Metadata

ID: bash-security/printf-format-variable

Language: Bash

Severity: Error

Category: Security

CWE: 134

Description

Using a variable as the printf format string can allow format-string injection. If the value is user-controlled, format specifiers like %s, %q, or %n can change output behavior and leak or corrupt data unexpectedly.

Always pass a fixed format literal and keep untrusted data in arguments, for example: printf '%s' "$var".

Non-Compliant Code Examples

#!/bin/bash
printf "$var"
printf "${fmt}" "$value"
printf -v out "$fmt" "$value"
printf "prefix ${fmt}" "$value"

Compliant Code Examples

#!/bin/bash
printf '%s' "$var"
printf "%s\n" "$user_input"
printf 'hello %s' "$name"
printf -- '%s' "$value"
printf -v out '%s' "$user_input"

Seamless integrations. Try Datadog Code Security

Datadog Code Security