java - Fixed fortify scan Locale changes are reappearing -

-

i have 1 j2ee application , application, fortify scan shows locale dependent issues.

i have fixed issues using locale.english in touppercase(locale.english) , tolowercase(locale.english) functions while comparing strings, earlier,

firstname.trim().tolowercase();

now

firstname.trim().tolowercase(locale.english);

and again run fortify scan on application. however, second time, fortify scan shows locale error @ same place.

does knows, how can fix these kind of issues?

thanks, jay

the issue category "portability flaw: locale dependent comparison" (ruleguid=d8e9ed3b-22ec-4cba-98c8-7c67f73ccf4c) belongs "code quality" kingdom , low risk issue. leave un-remediated.

rationale when "java.lang.string.touppercase()/tolowercase()" used without setting locale, use default locale. may cause security checking being bypassed. example, want exclude "script" user input; if default language turkish, tag.touppercase() returns "t\u0130tle", "\u0130" "latin capital letter dot above" character. therefor "script" checking bypassed.

if (tag.touppercase().equals("script")){   return null;}

remediation

(1) can set language when start vm, , mark issue "not issue"

java -duser.language=en -duser.country=us -duser.variant=us mainclass

(2) or, set language code

import java.util.locale; //be aware locale.setdefault global, below set locale en_us_win     locale.setdefault(new locale("en", "us", "win"));

(3) or, if clients use different languages, use httpservletrequest.getlocale

// see sample code here


Comments

Post a Comment

Popular posts from this blog

sql - invalid in the select list because it is not contained in either an aggregate function -

-
i can't figure out rewrite sql statement avoid error below msg 8120, level 16, state 1, line 26 column 'staffmember.staffmemberid' invalid in select list because not contained in either aggregate function or group clause. sql statment select (select [dbo].[udf_readstaffmemberbasic](sm.staffmemberid) xml path ('staffmembersummary'), root ('items'), type ), count(sm.staffmemberid) totalresults, ceiling(cast(count(sm.staffmemberid) decimal)/ @pagesize) totalpages staffmember sm inner join staffmembertoadditionalrole ar on sm.staffmemberid = ar.staffmemberid (sm.firstname '%' + @name + '%' or sm.surname '%' + @name + '%') , (@floorid null or sm.floorid = @floorid) , (@directorateid null or sm.directorateid = @directorateid) , (@additionalroleid null or ar.additionalroleid = @additionalroleid) order sm.staffmemberid offset @page * @pagesize rows fe...
Read more

Angularjs unit testing - ng-disabled not working when adding text to textarea -

-
i trying test angularjs component using karma, mocha, power-assert. have textarea , button in component, button disabled based on length of text in textarea. when run component in browser works perfectly. can't figure out how test functionality. here's bit of code. inquiryform.js function inquiryform($scope) { // plan add logic here } angular.module('myapp').component('inquiryform', { controller: inquiryform, controlleras: 'inquiryform', templateurl: 'inquiryform.html' }); inquiryform.html <div class="contact"> <div>thanks contacting us.</div> <form> <textarea ng-model="inquiryform.inquirytext" name=""></textarea> <input type="submit" value="send" ng-disabled="!inquiryform.inquirytext.length"> </form> </div> inquiryformtest.js describe('inquiry form ', () => { let $r...
Read more

How to start daemon on android by adb -

-
can me please, head swollen... i trying run daemon on android emu/device command: adb -s <device_name> shell su -c /dir/daemon <port_number> but nothink happens, , no errors! if do: adb -s <device> shell and form shell cmdline: su -c /dir/daemon <port_number> than work fine. try use shell-script , run: adb -s <device_name> shell sh su -c /dir/script.sh <port_number> and try generate script qt code port number , use: adb -s <device_name> shell sh su -c /dir/script.sh but not helped... problem if enter adb shell previous run daemon - work. problem on different device/emu/iso_image different command format not work. example: adb -s <device_name> shell su -c /dir/daemon <port_number> // work @ emu, not @ iso and vice: adb -s <device_name> shell su -c "/dir/daemon <port_number>" // work @ iso etc. everybody can answer what's matter? sorry english adb shell su -c ...
Read more