Collapse of data into unsafe value

ID

scala.strings.scala_strings_rule_normalizeaftervalidation

Severity

low

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Strings

Language

Scala

Description

IDS01-J. Normalize strings before validating them

Rationale

IDS01-J. Normalize strings before validating them

The following code illustrates a vulnerable pattern detected by this rule:

// Normalising last can turn a character the check allowed into one it would have rejected.
class TitleSanitiser {
  def normaliseAfterChecking(supplied: CharSequence) = {
    // VULNERABLE: Collapse of data into unsafe value
    val forbidden = Pattern.compile("[<>]")
    val found = forbidden.matcher(supplied)
    if (found.find) throw new IllegalStateException
    Normalizer.normalize(supplied, Normalizer.Form.NFKC)
  }
}

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References

© 2026 Xygeni. All rights reserved