Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Wiki Markup
Every Java platform has a default character encoding. The available encodings are listed in the Supported Encodings document \[[Encodings 06|AA. Java References#Encodings 06]\]. The default encoding is used when a character is converted to a sequence of bytes and _vice versa_. If characters are converted into an array of bytes to be sent as output, transmitted across some medium, input and converted back into characters, then the same encoding must be used on both sides of the conversation.

...

Code Block
bgColor#FFCCCC
FileInputStream fis = new FileInputStream("SomeFile");
DataInputStream dis = new DataInputStream(fis);
int bytesRead = 0;
byte[] data = new byte[1024];

bytesRead = dis.readFully(data);

if (bytesRead > 0) {
  String result = new String(data);
}

Compliant Solution

In this This compliant solution , explicitly specifies the encoding is explicitly specified by passing the string encoding as the second argument of to the String constructor.

Code Block
bgColor#CCCCFF
String encoding = "SomeEncoding" // for example, "UTF-16LE"

FileInputStream fis = new FileInputStream("SomeFile");
DataInputStream dis = new DataInputStream(fis);
int bytesRead = 0;
byte[] data = new byte[1024];

bytesRead = dis.readFully(data);

if (bytesRead > 0) {
   String result = new String(data, encoding);
}

...

EX1: If the data is coming from another Java application on that uses the same platform and it is known that the application is using the default character encoding, an explicit character encoding does is not need required to be specified on the receiving side.

Risk Assessment

Failure to specify the character encoding while performing file or network IO can corrupt the data.

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

FIO03- J

low

unlikely

medium

P2

L3

...