L2 |
Automated Detection
TODO
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[API 2006|AA. Java References#API 06]\] Class {{String}} |
IDS15-J. Prefer using URIs to URLs 10. Input Validation and Data Sanitization (IDS) IDS17-J. Understand how escape characters are interpreted when String literals are compiled