Escape % symbol in a java string to apply String.format

java string string.format input-sanitization
orlybg picture orlybg · Sep 20, 2013 · Viewed 9.1k times · Source

In my project (Java/Play framework) I have an error handling routing that checks the response from a web service if the response is an error code, we display the corresponding error message saying what was the problem with the user input, the service checks user input validity.

When the user enter an % symbol, this logic breaks because the error display logic uses 

String.format(message, messageArgs);

Which interpolates the messageArgs intro the message String where it finds an %, and if the messageArgs contains an % as well I get an exception.

I need to sanitize, escape or otherwise remove the % from the user inputs, before displaying the message.

message: The requested email address %s is invalid messageArgs: orlybg%@gmail.com

Any advice on how to do this in Java in the simplest, shortest way?

here's a part of the error log

 java.util.UnknownFormatConversionException: Conversion = 'i'
   at java.util.Formatter$FormatSpecifier.conversion(Formatter.java:2646)
   at java.util.Formatter$FormatSpecifier.<init>(Formatter.java:2675)
   at java.util.Formatter.parse(Formatter.java:2528)
   at java.util.Formatter.format(Formatter.java:2469)
   at java.util.Formatter.format(Formatter.java:2423)
   at java.lang.String.format(String.java:2797)
   at controllers.api.PublicAPI.renderAPIError(PublicAPI.java:176)
   at controllers.api.DeviceAPI.setEmailAddress(DeviceAPI.java:736)
   at play.mvc.ActionInvoker.invokeWithContinuation(ActionInvoker.java:557)
   at play.mvc.ActionInvoker.invoke(ActionInvoker.java:508)
   at play.mvc.ActionInvoker.invokeControllerMethod(ActionInvoker.java:484)
   at play.mvc.ActionInvoker.invokeControllerMethod(ActionInvoker.java:479)
   at play.mvc.ActionInvoker.invoke(ActionInvoker.java:161)
   at Invocation.HTTP Request(Play!)

Thanks!

Answer

stan picture stan · Sep 20, 2013

In message String, the % sign is escaped with another %. So you will need to double it up: %%
For example: "Bla bla %i bla" -> "Bla bla %%i bla"
In messageArgs String, there is no problem with the % sign and you don't need to escape it

Related questions

Is it better practice to use String.format over string Concatenation in Java?

Is there a perceptible difference between using String.format and String concatenation in Java? I tend to use String.format but occasionally will slip and use a concatenation. I was wondering if one was better than the other. The way …

Read More
How can I left-align strings using String.format()?

I'm using String.format() in Java trying to emulate the printf() control channel available in C. I understand how to specify that a string should be placed in a field which takes 20 characters, 5, 2 ... with 3 decimals, 2, etc. However, the strings are …

Read More
Make String.format("%s", arg) display null-valued arguments differently from "null"

Consider the custom toString() implementation of a bean: @Override public String toString() { String.format("this is %s", this.someField); } This yields this is null if someField is null. Is there a way to override the default null string representation of …

Read More