From 25186f8ebf9cbfd4ec8f32a2a6cca79c7105912f Mon Sep 17 00:00:00 2001 From: Steven Fisher Date: Mon, 23 Jul 2012 11:11:29 -0700 Subject: [PATCH] Very minor security fix. `informativeTextWithFormat` interprets its string as a format. `[error localizedDescription]` could contain string formatting specifiers. Fixes to use @"%@", [error localizedDescription] instead. Spotted via compiler warning. --- Example/Classes/Models/Tweet.m | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Example/Classes/Models/Tweet.m b/Example/Classes/Models/Tweet.m index 14fe2d0..f9e42f8 100644 --- a/Example/Classes/Models/Tweet.m +++ b/Example/Classes/Models/Tweet.m @@ -67,7 +67,7 @@ #if __IPHONE_OS_VERSION_MIN_REQUIRED [[[UIAlertView alloc] initWithTitle:NSLocalizedString(@"Error", nil) message:[error localizedDescription] delegate:nil cancelButtonTitle:nil otherButtonTitles:NSLocalizedString(@"OK", nil), nil] show]; #else - [[NSAlert alertWithMessageText:NSLocalizedString(@"Error", nil) defaultButton:NSLocalizedString(@"OK", nil) alternateButton:nil otherButton:nil informativeTextWithFormat:[error localizedDescription]] runModal]; + [[NSAlert alertWithMessageText:NSLocalizedString(@"Error", nil) defaultButton:NSLocalizedString(@"OK", nil) alternateButton:nil otherButton:nil informativeTextWithFormat:@"%@",[error localizedDescription]] runModal]; #endif if (block) { block(nil);