Using an unsanitized, externally-provided format string could lead to errors at runtime and open the door to attackers. This rule raises an issue when an externally-provided format string is used.


== Noncompliant Code Example

----
public void formattedLog(String format, String message) {
  String logLine = String.format(format, message);  // Noncompliant
  LOGGER.info(logLine);
}
----


== See

* https://www.owasp.org/index.php/Top_10-2017_A1-Injection[OWASP Top 10 2017 Category A1] - Injection
* http://cwe.mitre.org/data/definitions/134[MITRE, CWE-134] - Use of Externally-Controlled Format String
* https://wiki.sei.cmu.edu/confluence/x/RdYxBQ[CERT, FIO30-C.] - Exclude user input from format strings
* https://www.sans.org/top25-software-errors/#cat2[SANS Top 25] - Risky Resource Management

