FIO03-J. Specify the character encoding while performing file or network IO

Every Java platform has a default character encoding. The available encodings are listed in the Supported Encodings document [[Encodings 2006]]. Conversion between characters and sequences of bytes requires a character encoding to specify the details of the conversion. Such conversions use the system default encoding in the absence of an explicitly specified encoding. When characters are converted into an array of bytes to be sent as output, transmitted across some medium, input, and converted back into characters, the same encoding must be used on both sides of the conversation; disagreement over character encodings can cause data corruption.

According to the Java API [API 2006] for the String class:

The length of the new String is a function of the charset, and hence may not be equal to the length of the byte array. The behavior of this constructor when the given bytes are not valid in the given charset is unspecified.

See the related guideline FIO02-J. Keep track of bytes read and account for character encoding while reading data for more information.

Noncompliant Code Example

This noncompliant code example reads a byte array and converts it into a String using the platform's default character encoding. When the default encoding differs from the encoding that was used to produce the byte array, the resulting String is likely to be incorrect. Undefined behavior can occur when some of the input lacks a valid character representation in the default encoding.

FileInputStream fis = new FileInputStream("SomeFile");
DataInputStream dis = new DataInputStream(fis);
int bytesRead = 0;
byte[] data = new byte[1024];

bytesRead = dis.readFully(data);

if (bytesRead > 0) {
  String result = new String(data);
}

Compliant Solution

This compliant solution explicitly specifies the intended character encoding by passing it as the second argument to the String constructor (e.g. the string encoding in this example).

String encoding = "SomeEncoding" // for example, "UTF-16LE"

FileInputStream fis = new FileInputStream("SomeFile");
DataInputStream dis = new DataInputStream(fis);
int bytesRead = 0;
byte[] data = new byte[1024];

bytesRead = dis.readFully(data);

if (bytesRead > 0) {
   String result = new String(data, encoding);
}

Exceptions

FIO03-EX1: An explicit character encoding may be omitted on the receiving side when the data was created by another Java application that both uses the same platform and also uses the default character encoding.

Risk Assessment

Failure to specify the character encoding while performing file or network IO can corrupt the data.

Automated Detection

Sound automated detection of this vulnerability is not feasible.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Bibliography

[[Encodings 2006]]

FIO02-J. Keep track of bytes read and account for character encoding while reading data      Input Output (FIO)      FIO04-J. Canonicalize path names before validating them