devs/profanity
2
0
Fork 0
mirror of https://git.jabber.space/devs/cproof.git synced 2026-07-21 10:56:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): prevent CWE-134 format string injection

Browse Source 
- add "%s" to unsafe cons_show/log_*/win_println calls
- add check-cwe134.sh static analysis script
- integrate security check into CI pipeline

Closes #85
This commit is contained in:
jabber.developer2
2026-02-05 17:22:04 +03:00
parent b772bd8c86
commit 34501d913c
13 changed files with 99 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/plugins/python_plugins.c
View File

@@ -887,8 +887,8 @@ _python_undefined_error(ProfPlugin* plugin, char* hook, char* type)
g_string_append(err_msg, hook);
g_string_append(err_msg, "(): return value undefined, expected ");
g_string_append(err_msg, type);
log_error(err_msg->str);
cons_show_error(err_msg->str);
log_error("%s", err_msg->str);
cons_show_error("%s", err_msg->str);
g_string_free(err_msg, TRUE);
}
@@ -901,8 +901,8 @@ _python_type_error(ProfPlugin* plugin, char* hook, char* type)
g_string_append(err_msg, hook);
g_string_append(err_msg, "(): incorrect return type, expected ");
g_string_append(err_msg, type);
log_error(err_msg->str);
cons_show_error(err_msg->str);
log_error("%s", err_msg->str);
cons_show_error("%s", err_msg->str);
g_string_free(err_msg, TRUE);
}