...
This rule appears in the Java Secure Coding Standard as FIO35-J. Exclude user input from format strings.
...
Bibliography
| Wiki Markup |
|---|
\[[ISO/IEC 9899:1999|AA. Bibliography#ISO/IEC 9899-1999]\] Section 7.19.6, "Formatted input/output functions"
\[[ISO/IEC PDTR 24772|AA. Bibliography#ISO/IEC PDTR 24772]\] "RST Injection"
\[[MITRE 07|AA. Bibliography#MITRE 07]\] [CWE ID 134|http://cwe.mitre.org/data/definitions/134.html], "Uncontrolled Format String"
\[[Open Group 04|AA. Bibliography#Open Group 04]\] [{{syslog()}}|http://www.opengroup.org/onlinepubs/009695399/toc.htm]
\[[Seacord 05|AA. Bibliography#Seacord 05]\] Chapter 6, "Formatted Output"
\[[Viega 05|AA. Bibliography#Viega 05]\] Section 5.2.23, "Format string problem" |
...