Page History

...

This compliant solution sanitizes the search terms by using Pattern.quote() to escape any malicious characters in the search string. Unlike the previous compliant solution, a search string using punctuation characters, such as "name =" is permitted.

	public static void FindLogEntry(String search) {
		// Sanitize search string
        search = Pattern.quote(search);
		// Construct regex dynamically from user string
		String regex = "(.*? +public\\[\\d+\\] +.*" + search + ".*)";
        // ...
    }

...

Failing to sanitize untrusted data included as part of a regular expression can result in the disclosure of sensitive information.

Automated Detection

Related Guidelines

Bibliography

...

Image Added Image Modified Image Modified IDS09-J. Specify an appropriate locale when comparing locale-dependent data