Why is my string potentially unsecure in my iOS application?

Question

I am initializing a mutable string and then logging it as follows.

NSMutableString* mStr = [[NSMutableString alloc] init];
mStr = (NSMutableString*) someText         


        

Answer 1

If mStr was set to something like %@, NSLog would try to load an object argument, fail, and probably crash badly. There are other format strings which can also cause havoc.

If you need to just log a string without any marker text, use:

NSLog(@"%@", mStr);