Composite Format String¶
What does this mean ?¶
.NET composite formatting interprets indexed placeholders such as {0}. Malformed braces or a placeholder without a corresponding argument can cause a FormatException. This is normally a formatting/reliability defect; it is not the same vulnerability class as C-style printf memory corruption.
What can happen ?¶
A response, report or diagnostic operation may fail. Some wrong strings remain valid and merely display unintended text, so exception testing alone is insufficient.
Recommendation¶
Use a fixed, reviewed format string and supply matching arguments. Prefer interpolation for simple expressions. Choose an explicit culture for machine-readable output and a deliberate user culture for display. String formatting does not perform HTML encoding or SQL parameterization.
Sample Code¶
// Incorrect: placeholder 1 has no second argument.
string broken = string.Format("{0}: {1}", "Count");
// Correct: both placeholders have values.
string display = string.Format("{0}: {1}", "Count", 42);
string interpolated = $"Count: {42}";
JavaScript uses a different syntax:
const value = 42;
const literal = 'Count: ${value}'; // Literal text, not interpolation.
const display = `Count: ${value}`; // Count: 42
Do not fix an ordinary C# string by applying JavaScript's ${...} rules.
Regression checks¶
Assert exact output, including literal braces and required culture behavior. Exercise every localized format with its argument list. Handle a formatting failure without exposing sensitive values in a client error.