cybersecurity · intermediate · ~15 min
Spot the dangerous-format-string pattern.
Flag a string that contains a printf conversion specifier — the smell of passing user input straight into a format argument.
Implement int has_format_specifier(const char *s) that returns 1 if s contains a % followed by a non-% character, else 0.
A %% is an escaped percent (not a specifier); any other character after % counts as a conversion.
s: a NUL-terminated string the grader passes.Returns int: 1 if a conversion specifier is present, else 0.
has_format_specifier("hello %s") -> 1
has_format_specifier("100%% done") -> 0 (escaped percent)
has_format_specifier("safe text") -> 0
%% is an escape and does not count.% returns 0.printf("%s", user), never printf(user).A NUL-terminated string s.
An int: 1 if s has a real %-specifier, else 0.
%% is an escape and does not count.
int has_format_specifier(const char *s) {
/* TODO */
return 0;
}
Solve this exercise in the browser editor — compile and run against the test harness, no setup required.