Use Locale For Case Conversion

ID

java.locale_convert_case

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Best Practice

Language

Java

Tags

best-practice

Description

Reports String.toUpperCase() and String.toLowerCase() calls that do not pass an explicit Locale.

Rationale

The no-arg overloads use the JVM’s default locale at runtime. The result therefore depends on the OS / user environment that happens to be running the code. The most famous failure case is the Turkish locale’s dotless ı: "I".toLowerCase() returns "ı" (not "i") when the JVM default locale is tr. Code that does string-key normalization, case-insensitive comparison, or builds identifiers from input then breaks subtly on Turkish (and on a few other locales).

// Bad — locale-dependent
String key = input.toUpperCase();

// Good — deterministic
String key = input.toUpperCase(Locale.ROOT);
String text = input.toLowerCase(Locale.ENGLISH);

Remediation

Always pass an explicit Locale:

  • Locale.ROOT — the locale-neutral choice for technical strings (identifiers, keys).

  • Locale.ENGLISH / Locale.US — when the result is intended to be displayed in that language.

  • The user’s actual Locale — when the result is presented to a human in their language.

References