Menu
Are there security implications for passing a user-provided (untrusted) format string to string.Format?
Can this lead to unexpected code execution? Can it result in infinite CPU or memory consumption?
Please assume that the following are untrusted inputs:
Exceptions being thrown are not a problem because that is easily handled.
223
The function strftime() is MT-Safe as long as no thread calls setlocale() while this function is executing. The function strftime_l() is MT-Safe as long as no thread calls freelocale() on locale while this function is executing.
Python's f-strings are actually safer. String formatting may be dangerous when a format string depends on untrusted data. So, when using str. format() or % -formatting, it's important to use static format strings, or to sanitize untrusted parts before applying the formatter function.
The Format String exploit occurs when the submitted data of an input string is evaluated as a command by the application.
In java, String format() method returns a formatted string using the given locale, specified format string, and arguments. We can concatenate the strings using this method and at the same time, we can format the output concatenated string.
It's possible to produce very long outputs with rather small format strings. This can cause performance problems and potentially even out of memory errors.
For example string.Format("{0,9999999}",0) produces a string that consumes 20MB of RAM. You can repeat that pattern to increase the output size further.
80
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
