cybersecurity · intermediate · ~15 min

Detect format specifiers in input

Spot the dangerous-format-string pattern.

Challenge

Flag a string that contains a printf conversion specifier — the smell of passing user input straight into a format argument.

Task

Implement int has_format_specifier(const char *s) that returns 1 if s contains a % followed by a non-% character, else 0.

A %% is an escaped percent (not a specifier); any other character after % counts as a conversion.

Input

  • s: a NUL-terminated string the grader passes.

Output

Returns int: 1 if a conversion specifier is present, else 0.

Example

has_format_specifier("hello %s")   ->   1
has_format_specifier("100%% done") ->   0   (escaped percent)
has_format_specifier("safe text")  ->   0

Edge cases

  • %% is an escape and does not count.
  • A string with no % returns 0.

Rules

  • Detection only — the fix is to always call printf("%s", user), never printf(user).

Input format

A NUL-terminated string s.

Output format

An int: 1 if s has a real %-specifier, else 0.

Constraints

%% is an escape and does not count.

Starter code

int has_format_specifier(const char *s) {
    /* TODO */
    return 0;
}

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.