NSRunAlertPanel + format string is not a string literal (potentially insecure)

Question

Ok, so I know the format string is not a string literal warning, but I don't know why is it appearing on NSRunAlertPanel, the definition is:

APPKIT_EXTERN NSInteger NSRunAlertPanel(NSString *title, NSString *msgFormat, NSString *defaultButton, NSString *alternateButton, NSString *otherButton, ...) NS_FORMAT_FUNCTION(2,6);

When reporting errors I usually just pass the error.localizedDescription on the message, example:

NSRunAlertPanel(@"error", err.localizedDescription, @"OK",nil,nil);

But after upgrading to xcode 5.1, I started getting this warnings.

So I tried something like this:

NSRunAlertPanel(@"error", [NSString stringWithFormat:@"%@", err.localizedDescription], @"OK", nil, nil);

And its the same situation. Anyone has any ideas on how to fix this ?

Answer 1

msgFormat is the message format string and should be a string literal. The necessary arguments are added as "variable argument list" after otherButton. For example

NSRunAlertPanel(@"error", @"%@", @"OK", nil, nil, err.localizedDescription);
           message format---^         arguments---^