On: Widespread exploitation of critical remote code ex...

[marwis]

Can someone clarify if this template expansion happens only in format string or in the substituted string as well. I.e. is it affecting just code like this:

  log.info("foo: " + untrusted)

Or also:

  log.info("foo: {}", untrusted)

?

[gpm → marwis]

Both