The InvariantCulture property can be used to persist data in
a culture-independent format. This provides a known format that does not change
and that can be used to serialize and deserialize data across cultures.
If you are making a security decision (such as whether to
allow access to a system resource) based on the result of a string comparison
or a case change, you should not use the invariant culture.
Instead, you should perform a case-sensitive or case-insensitive ordinal
comparison by calling a method that includes a StringComparison parameter and supplying either StringComparison.Ordinal or StringComparison.OrdinalIgnoreCase as an argument.
The Turkish ‘i’ Problem
A method call such as IsFileURI("file:") returns true if the current culture is U.S. English, but false if
the current culture is Turkish. Thus, on Turkish systems, someone could
circumvent security measures that block access to case-insensitive URIs that
begin with "FILE:". The Turkish alphabet includes an "I
with a dot" character "İ", which is the capital version of
"i". Turkish also includes a lowercase "i without a dot"
character, "ı", which capitalizes to "I".
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.