[Autofix][critical] Alert #1: Non-constant format string

[xengine-qyt]

🤖 Copilot Autofix 自动修复报告

---

📋 基本信息

字段	内容
Alert ID	#1
安全级别	critical
规则名称	Non-constant format string
问题文件	XEngine_Source/XEngine_ServiceApp/XEngine_HttpApp/XEngine_TaskGet/TaskGet_Bank.cpp 第 21 行
CWE 分类	external/cwe/cwe-134
规则标签	correctness, external/cwe/cwe-134, maintainability, security

---

🔍 问题说明

Non-constant format string

The printf function, related functions like sprintf and fprintf, and other functions built atop vprintf all accept a format string as one of their arguments. When such format strings are literal constants, it is easy for the programmer (and static analysis tools) to verify that the format specifiers (such as %s and %02x) in the format string are compatible with the trailing arguments of the function call. When such format strings are not literal constants, it is more difficult to maintain the program: programmers (and static analysis tools) must perform non-local data-flow analysis to deduce what values the format string argument might take.

Recommendation

If the argument passed as a format string is meant to be a plain string rather than a for

---

🤖 AI 修复思路

General fix: never pass externally sourced strings as the format argument to printf-family functions. Use a constant format string and treat external strings as plain data.

Best fix here without changing functionality: in XEngine_Source/XEngine_ServiceApp/XEngine_HttpApp/XEngine_TaskGet/TaskGet_Bank.cpp, replace the _xstprintf call that uses st_ServiceConfig.st_XApi.tszBankUrl as format string with a bounded copy of the URL template followed by safe substitution of %s token. A practical minimal change in this snippet is:

1. Copy st_ServiceConfig.st_XApi.tszBankUrl into tszUrlBuffer.
2. Find the first %s in tszUrlBuffer.
3. Replace that token with lpszBankNumber using bounded operations.
   This preserves current template behavior (single placeholder) while removing the non-constant format-string sink.

No new dependencies are required.

---

✅ Review 检查清单

• 理解了漏洞的成因和影响范围
• 确认 AI 修复逻辑正确，没有遗漏边界情况
• 确认修复没有改变原有业务逻辑
• 确认没有引入新的安全问题
• CI / 单元测试全部通过
• 如有必要，已补充对应的测试用例

---

此 PR 由 GitHub Copilot Autofix 自动生成，请仔细审核后再 merge。