Clarification: V1.3.10 "sanitized before being processed"

Verify that format strings which might resolve in an unexpected or malicious
way when used are sanitized before being processed

“sanitized before being processed”

The statement doesn’t emphasize stronger practices, such as using hardcoded format strings or validating against an allowlist of expected patterns. As “Sanitized” is not the right verb to use, as the vulnerability lies in structure not in special characters. The statement should be – “Ensure untrusted input is never used as a format string, only as a value for formatting.”

“Might Resolve in an Unexpected or Malicious Way”

This is ambiguous, as "unexpected" or "malicious" depends on the context (e.g, programming language, framework or function used), The requirement doesn’t specify the types of risks. Without clear definitions developers might apply insufficient checks.

The requirement should clarify the context and risks

Locate requirement V1.3.10 in the ASVS text and review the wording around “sanitized before being processed” and “might resolve in an unexpected or malicious way.” Compare it with the proposed wording, then update the requirement so the format-string guidance and relevant risks are explicit.