IDS20-J. Exclude user input from format strings

Interpretation of Java format strings is stricter than that in languages such as C. The implementations in the standard libraries throw appropriate exceptions when any conversion argument fails to match the corresponding flag. This approach reduces opportunities for malicious exploits. Nevertheless, malicious user input can exploit format strings and can cause information leaks or denial of service. Therefore strings from an untrusted source shall not be incorporated into format strings.

Noncompliant Code Example

This noncompliant code example demonstrates an information leak issue. It accepts a credit card expiration date as an input argument and uses it within the format string.

class Format {
  static Calendar c = new GregorianCalendar(1995, GregorianCalendar.MAY, 23);
  public static void main(String[] args) {  
    // args[0] is the credit card expiration date
    // args[0] can contain either %1$tm, %1$te or %1$tY as malicious arguments
    // First argument prints 05 (May), second prints 23 (day) and third prints 1995 (year)
    // Perform comparison with c, if it doesn't match print the following line
    System.out.printf(args[0] + " did not match! HINT: It was issued on %1$terd of some month", c);
  }
}

In the absence of proper input validation, an attacker can determine the date against which the input is being verified, perhaps by supplying an input that includes one of the format string arguments %1$tm, %1$te, or %1$tY.

Compliant Solution

This compliant solution ensures that user generated input is excluded from format strings.

class Format {
  static Calendar c = new GregorianCalendar(1995, MAY, 23);
  public static void main(String[] args) {  
    // args[0] is the credit card expiration date
    // Perform comparison with c, if it doesn't match print the following line
    System.out.printf("The input did not match! HINT: It was issued on %1$terd of some month", c);
  }
}

Risk Assessment

Allowing user input to taint a format string may cause information leaks or denial of service.

Automated Detection

Static analysis tools that perform taint analysis can diagnose some violations of this rule.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

This rule appears in the C Secure Coding Standard as FIO30-C. Exclude user input from format strings.

This rule appears in the C++ Secure Coding Standard as FIO30-CPP. Exclude user input from format strings.

Bibliography

[[API 2006]] Class Formatter
[[MITRE 2009]] CWE-134 "Uncontrolled Format String"
[[Seacord 2005]] Chapter 6, Formatted Output

IDS19-J. Sanitize untrusted data passed to a regex            IDS21-J. Canonicalize path names before validating them