Critical bug in StringUtil.equalsIgnoreCase

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 6.2.3 CE GA4, 6.2.4 CE GA5, 6.2.10 EE GA1, 7.0.0 Alpha 5
• Fix Version/s: 6.2.X EE, 7.0.0 Beta 2
• Component/s: Core Infrastructure
• Labels:
  • 6.1_release_notes
  • Externally_Reported_Sec_Vuln
  • QA-CT
  • liferay-fixpack-portal-94-6210
• Branch Version/s:
  6.2.x
• Backported to Branch:
  Committed
• Story Points: 1
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/33801

Method StringUtil.equalsIgnoreCase(s1, s2) tries to be smart on comparing string ignoring case.
It use uppercase and lowercase chars distance in ascii table to ignore case.

Unfortunately if you compare "2001" with "R001" the function returns they are equals because the distance between "2" and "R" is -32, the same distance of "A" and "a".

I suggest to change this porting of code

        for (int i = 0; i < s1.length(); i++) {
            char c1 = s1.charAt(i);

            char c2 = s2.charAt(i);

            if (c1 == c2) {
                continue;
            }

            if ((c1 > 127) || (c2 > 127)) {

                // Georgian alphabet needs to check both upper and lower case

                if ((Character.toLowerCase(c1) == Character.toLowerCase(c2)) ||
                    (Character.toUpperCase(c1) == Character.toUpperCase(c2))) {

                    continue;
                }

                return false;
            }

            int delta = c1 - c2;

            if ((delta != 32) && (delta != -32)) {
                return false;
            }
        }

with

        for (int i = 0; i < s1.length(); i++) {
            char c1 = s1.charAt(i);

            char c2 = s2.charAt(i);

            if (c1 == c2) {
                continue;
            }

            if ((c1 > 127) || (c2 > 127)) {

                // Georgian alphabet needs to check both upper and lower case

                if ((Character.toLowerCase(c1) == Character.toLowerCase(c2)) ||
                    (Character.toUpperCase(c1) == Character.toUpperCase(c2))) {

                    continue;
                }

                return false;
            }

            if ((Character.toLowerCase(c1) != Character.toLowerCase(c2)) {
                return false;
            }
        }