The InvariantCulture property can be used to
persist data in a culture-independent format. This provides a
known format that does not change and that can be used to serialize and
deserialize data across cultures.
If you are making a
security decision (such as whether to allow access to a system resource) based on the result of a string comparison or a case change, you
should not use the invariant culture. Instead, you should perform a case-sensitive or case-insensitive ordinal comparison by calling a method that includes a
StringComparison parameter and supplying either
StringComparison.Ordinal or
StringComparison.OrdinalIgnoreCase as an argument.
The Turkish ‘i’ Problem
A method call such as
IsFileURI("file:")
returns true if the current culture is U.S. English, but false if the
current culture is Turkish. Thus, on Turkish systems, someone could
circumvent
security measures that block access to case-insensitive URIs that begin
with "FILE:". The Turkish alphabet includes an "I with a dot" character "İ", which is the capital
version of "i". Turkish also includes a lowercase "i without a dot" character, "ı", which capitalizes to "I".
No comments:
Post a Comment