I am not familiar with Python. I found lots of places talking about the format string issue in python. To understand its impact, I created a very simple test code:

# assume this CONFIG holds sensitive information
    "KEY": "abcdefg"
class PeopleInfo:
    def __init__(self, fname, lname):
        self.fname = fname
        self.lname = lname
# case 1: st obtained from user
jobId = input()
print("Job ID: {}".format(jobId))

Assume this is vulnerable code, if I provide an expression through the input, it supposes to trigger that expression. However, it just returns the expression I put in the input as String. For example if I input: {people_obj.__init__.__globals__[CONFIG][KEY]}, it will just returns Job ID: {people_obj.__init__.__globals__[CONFIG][KEY]}.

Does it mean the issue has been solved in newer Python version? Should developer still take care of it?

  • 2
    format string vulnerability is about using a format string (in your case Job ID: {}) which includes untrusted user input. Your example does not do this, i.e. your format string is a static string hard coded in the program. This is explained in more detail in Are there any Security Concerns to using Python F Strings with User Input Commented Apr 27, 2023 at 20:13
  • thanks a lot for quick answer! So, if the untrusted input is provided as an argument to a string formatting function, it is actually not vulnerable to format string attack. Is my understanding right? Commented Apr 27, 2023 at 20:31
  • By the very definition of a format string attack the attacker needs to control (part of) the format string. This is not true in your example, so it cannot be vulnerable to a format string attack. It can of course still be vulnerable to other attack types, although I don't see any in your short example. Commented Apr 28, 2023 at 4:15


You must log in to answer this question.

Browse other questions tagged .