76 lines
4.2 KiB
Plaintext
76 lines
4.2 KiB
Plaintext
== Why is this an issue?
|
|
|
|
A `printf-`-style format string is a string that contains placeholders, usually represented by special characters such as "%s" or "{}", depending on the technology in use. These placeholders are replaced by values when the string is printed or logged.
|
|
|
|
Because `printf`-style format strings are interpreted at runtime, rather than validated by the compiler, they can contain errors that result in the wrong strings being created.
|
|
|
|
This rule checks whether every format string specifier can be correctly matched with one of the additional arguments when calling the following methods:
|
|
|
|
* https://docs.oracle.com/javase/8/docs/api/java/lang/String.html#format-java.lang.String-java.lang.Object...-[`java.lang.String#format`]
|
|
* https://docs.oracle.com/javase/8/docs/api/java/util/Formatter.html#format-java.lang.String-java.lang.Object...-[`java.util.Formatter#format`]
|
|
* https://docs.oracle.com/javase/8/docs/api/java/io/PrintStream.html#format-java.lang.String-java.lang.Object...-[`java.io.PrintStream#format`]
|
|
* https://docs.oracle.com/javase/8/docs/api/java/text/MessageFormat.html#format-java.lang.String-java.lang.Object...-[`java.text.MessageFormat#format`]
|
|
* https://docs.oracle.com/javase/8/docs/api/java/io/PrintWriter.html#format-java.lang.String-java.lang.Object...-[`java.io.PrintWriter#format`]
|
|
* https://docs.oracle.com/javase/8/docs/api/java/io/PrintStream.html#printf-java.lang.String-java.lang.Object...-[`java.io.PrintStream#printf`]
|
|
* https://docs.oracle.com/javase/8/docs/api/java/io/PrintWriter.html#printf-java.lang.String-java.lang.Object...-[`java.io.PrintWriter#printf`]
|
|
* https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/String.html#formatted(java.lang.Object...)[`java.lang.String#formatted`] (since Java 15)
|
|
* logging methods of https://www.slf4j.org/api/org/slf4j/Logger.html[`org.slf4j.Logger`], https://docs.oracle.com/javase/8/docs/api/java/util/logging/Logger.html[`java.util.logging.Logger`], https://logging.apache.org/log4j/2.x/javadoc/log4j-api/org/apache/logging/log4j/Logger.html[`org.apache.logging.log4j.Logger`].
|
|
|
|
== How to fix it
|
|
|
|
A `printf-`-style format string is a string that contains placeholders, which are replaced by values when the string is printed or logged. Mismatch in the format specifiers and the arguments provided can lead to incorrect strings being created.
|
|
|
|
To avoid issues, a developer should ensure that the provided arguments match format specifiers.
|
|
|
|
Note that https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/text/MessageFormat.html[MessageFormat] is used by most logging mechanisms, for example `java.util.logging.Logger`, thus the _single quote_ must be escaped by a _double single quote_.
|
|
|
|
=== Code examples
|
|
|
|
==== Noncompliant code example
|
|
|
|
[source,java,diff-id=1,diff-type=noncompliant]
|
|
----
|
|
void logging(org.slf4j.Logger slf4jLog, java.util.logging.Logger logger) {
|
|
String.format("Too many arguments %d and %d", 1, 2, 3); // Noncompliant - the third argument '3' is unused
|
|
String.format("First {0} and then {1}", "foo", "bar"); //Noncompliant - it appears there is confusion with the use of "java.text.MessageFormat" - parameters "foo" and "bar" will be ignored here
|
|
|
|
|
|
slf4jLog.debug("The number: ", 1); // Noncompliant - String contains no format specifiers.
|
|
|
|
logger.log(level, "Can't load library \"{0}\"!", "foo"); // Noncompliant - the single quote ' must be escaped
|
|
}
|
|
----
|
|
|
|
==== Compliant solution
|
|
|
|
[source,java,diff-id=1,diff-type=compliant]
|
|
----
|
|
void logging(org.slf4j.Logger slf4jLog, java.util.logging.Logger logger) {
|
|
String.format("Too many arguments %d and %d", 1, 2);
|
|
String.format("First %s and then %s", "foo", "bar");
|
|
|
|
slf4jLog.debug("The number: {}", 1);
|
|
|
|
logger.log(level, "Can''t load library \"{0}\"!", "foo");
|
|
}
|
|
----
|
|
|
|
== Resources
|
|
|
|
* https://wiki.sei.cmu.edu/confluence/x/J9YxBQ[CERT, FIO47-C.] - Use valid format strings
|
|
* https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/text/MessageFormat.html[java.text.MessageFormat]
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
include::../comments-and-links.adoc[]
|
|
|
|
endif::env-github,rspecator-view[]
|