Use of Externally-Controlled Format String

ID

scala.strings.scala_strings_rule_formatstringmanipulation

Severity

high

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Strings

Language

Scala

Description

Allowing user input to control format parameters could enable an attacker to cause exceptions to be thrown or leak information.Attackers may be able to modify the format string argument, such that an exception is thrown. If this exception is left uncaught, it may crash the application. Alternatively, if sensitive information is used within the unused arguments, attackers may change the format string to reveal this information.

Rationale

Allowing user input to control format parameters could enable an attacker to cause exceptions to be thrown or leak information.Attackers may be able to modify the format string argument, such that an exception is thrown. If this exception is left uncaught, it may crash the application. Alternatively, if sensitive information is used within the unused arguments, attackers may change the format string to reveal this information.

The following code illustrates a vulnerable pattern detected by this rule:

// The danger is in the FORMAT, not the arguments: a caller who can add conversions to it
// can read past the arguments that were supplied.
class ReceiptServlet extends HttpServlet {
  @throws[IOException]
  override def doGet(request: HttpServletRequest, response: HttpServletResponse): Unit = {
    val buffer = new StringBuffer()
    val formatter = new Formatter(buffer, Locale.US)
    val supplied = request.getParameter("suffix")
    // VULNERABLE: Use of Externally-Controlled Format String
    val format = "Customer: %s %s" + supplied

    // VULNERABLE: Use of Externally-Controlled Format String
    formatter.format(format, "Ana", "Ruiz", "Jr")

    // VULNERABLE: Use of Externally-Controlled Format String
    formatter.format(Locale.US, format, "Ana", "Ruiz")

    // A supplied ARGUMENT is ordinary data, so this one is not reported.
    formatter.format("Customer: %s %s", "Ana", request.getParameter("surname"))

    // VULNERABLE: Use of Externally-Controlled Format String
    System.out.printf(format, "Ana", "Ruiz")
    // VULNERABLE: Use of Externally-Controlled Format String
    System.out.printf(Locale.US, format, "Ana", "Ruiz")
    // VULNERABLE: Use of Externally-Controlled Format String
    System.out.format(format, "Ana", "Ruiz")
    // VULNERABLE: Use of Externally-Controlled Format String
    System.out.format(Locale.US, format, "Ana", "Ruiz")

    // VULNERABLE: Use of Externally-Controlled Format String
    val inlineFormat = "Customer: %s %s" + request.getParameter("suffix")
    // VULNERABLE: Use of Externally-Controlled Format String
    String.format(inlineFormat, "Ana", "Ruiz")
    // VULNERABLE: Use of Externally-Controlled Format String
    String.format(Locale.US, inlineFormat, "Ana", "Ruiz")
  }
}

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References

© 2026 Xygeni. All rights reserved