# Unsanitized user input in format string ## Overview * **Rule ID**: `javascript_lang_format_string_using_user_input` * **Applicable Languages**: Javascript * **Weakness ID**: CWE-134 ## Description Including user input directly in a format string can lead to security vulnerabilities. This issue occurs when an attacker manipulates format specifiers within the user input, potentially causing misleading or fabricated messages. ## Remediation Guidelines * **Do not incorporate user input directly into format strings.** This approach can be exploited by attackers to manipulate output or execute malicious code. ```javascript console.log(`The value was ${req.params.value}`); // unsafe ``` * **Do** use a literal format string and pass user input as additional arguments. This method safely incorporates user input without exposing the application to format string vulnerabilities. ```java console.log('The value was %s', req.params.value); // safe ``` ## References * [**CWE-134: Use of Externally-Controlled Format String**](https://cwe.mitre.org/data/definitions/134.html) ## Configuration To omit this rule during a scan, and to provide you with continuous 24/7 code-level scanning, you can employ our [**SAST TOOL**](https://scopy.sec1.io/login) --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.sec1.io/user-docs/4-sast/3-javascript/unsanitized-user-input-in-format-string.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.