Page Information

Title:	IDS06-J. Exclude unsanitized user input from format strings
Author:	Dhruv Mohindra	Jul 29, 2008
Last Changed by:	Hiromi Kinoshita	Sep 02, 2025
Tiny Link: (useful for email)	https://wiki.sei.cmu.edu/confluence/x/nDdGBQ
Export As:	Word · PDF

SEI CERT Perl Coding Standard (1)     Page: IDS30-PL. Exclude user input from format strings

SEI CERT Oracle Coding Standard for Java (1)     Page: IDS07-J. Sanitize untrusted data passed to the Runtime.exec() method

Parent Page     Page: Rule 00. Input Validation and Data Sanitization (IDS)

• malicious
• draft
• ids
• android-applicable
• android
• dos
• rule
• cwe-134
• analyzable

Time	Editor
Sep 02, 2025 02:28	Hiromi Kinoshita	View Changes
Reverted from v. 123
Sep 02, 2025 02:23	Hiromi Kinoshita	View Changes
fixed h2 tag of Risk Assessment
Aug 06, 2025 10:08	Jill Britton	View Changes
REM cost reform
Jun 11, 2024 08:22	Jill Britton	View Changes
May 18, 2021 08:01	Michal Rozenau
Parasoft Jtest 2021.1

External Links (10)
    cwe.mitre.org/data/definitions/134.html
    https://www.securecoding.cert.org/confluence/display/perl/C…
    java.sun.com/javase/6/docs/api/java/util/Formatter.html
    https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?p…
    https://www.safaribooksonline.com/library/view/secure-codin…
    https://www.securecoding.cert.org/confluence/display/perl/I…
    cwe.mitre.org/
    java.io
    https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?p…
    https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?p…

SEI CERT C Coding Standard (2)     Home page: SEI CERT C Coding Standard     Page: FIO30-C. Exclude user input from format strings

SEI CERT Oracle Coding Standard for Java (9)     Page: Klocwork_V     Home page: SEI CERT Oracle Coding Standard for Java     Page: The Checker Framework     Page: Rule AA. References     Page: The Checker Framework_V     Page: Parasoft     Page: Klocwork     Page: Rule BB. Glossary     Page: Parasoft_V