Page History

Using locale-sensitive dependent methods on locale-sensitive dependent data can produce unexpected results when the locale is unspecified. Programming language identifiers, protocol keys, and HTML tags are often specified in a particular locale, usually Locale.ENGLISH. It may even be possible to bypass input filters by changing the default locale, which can alter the behavior of locale-sensitive dependent methods. For example, when a string is converted to upper case, it may be declared valid; however, changing the string back to lower case during subsequent execution may result in a blacklisted string.

Any program which invokes local-sensitive dependent methods on untrusted data must explicitly specify the locale to use with these methods.

Noncompliant Code Example

This noncompliant code example uses the locale-sensitivedependent {{String.toUpperCase()}} method to convert an HTML tag to upper case. While the English locale would convert "title" to "TITLE", the Turkish locale will convert "title" to "T?TLE," where '?' is the Latin capital letter 'I' with a dot above the character \[[API 2006|AA. Bibliography#API 06]\]. 

"title".toUpperCase();

Compliant Solution (Explicit Locale)

This compliant solution explicitly sets the locale to English to avoid unexpected results.

...

This rule also applies to the String.equalsIgnoreCase() method.

Compliant Solution (Default Locale)

This compliant solution sets the default locale to English before proceeding with string operations.

Locale.setDefault(Locale.ENGLISH);
"title".toUpperCase();

Risk Assessment

Failure to specify the appropriate locale when using locale-dependent methods on local-dependent data without specifying the appropriate locale may result in unexpected behavior.

Bibliography

...