Rules / C/C++
SHIELD-CPP-006
Non-constant format string
What it detects
printf-family called with a variable format string enables format string attacks.
How to fix
Always pass a constant format string such as printf("%s", var).
Vulnerable — Shield flags thislog.c
#include <stdio.h>
void log_message(const char *msg) {
printf(msg);
}
Fixed — scans cleanlog.c
#include <stdio.h>
void log_message(const char *msg) {
printf("%s", msg);
}
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CPP-006, the fixed one does not.