Implicit Default Locale

ID

kotlin.implicit_default_locale

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Kotlin

Tags

locale, portability

Description

Reports calls to locale-sensitive String methods that use the JVM default locale because no explicit Locale argument was passed.

The no-arg overloads of uppercase(), lowercase(), toUpperCase(), and toLowerCase() delegate to Locale.getDefault(), which differs across environments and user settings. The most notable case is the Turkish locale: "I".lowercase() returns "ı" instead of "i", silently breaking case-insensitive comparisons and key lookups.

Rationale

val tag  = label.uppercase()        // FLAW — default Locale
val key  = id.toLowerCase()         // FLAW — default Locale

val tag  = label.uppercase(Locale.ROOT)    // OK
val key  = id.toLowerCase(Locale.ENGLISH)  // OK

Remediation

Always pass an explicit Locale:

  • Use Locale.ROOT for technical strings (identifiers, HTTP headers, protocol tokens).

  • Use Locale.getDefault() explicitly only when user-visible locale-sensitivity is intentional.

References