[Autofix][critical] Alert #3: Non-constant format string

[xengine-qyt]

🤖 Copilot Autofix 自动修复报告

---

📋 基本信息

字段	内容
Alert ID	#3
安全级别	critical
规则名称	Non-constant format string
问题文件	XEngine_Source/XEngine_ServiceApp/XEngine_HttpApp/XEngine_TaskGet/TaskGet_Weather.cpp 第 15 行
CWE 分类	external/cwe/cwe-134
规则标签	correctness, external/cwe/cwe-134, maintainability, security

---

🔍 问题说明

Non-constant format string

The printf function, related functions like sprintf and fprintf, and other functions built atop vprintf all accept a format string as one of their arguments. When such format strings are literal constants, it is easy for the programmer (and static analysis tools) to verify that the format specifiers (such as %s and %02x) in the format string are compatible with the trailing arguments of the function call. When such format strings are not literal constants, it is more difficult to maintain the program: programmers (and static analysis tools) must perform non-local data-flow analysis to deduce what values the format string argument might take.

Recommendation

If the argument passed as a format string is meant to be a plain string rather than a for

---

🤖 AI 修复思路

General fix: avoid passing externally controlled strings as printf-style format templates. Use a constant format string and treat external data as plain data.

Best fix here (without changing broader functionality): stop using _xstprintf(tszUrlBuffer, st_ServiceConfig.st_XApi.tszWeatherUrl, lpszAddrCode); and instead copy the configured URL into tszUrlBuffer, then append the address code safely as plain text. This preserves behavior of “base URL from config + query/id value” while removing format-string interpretation entirely.

Edit only:

• XEngine_Source/XEngine_ServiceApp/XEngine_HttpApp/XEngine_TaskGet/TaskGet_Weather.cpp at line 15 region.

No new imports or dependencies are required.

---

✅ Review 检查清单

• 理解了漏洞的成因和影响范围
• 确认 AI 修复逻辑正确，没有遗漏边界情况
• 确认修复没有改变原有业务逻辑
• 确认没有引入新的安全问题
• CI / 单元测试全部通过
• 如有必要，已补充对应的测试用例

---

此 PR 由 GitHub Copilot Autofix 自动生成，请仔细审核后再 merge。