Language: C
Label: safe
CWE: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Code:
print_perm_line (int        idx,
                 GPtrArray *items,
                 int        cols)
{
  g_autoptr(GString) res = g_string_new (NULL);
  g_autofree char *escaped_first_perm = NULL;
  int i;

  escaped_first_perm = flatpak_escape_string (items->pdata[0], FLATPAK_ESCAPE_DEFAULT);
  g_string_append_printf (res, "    [%d] %s", idx, escaped_first_perm);

  for (i = 1; i < items->len; i++)
    {
      g_autofree char *escaped = flatpak_escape_string (items->pdata[i],
                                                        FLATPAK_ESCAPE_DEFAULT);
      char *p;
      int len;

      p = strrchr (res->str, '\n');
      if (!p)
        p = res->str;

      len = (res->str + strlen (res->str)) - p;
      if (len + strlen (escaped) + 2 >= cols)
        g_string_append_printf (res, ",\n        %s", escaped);
      else
        g_string_append_printf (res, ", %s", escaped);
    }

  g_print ("%s\n", res->str);
}