[GitHub] [httpcomponents-core] github-code-scanning[bot] commented on a diff in pull request #416: Filter characters before byte conversion

["github-code-scanning[bot] (via GitHub)" <gi...@apache.org>]

github-code-scanning[bot] commented on code in PR #416:
URL: https://github.com/apache/httpcomponents-core/pull/416#discussion_r1300532354


##########
httpcore5/src/main/java/org/apache/hc/core5/util/TextUtils.java:
##########
@@ -141,4 +142,20 @@
         return s.toLowerCase(Locale.ROOT);
     }
 
+    /**
+     * Filter characters before byte conversion
+     *
+     * @since 5.2
+     */
+    @Internal
+    public static byte filterIfRequired(final int c) {
+        if ((c >= 0x20 && c <= 0x7E) || // Visible ASCII
+            (c >= 0xA0 && c <= 0xFF) || // Visible ISO-8859-1
+             c == 0x09) {               // TAB
+            return (byte) c;

Review Comment:
   ## User-controlled data in numeric cast
   
   This cast to a narrower type depends on a [user-provided value](1), potentially causing truncation.
   This cast to a narrower type depends on a [user-provided value](2), potentially causing truncation.
   
   [Show more details](https://github.com/apache/httpcomponents-core/security/code-scanning/11)



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org