IDS16-J. Do not use locale dependent methods on locale insensitive data

Using locale-sensitive methods on data that should be interpreted in a locale-independent fashion can produce unexpected results. Locale independent data includes programming language identifiers, protocol keys and HTML tags. It may even be possible to bypass input filters by supplying locale specific data. For example, when a string is converted to uppercase, it may be declared valid; however, changing the string back to lower case during subsequent execution may result in a black-listed string.

Noncompliant Code Example

This noncompliant code example uses the locale sensitive String.toUpperCase() method to convert an html tag to uppercase. This produces the string "T?TLE" in the Turkish locale wherein '?' is the Latin capital letter 'I' with a dot above the character [[API 2006]].

"title".toUpperCase();

Compliant Solution

This compliant solution explicitly sets the locale to English to avoid the unexpected result.

"title".toUpperCase(Locale.ENGLISH);

This advice also applies to the String.equalsIgnoreCase() method.

Risk Assessment

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Bibliography

[[API 2006]] Class String

IDS15-J. Prefer use of URIs rather than URLs      13. Input Validation and Data Sanitization (IDS)      IDS17-J. Understand how escape characters are interpreted when String literals are compiled