For example, for different locales it may be necessary to report data results in a different order, or to separate the values in different ways. A clever approach to resolving this was to support changing the formatting string itself based on the locale - that way, different ordering and separating could be handled easily. However, many of those interested in security began to perceive this as a bit too clever. And it did not take long for people to find it. This information is used to compute the directory used to retrieve the format strings used for a given user.
Some libraries even let attackers pick a file without bothering with any tricks at all.
In all cases, if an attacker could get a program to accept an arbitrary file for the format, he could then exploit all of the format string problems we just discussed. One simple solution is to permit only legal locale values. I'd rather filter them all to only permit legal values instead of wasting my time trying to figure out if there's an exploit. Next, I tried to devise a filter that would allow only legal locale values. In this case, the filter prevents them all, which is encouraging.