Sunday, August 12, 2018

Invariant Culture

The InvariantCulture property can be used to persist data in a culture-independent format. This provides a known format that does not change and that can be used to serialize and deserialize data across cultures.
 
If you are making a security decision (such as whether to allow access to a system resource) based on the result of a string comparison or a case change, you should not use the invariant culture. Instead, you should perform a case-sensitive or case-insensitive ordinal comparison by calling a method that includes a StringComparison parameter and supplying either StringComparison.Ordinal or StringComparison.OrdinalIgnoreCase as an argument.
 
The Turkish ‘i’ Problem
A method call such as IsFileURI("file:") returns true if the current culture is U.S. English, but false if the current culture is Turkish. Thus, on Turkish systems, someone could circumvent security measures that block access to case-insensitive URIs that begin with "FILE:". The Turkish alphabet includes an "I with a dot" character "İ", which is the capital version of "i". Turkish also includes a lowercase "i without a dot" character, "ı", which capitalizes to "I".
 

No comments:

Post a Comment