- Rules
- Risk Assessment Summary
- IDS00-J. Sanitize untrusted data passed across a trust boundary
- IDS01-J. Normalize strings before validating them
- IDS02-J. Canonicalize path names before validating them
- IDS03-J. Do not log unsanitized user input
- IDS04-J. Limit the size of files passed to ZipInputStream
- IDS05-J. Use a subset of ASCII for file and path names
- IDS06-J. Exclude user input from format strings
- IDS07-J. Do not pass untrusted, unsanitized data to the Runtime.exec() method
- IDS08-J. Sanitize untrusted data passed to a regex
- IDS09-J. Do not use locale-dependent methods on locale-dependent data without specifying the appropriate locale
- IDS10-J. Do not split characters between two data structures
- IDS11-J. Eliminate noncharacter code points before validation
- IDS12-J. Perform lossless conversion of String data between differing character encodings
- IDS13-J. Use compatible encodings on both sides of file or network I/O
This chapter is from the book
This chapter is from the book
This chapter is from the book
IDS09-J. Do not use locale-dependent methods on locale-dependent data without specifying the appropriate locale
Using locale-dependent methods on locale-dependent data can produce unexpected results when the locale is unspecified. Programming language identifiers, protocol keys, and HTML tags are often specified in a particular locale, usually Locale.ENGLISH. It may even be possible to bypass input filters by changing the default locale, which can alter the behavior of locale-dependent methods. For example, when a string is converted to uppercase, it may be declared valid; however, changing the string back to lowercase during subsequent execution may result in a blacklisted string.
Any program which invokes locale-dependent methods on untrusted data must explicitly specify the locale to use with these methods.
Noncompliant Code Example
This noncompliant code example uses the locale-dependent String.toUpperCase() method to convert an HTML tag to uppercase. While the English locale would convert “title” to “TITLE,” the Turkish locale will convert “title” to “T?TLE,” where “?” is the Latin capital letter “I” with a dot above the character [API 2006].
"title".toUpperCase();
Compliant Solution (Explicit Locale)
This compliant solution explicitly sets the locale to English to avoid unexpected results.
"title".toUpperCase(Locale.ENGLISH);
This rule also applies to the String.equalsIgnoreCase() method.
Compliant Solution (Default Locale)
This compliant solution sets the default locale to English before proceeding with string operations.
Locale.setDefault(Locale.ENGLISH); "title".toUpperCase();
Risk Assessment
Failure to specify the appropriate locale when using locale-dependent methods on locale-dependent data may result in unexpected behavior.
|
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|
IDS09-J |
medium |
probable |
medium |
P8 |
L2 |
Bibliography
|
[API 2006] |
Class String |