# V3232\. Use of externally\-controlled format string\. Potentially tainted data is used as a format string\.

The analyzer has detected the use of an externally\-controlled format string without prior validation\. If the number of placeholders in the format string does not match the number of arguments, this results in either an exception being thrown or information being lost\.

The example:

```cpp
static void Foo(string hostName, int port, params string[] args)
{
  using (TcpClient tcpConn = new TcpClient(hostName, port))
  {
    using (StreamReader sr = new StreamReader(tcpConn.GetStream()))
    {
      var format = sr.ReadLine();
      var data = ApplyFormat(format, args);
      ....
    }
  }
}

static string ApplyFormat(string format, string[] args)
{
  return string.Format(...., format, args);
}
```

In the example, the `format` value is externally retrieved and passed to `ApplyFormat`, where it is directly used as the format in the `string.Format` method\. Since no validation is performed on the number of the placeholders \(`{....}`\) in the string, there is a risk of mismatch with the arguments in `args`\. If the number of placeholders is less, some arguments will be ignored\. If it is greater, an exception will be thrown\.

To avoid potential problems, validate the format string before use, for example, with a regular expression:

```cpp
static bool TryApplyFormat(string format, string[] args, out string data)
{
  if (Regex.Matches(format, ....).Count == args.Length)
  {
    data = string.Format(format, args);
    return true;
  }

  data = null;
  return false;
}
```