Page History

According to the Java API \[[API 06|AA. Java References#API 06]\], class {{Character}} documentation (Unicode Character Representations):

The char data type (and therefore consequently the value that a Character object encapsulates) are based on the original Unicode specification, which defined characters as fixed-width 16-bit entities. The Unicode standard has since been changed to allow for characters whose representation requires more than 16 bits. The range of legal code points is now U+0000 to U+10FFFF, known as Unicode scalar value.

The Java 2 platform uses the UTF-16 representation in char arrays and in the String and StringBuffer classes. In this representation, supplementary characters are represented as a pair of char values, the first from the high-surrogates range, (\uD800-\uDBFF), the second from the low-surrogates range (\uDC00-\uDFFF).

An int value represents all Unicode code points, including supplementary code points. The lower (least significant) 21 bits of int are used to represent Unicode code points and the upper (most significant) 11 bits must be zero. Unless otherwise specified, the behavior with respect to supplementary characters and surrogate char values is as follows:

• The methods that only accept a char value cannot support supplementary characters. They treat char values from the surrogate ranges as undefined characters. For example, Character.isLetter('\uD840') returns false, even though this specific value if followed by any low-surrogate value in a string would represent a letter.
• The methods that accept an int value support all Unicode characters, including supplementary characters. For example, Character.isLetter(0x2F81A) returns true because the code point value represents a letter (a CJK ideograph).

...

// Fails for supplementary or combining characters
public static String trim_bad1(String string) {
  char ch;
  for (int i = 0; i <&lt; string.length(); i += 1) {
    ch = string.charAt(i);
    if (!Character.isLetter(ch))
      break;
    }
  return string.substring(i);
}

...

// Fails for combining characters
public static String trim_bad2(String string) {
  int ch;
  for (int i = 0; i <&lt; string.length(); i += Character.charCount(ch)) {
    int ch = string.codePointAt(i);
    if (!Character.isLetter(ch))
      break;
    }
  return string.substring(i);
}

...

public static String trim_good(String string) {
  BreakIterator iter = BreakIterator.getCharacterInstance();
  iter.setText(string);
  for (int i = iter.first(); i != BreakIterator.DONE; i = iter.next()) {
    int ch = string.codePointAt(i);
    if (!Character.isLetter(ch)) {
      break;
    }
    
    if (i == BreakIterator.DONE) { // first or last text boundary has been reached
      return """";
    } else {
      return string.substring(i);
    }
  }
  return string;
}

...

Automated Detection

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[API 06|AA. Java References#API 06]\] Classes {{Character}} and {{BreakIterator}}
\[[Hornig 07|AA. Java References#Hornig 07]\] Problem areas: Characters

...

IDS08-J. Sanitize before processing or storing user input            49. Miscellaneous (MSC)            99. The Void (VOID)