Page History

Interpretation of Java format strings is stricter than that in languages such as C. The implementations in the standard libraries throw appropriate exceptions The java.io package includes a PrintStream class that has two equivalent formatting methods: format() and printf(). System.out and System.err are PrintStream objects, allowing PrintStream methods to be invoked on the standard output and error streams. The risks from using these methods are not as high as from using similar functions in C or C++  [Seacord 2013]. The standard library implementations throw an exception when any conversion argument fails to match the corresponding flag. This approach reduces opportunities for malicious exploits. Nevertheless, malicious user input can exploit format strings and can cause information leaks or denial of serviceformat specifier. Although throwing an exception helps mitigate against exploits, if untrusted data is incorporated into a format string, it can result in an information leak or allow a denial-of-service attack. Consequently, unsanitized input from an untrusted source must never be incorporated into format strings.

Noncompliant Code Example

This noncompliant code example demonstrates an information leak issue. It accepts a credit card expiration date as an input argument and uses it within the format string. In the absence of proper input validation, an attacker can determine the date against which the input is being verified, perhaps by supplying an input that includes one of the format string arguments %1$tm, %1$te or %1$tYleaks information about a user's credit card. It incorporates untrusted data in a format string.

class Format {
  static Calendar c = new GregorianCalendar(1995, GregorianCalendar.MAY, 23);
  public static void main(String[] args) {  
    // args[0] isshould contain the credit card expiration date
    // args[0] canbut might contain either %1$tm, %1$te or %1$tY asformat malicious argumentsspecifiers
    // First argument prints 05 (May), second prints 23 (day) and third prints 1995 (year)System.out.format(
    // Perform comparison with c, if it doesn't match print the following line
    System.out.printf(args[0] + " did not match! HINT: It was issued on %1$terd of some month", c
    );
  }
}

In the absence of proper input validation, an attacker can determine the date against which the input is verified by supplying an input string that includes the %1$tm, %1$te, or %1$tY format specifiers. In this example, these format specifiers print 05 (May), 23 (day), and 1995 (year), respectively.

Compliant Solution

This compliant solution ensures that excludes untrusted user generated input is excluded from format strings.from the format string. Although arg[0] still may contain one or more format specifiers, they are now rendered inert. 

class Format {
  static Calendar c = 
    new GregorianCalendar(1995, GregorianCalendar.MAY, 23);
  public static void main(String[] args) {  
    // args[0] is the credit card expiration date
    // Perform comparison with c, 
    // if it doesn't match, print the following line
    System.out.printf("The inputformat(
      "%s did not match! HINT: It was issued on %1$terd%terd of some month", 
      args[0], c
    );
  }
}

Risk Assessment

Allowing user input to taint Incorporating untrusted data in a format string may cause result in information leaks or allow a denial-of-service attack.

Automated Detection

Static analysis tools that perform taint analysis can diagnose some violations of this guidelinerule.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Other Languages

Related Guidelines

...

...

...

...

Bibliography

[API 2006]	Class Formatter
[Seacord 2013]	Chapter 6, "Formatted Output"
[Seacord 2015]	Image Added IDS06-J. Exclude unsanitized user input from format strings LiveLesson

...

Image Added Image Added Image Added

Bibliography

\[[API 2006|AA. Bibliography#API 06]\] [Class Formatter|http://java.sun.com/javase/6/docs/api/java/util/Formatter.html]
\[[MITRE 2009|AA. Bibliography#MITRE 09]\] [CWE-134|http://cwe.mitre.org/data/definitions/134.html] "Uncontrolled Format String"
\[[Seacord 2005|AA. Bibliography#Seacord 05]\] Chapter 6, Formatted Output

FIO08-J. Do not log sensitive information      09. Input Output (FIO)      FIO10-J. Do not let Runtime.exec() fail or block indefinitely