Wiki Markup |
---|
Every Java platform has a default character encoding. The available encodings are listed in the Supported Encodings document \[[Encodings 06|AA. Java References#Encodings 06]\]. The default encoding is used when a character is converted to a sequence of bytes and _vice versa_. If characters are converted into an array of bytes to be sent as output, transmitted across some medium, input and converted back into characters, then the same encoding must be used on both sides of the conversation. |
...
Code Block | ||
---|---|---|
| ||
FileInputStream fis = new FileInputStream("SomeFile"); DataInputStream dis = new DataInputStream(fis); int bytesRead = 0; byte[] data = new byte[1024]; bytesRead = dis.readFully(data); if (bytesRead > 0) { String result = new String(data); } |
Compliant Solution
In this This compliant solution , explicitly specifies the encoding is explicitly specified by passing the string encoding
as the second argument of to the String
constructor.
Code Block | ||
---|---|---|
| ||
String encoding = "SomeEncoding" // for example, "UTF-16LE" FileInputStream fis = new FileInputStream("SomeFile"); DataInputStream dis = new DataInputStream(fis); int bytesRead = 0; byte[] data = new byte[1024]; bytesRead = dis.readFully(data); if (bytesRead > 0) { String result = new String(data, encoding); } |
...
EX1: If the data is coming from another Java application on that uses the same platform and it is known that the application is using the default character encoding, an explicit character encoding does is not need required to be specified on the receiving side.
Risk Assessment
Failure to specify the character encoding while performing file or network IO can corrupt the data.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
FIO03- J | low | unlikely | medium | P2 | L3 |
...