String literal embeds a non-printable control character
ID |
c.maintainability.control_char_in_literal |
Severity |
low |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Literal Format |
Language |
C / C++ |
Description
Reports a string literal containing an escape for a non-printable control character - the bell (\a), backspace (\b), form feed (\f), vertical tab (\v), or a \x/octal escape in the 0x00-0x1F control range - other than the common, self-explanatory \n, \t, \r, and \0.
Rationale
A control character has no visible glyph, so once it is embedded inside a longer literal the source only shows the surrounding text; a reader skimming the code cannot tell that a BEL, form feed, or an arbitrary \x1b-style byte is hiding in the middle of what looks like an ordinary string. That silent content changes what the string prints or does when interpreted by a terminal, log viewer, or downstream parser, and is a common way an unintended byte ends up in output.
The following code illustrates the pattern detected by this rule:
void alert(void)
{
// FLAGGED: String literal embeds a non-printable control character
const char *bell = "Warning\aDone";
// FLAGGED: String literal embeds a non-printable control character
const char *hex_esc = "prefix\x1bmid";
// FLAGGED: String literal embeds a non-printable control character
const char *octal_esc = "prefix\033mid";
// FLAGGED: String literal embeds a non-printable control character
const char *form_feed = "page\fbreak";
const char *newline = "line1\nline2";
const char *tab = "col1\tcol2";
const char *plain = "hello world";
}