devs/cproof
1
2
Fork 1
Code Issues 43 Pull Requests 9 Actions Packages Projects 1 Releases Wiki Activity

fix(security): prevent CWE-134 format string injection
All checks were successful
CI Code / Check spelling (pull_request) Successful in 20s
Details
CI Code / Check coding style (pull_request) Successful in 35s
Details
CI Code / Code Coverage (pull_request) Successful in 4m45s
Details
CI Code / Linux (debian) (pull_request) Successful in 6m7s
Details
CI Code / Linux (ubuntu) (pull_request) Successful in 6m13s
Details
CI Code / Linux (arch) (pull_request) Successful in 6m20s
Details

Browse Source 
- add "%s" to unsafe cons_show/log_*/win_println calls
- add check-cwe134.sh static analysis script
- integrate security check into CI pipeline

Closes #85
This commit is contained in:
jabber.developer2
2026-02-05 17:22:04 +03:00
parent b772bd8c86
commit 34501d913c
13 changed files with 99 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/command/cmd_funcs.c
View File

@@ -4970,8 +4970,8 @@ cmd_sendfile(ProfWin* window, const char* const command, gchar** args)
alt_scheme = OMEMO_AESGCM_URL_SCHEME;
alt_fragment = _add_omemo_stream(&fd, &fh, &err);
if (err != NULL) {
cons_show_error(err);
win_println(window, THEME_ERROR, "-", err);
cons_show_error("%s", err);
win_println(window, THEME_ERROR, "-", "%s", err);
goto out;
}
#endif