NSString stringWithFormat format warning

Question

I am probably using a wrong symbol for the NSString type to be included in another string.

const char* error; //it's set, not nil
NSLog([NSString stringWithFormat : @"Problem with SQL statement in \n %@ \n %@",sqlQuery,[NSString stringWithUTF8String:error]]);

The expression works, but I am getting this warning:

Formatting string is not a string literal(potentially insecure)

Is there a way to get rid of the warnings?

Just for starters the posted code is missing a trailing "]". As always breakup compound statements, especially when debugging. NSLog() after each step or use the debugger to inspect after each step.; — zaph
– zaph, Commented Jun 6, 2014 at 20:04
Get rid of both uses of stringWithFormat: and use %s instead of %@ for error. — rmaddy
– rmaddy, Commented Jun 6, 2014 at 20:19

Midhun MP · Accepted Answer · 2014-06-06 20:27:02Z

2

According to NSLog implementation, the function expects a constant string or a format specifier string as it's first argument.

You need to use:

NSLog(@"Problem with SQL statement in [BSurfSpotDBOperations allSpots] \n %@ \n %@",sqlQuery,[NSString stringWithUTF8String:error]);

edited Jun 6, 2014 at 20:27

answered Jun 6, 2014 at 20:10

Midhun MP

108k31 gold badges157 silver badges207 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

zaph · Accepted Answer · 2014-06-06 20:17:59Z

2

Format strings in NSLog() statements must be constant strings or there will be a warning. Re-write the code to make the format portion a string literal.

In general avoid complex compound statements. Temporary variables make the code more readable and potentially less buggy. The compiler is quite good at elimination temporaries at release compile-time.

Example:

const char* error; //it's set, not nil
NSString *errorString = [NSString stringWithUTF8String:error];
NSLog(@"Problem with SQL statement in [BSurfSpotDBOperations allSpots] \n %@ \n %@", sqlQuery, errorString);

edited Jun 6, 2014 at 20:17

answered Jun 6, 2014 at 20:10

zaph

113k21 gold badges196 silver badges234 bronze badges

2 Comments

rmaddy Over a year ago

Even better - get rid of errorString and use %s to directly log error. No need for the NSString.

zaph Over a year ago

From a debugging POV the extra statements might expose the error, perhaps it is not really set, not null terminated, etc. Note that the error statement was not included in the original question. Generally when debugging there is an incorrect assumption, verifying each step helps expose the incorrect assumption.

Kevin DiTraglia · Accepted Answer · 2014-06-06 20:10:57Z

1

stringWithFormat is unnecessary here since NSLog() gives you similar options. You could simply change it to this:

NSLog(@"Problem with ... \n %@ \n %@", sqlQuery,[NSString stringWithUTF8String:error]);

This will eliminate the warning since the NSLog knows it isn't going to run into a string literal it doesn't know what to do with, which is a security concern.

answered Jun 6, 2014 at 20:10

Kevin DiTraglia

26.2k20 gold badges95 silver badges145 bronze badges

Comments

Kevin Machado · Accepted Answer · 2014-06-06 20:12:06Z

0

Try this method :

NSLog([@"Problem with SQL statement in [BSurfSpotDBOperations allSpots] \n %@ \n %@"
,sqlQuery,[NSString stringWithUTF8String:error]);

I think you can also translate [NSString stringWithUTF8String:error] by error

Think this can help you ;)

answered Jun 6, 2014 at 20:12

Kevin Machado

4,1973 gold badges32 silver badges55 bronze badges

Collectives™ on Stack Overflow

NSString stringWithFormat format warning

4 Answers 4

Comments

2 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related