security - C#或Java中是否存在格式字符串漏洞？

Question

我发现了C++中的格式字符串漏洞，但是C++是一种古老的语言。我想知道格式字符串漏洞是否仍然存在于现代语言中，例如C#和Java。

Answer 1

Format String Vulnerability:-

Format string problems are a classic C/C++ issue that are now rare due to the ease of discovery. The reason format string vulnerabilities can be exploited is due to the %n operator. The %n operator will write the number of characters, which have been printed by the format string therefore far, to the memory pointed to by its argument.

但是，诸如C#和Java之类的语言会生成 managed code，它们不易受内存地址覆盖的影响，因为CLR/JVM管理进程内存，而不是开发人员的责任。这可能意味着 buffer overflow漏洞的可能性要小得多(但它的发生取决于所调用的第三方组件或语言本身的漏洞)。

因此，对于托管语言(例如C#和Java)，答案是否定的。