Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

According to the Java API [API 2006] for the String class:

The length of the new String is a function of the charset, and hence may not be equal to the length of the byte array. The behavior of this constructor when the given bytes are not valid in the given charset is unspecified.

...

Code Block
bgColor#CCCCFF
String encoding = "SomeEncoding" // for example, "UTF-16LE"

FileInputStream fis = new FileInputStream("SomeFile");
DataInputStream dis = new DataInputStream(fis);
int bytesRead = 0;
byte[] data = new byte[1024];

bytesRead = dis.readFully(data);

if (bytesRead > 0) {
   String result = new String(data, encoding);
}

Exceptions

FIO03-EX1: If the data is coming from another Java application that uses the same platform and it is known that the application is using the default character encoding, an explicit character encoding is not required to be specified on the receiving side.

...

Failure to specify the character encoding while performing file or network IO can corrupt the data.

Recommendation Guideline

Severity

Likelihood

Remediation Cost

Priority

Level

FIO03-J

low

unlikely

medium

P2

L3

...