...
It is important to not that for expressions such as regular expressions and SQL sequences, where a particular wild card is of the form '\X', the java String representation would be:
| Code Block |
|---|
"\\X" |
Noncompliant Code Example
In the following example, a method performing matching to regular expressions, matchPattern, is implemented. However, the assumption is that the pattern matches to word boundaries and will thus split a given string into individual words.
...
The String WORDS is compiled to the backspace character instead of the regular expression for splitting on word boundaries.
Compliant Solution
This compliant solution shows the correct value of the String WORDS to produce a regular expression to split on word boundaries.
...
In this example, the String WORDS is compiled to "\b", the pattern for matching to word boundaries. This is because the escape on the slash is converted to a single slash when the String is compiled.
Noncompliant Code Example
In the following example, a method performing matching to regular expressions, matchPattern, is implemented to split input Strings on one or more white space characters. However, the String SPACE is not correctly formed.
...
String SPACE attempts to escape the character 's', producing an illegal escape character compiler error.
Compliant Solution
This compliant solution shows the correct value of the String SPACE to produce a regular expression to split one or more white space characters.
...
In this example, the String SPACE is compiled to "\s+", the pattern for matching to one or more white space characters.
Risk Assessment
Incorrect usage of escape characters in Strings for statements involving Pattern, SQL, XML, and other systems that take Strings could result in misinterpretation of and potentially corruption of data.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
CON37-J | medium | unlikely | high | P2 | L3 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[API 06|AA. Java References#API 06]\] [Class Pattern|http://java.sun.com/javase/6/docs/api/java/util/regex/Pattern.html] \[[API 06|AA. Java References#API 06]\] [Package java.sql|http://java.sun.com/javase/6/docs/api/java/sql/package-summary.html] \[[MSDN 09|AA. Java References#MSDN 09]\] [Using SQL Escape Sequences|http://msdn.microsoft.com/en-us/library/ms378045(SQL.90).aspx] |