SEC007
Unvalidated format string
Object Pascal — Delphi & Free Pascal
Warning
Security
Passing user-controlled variables as format strings to Format() can cause crashes or information disclosure
passing user-controlled variables as format strings to Format() can cause crashes or information disclosure.
Why this severity
passing user-controlled variables as format strings to Format() can cause crashes or information disclosure.
Known false positives
format strings loaded from trusted resource files or constants.
Remediation example
S := Format('Hello %s, count is %d', [Name, Count]);
// instead of: S := Format(UserInput, [Name, Count]);