Collapse of data into unsafe value
ID |
scala.strings.scala_strings_rule_normalizeaftervalidation |
Severity |
low |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Strings |
Language |
Scala |
Rationale
IDS01-J. Normalize strings before validating them
The following code illustrates a vulnerable pattern detected by this rule:
// Normalising last can turn a character the check allowed into one it would have rejected.
class TitleSanitiser {
def normaliseAfterChecking(supplied: CharSequence) = {
// VULNERABLE: Collapse of data into unsafe value
val forbidden = Pattern.compile("[<>]")
val found = forbidden.matcher(supplied)
if (found.find) throw new IllegalStateException
Normalizer.normalize(supplied, Normalizer.Form.NFKC)
}
}
Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.
References
-
OWASP Top 10 2025 - A05 : Injection.