The java.io package includes a PrintStream class that has two equivalent formatting methods format() and printf(). System.out is a PrintStream object, allowing PrintStream methods to be invoked on System.outthe standard output stream. The risks from using these methods are not as high as from using similar functions in C or C++ [Seacord 2013]. The standard library implementations throws throw an exception when any conversion argument fails to match the corresponding format specifier. Although this helps mitigate against exploits, if malicious user input is accepted in a format string, it can cause information leaks leakage or denial of service. As a resultConsequently, unsanitized input from an untrusted source must never be incorporated into format strings.
...