rules:
- id: info-leak-on-non-formated-string
  message: >-
    Use %s, %d, %c... to format your variables, otherwise this could leak information.
  metadata:
    cwe:
    - 'CWE-532: Insertion of Sensitive Information into Log File'
    references:
    - http://nebelwelt.net/files/13PPREW.pdf
    category: security
    technology:
    - c
    confidence: LOW
    owasp:
    - A09:2021 - Security Logging and Monitoring Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
  languages: [c]
  severity: WARNING
  pattern: printf(argv[$NUM]);