I love compilers.
Here I am busily working away; I throw in a cheeky
NSLog() to see where I've got to:
Hang on! A compiler warning:
Format string is not a string literal (potentially insecure)
What's this about?
A bit of Google (via this forum post)
led me to a Wikipedia article on the Format string attack. It turns out that an attacker might use
printf style format specifiers to do all sorts of nasty to my heap/stack.
The correct usage is this:
NSLog(@"%@", [myObject stringRepresentation]);
No more warning. We can sleep at night.