Compare usage sharing keys in the root locale

pipeline/pipeline.engines.fiftyone/src/main/java/fiftyone/pipeline/engines/fiftyone/data/EvidenceKeyFilterShareUsage.java

@@ -29,6 +29,7 @@
 
 import java.util.HashSet;
 import java.util.List;
+import java.util.Locale;
 import java.util.Set;
 
 import static fiftyone.pipeline.core.Constants.*;
@@ -167,15 +168,15 @@ public EvidenceKeyFilterShareUsage(
         this.blockedHttpHeaders.add("cookie");
         this.includeSession = includeSession;
         this.sessionCookieName = sessionCookieName == null ?
-            null : sessionCookieName.toLowerCase();
+            null : sessionCookieName.toLowerCase(Locale.ROOT);
         for (String header : blockedHttpHeaders) {
-            String lowerHeader = header.toLowerCase();
+            String lowerHeader = header.toLowerCase(Locale.ROOT);
             if (!this.blockedHttpHeaders.contains(lowerHeader)) {
                 this.blockedHttpHeaders.add(lowerHeader);
             }
         }
         for (String parameter : includedQueryStringParams) {
-            String lowerParameter = parameter.toLowerCase();
+            String lowerParameter = parameter.toLowerCase(Locale.ROOT);
             if (!this.includedQueryStringParams.contains(lowerParameter)) {
                 this.includedQueryStringParams.add(lowerParameter);
             }
@@ -189,7 +190,7 @@ public boolean include(String key) {
         if (ShareUsageEvidence.HTTP_REQUEST_KEY.equalsIgnoreCase(key)) {
             return false;
         }
-        String lowerKey = key.toLowerCase();
+        String lowerKey = key.toLowerCase(Locale.ROOT);
         for (String neverShared : NEVER_SHARED_EVIDENCE_KEYS) {
             if (lowerKey.equals(neverShared) ||
                 lowerKey.endsWith(EVIDENCE_SEPERATOR + neverShared)) {

pipeline/pipeline.engines.fiftyone/src/test/java/fiftyone/pipeline/engines/fiftyone/flowelements/ShareUsageOptionsTests.java

@@ -46,6 +46,7 @@
 import java.io.OutputStream;
 import java.util.ArrayList;
 import java.util.HashMap;
+import java.util.Locale;
 import java.util.Map;
 import java.util.concurrent.atomic.AtomicInteger;
 
@@ -262,6 +263,41 @@ public void keysAreReadWithoutRegardToCase() throws Exception {
             sent.getElementsByTagName("Sequence").item(0).getTextContent());
     }
 
+    /**
+     * The never-shared keys are matched without regard to case under any
+     * default locale. Under a Turkish default locale "I" lower-cases to a
+     * dotless "i", so a comparison in the default locale would let
+     * "ID.EMAIL" through.
+     */
+    @Test
+    public void neverSharedKeys_TurkishLocale_StillRefused() {
+        Locale original = Locale.getDefault();
+        Locale.setDefault(Locale.forLanguageTag("tr-TR"));
+        try {
+            EvidenceKeyFilterShareUsage filter = new EvidenceKeyFilterShareUsage(
+                new ArrayList<String>(),
+                new ArrayList<String>(),
+                false,
+                DEFAULT_SESSION_COOKIE_NAME);
+            EvidenceKeyFilterShareUsage shareAll =
+                new EvidenceKeyFilterShareUsage(
+                    new ArrayList<String>(),
+                    new ArrayList<String>(),
+                    false,
+                    DEFAULT_SESSION_COOKIE_NAME,
+                    true,
+                    true);
+            for (String key : new String[] {
+                "ID.EMAIL", "Query.ID.Email", "HEADER.COOKIE",
+                "Server.Request-Path", "SERVER.REQUEST-QUERY", "ID.SALT"}) {
+                assertFalse(filter.include(key), key);
+                assertFalse(shareAll.include(key), key);
+            }
+        } finally {
+            Locale.setDefault(original);
+        }
+    }
+
     @Test
     public void tracker_BuildsOneCache() {
         CountingCacheBuilder builder = new CountingCacheBuilder();