Page History

Formatting in Java is stricter as compared to traditional languages such as C. Exceptions are thrown if any conversion argument mismatches with the corresponding flag. Although not easily exploitable, it is possible for user input to taint the format string and cause information leakage leaks or denial of service in some cases.

Noncompliant Code Example

This noncompliant code example demonstrates a careless an information leak issue. The code accepts the credit card expiration date as an input argument and uses it within the format string. In the absence of proper input validation, an artful attacker can observe the very date that has been asked to be inputteddate against which the input is verified. Any of the arguments %1$tm, %1$te or %1$tY can further aid such an attempt.

import java.util.Calendar;
import java.util.GregorianCalendar;
import static java.util.Calendar.*;

class Format {
  static Calendar c = new GregorianCalendar(1995, MAY, 23);
  public static void main(String[] args) {  
    //args[0] is the credit card expiration date
    //args[0] can contain either %1$tm, %1$te or %1$tY as malicious arguments
    //perform comparison with c, if it doesn't match print the following line
    System.out.printf(args[0] + " did not match! HINT: It was issued on %1$terd of some month", c);
  }
}

Compliant Solution

The perfect best remedy to for format string problems is to ensure that user generated input never shows up in format strings. This will safeguard safeguards the code from unforeseen exploitation.

import java.util.Calendar;
import java.util.GregorianCalendar;
import static java.util.Calendar.*;

class Format {
  static Calendar c = new GregorianCalendar(1995, MAY, 23);
  public static void main(String[] args) {  
    //args[0] is the credit card expiration date
    //perform comparison with c, if it doesn't match print the following line
    System.out.printf("The input did not match! HINT: It was issued on %1$terd of some month", c);
  }
}

...

Allowing user input to taint the format string may cause information leakage leaks or denial of service.

...