c.lang.security.info-leak-on-non-formatted-string.info-leak-on-non-formated-string

profile photo of returntocorpreturntocorp
Author
161
Download Count*
LGPL Commons Clause
License

Use %s, %d, %c... to format your variables, otherwise this could leak information.

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: info-leak-on-non-formated-string
    message: Use %s, %d, %c... to format your variables, otherwise this could leak
      information.
    metadata:
      cwe:
        - "CWE-532: Insertion of Sensitive Information into Log File"
      references:
        - http://nebelwelt.net/files/13PPREW.pdf
      category: security
      technology:
        - c
      confidence: MEDIUM
      owasp:
        - A09:2021 - Security Logging and Monitoring Failures
      subcategory:
        - audit
      likelihood: LOW
      impact: MEDIUM
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
    languages:
      - c
    severity: WARNING
    pattern: printf(argv[$NUM]);

Examples

info-leak-on-non-formatted-string.c

#include <stdio.h>

int main() {
    //ruleid: info-leak-on-non-formated-string
    printf(argv[1]);

    return 0;
}