printf format-string vulnerability in features/utils.bash and tools/uv/utils.bash

[ooloth]

Why

Using a variable as the printf format string means any %s, %n, %d, or other specifier in the variable's value is interpreted as a format directive rather than literal text, producing garbled output or — in the case of %n on some platforms — a write to an arbitrary memory address.

Current state

Three printf calls use variables directly as the format string:

• features/utils.bash line 13: printf "${version_raw}" — if a tool's version string contains %s or similar (unlikely but not impossible), the output is corrupted.
• tools/uv/utils.bash line 22: printf "${raw_version}" — same issue applied to the raw output of uv --version.
• tools/uv/utils.bash line 24: printf "${second_word}" — same issue applied to the second word of uv --version output.

All three variables hold tool version strings sourced from external command output; their content is not controlled by this codebase.

Ideal state

• features/utils.bash line 13 reads: printf '%s' "${version_raw}"
• tools/uv/utils.bash line 22 reads: printf '%s' "${raw_version}"
• tools/uv/utils.bash line 24 reads: printf '%s' "${second_word}"
• No printf call in either file uses a variable as its format string.
• shellcheck (SC2059) passes cleanly on both files after the fix.

Out of scope

• Auditing other files in the repo for the same pattern (though a grep -r "printf \"\${" . pass is recommended as a follow-up).

Starting points

• features/utils.bash — line 13
• tools/uv/utils.bash — lines 22 and 24
• shellcheck rule SC2059: https://www.shellcheck.net/wiki/SC2059

QA plan

1. Set version_raw to the string %s %s %s and run the affected printf call; confirm the output is the literal string %s %s %s rather than blank fields.
2. Run shellcheck features/utils.bash and confirm SC2059 is not reported.
3. Run shellcheck tools/uv/utils.bash and confirm SC2059 is not reported.

Done when

All three printf calls use '%s' as a literal format string and no variable appears in the format-string position in either file.