Format security for string_format function

[mewim]

In our string_format function (

kuzu/src/include/common/utils.h

Lines 52 to 61 in 59e231a

	static std::string string_format(const std::string& format, Args... args) {
	int size_s = snprintf(nullptr, 0, format.c_str(), args...) + 1; // Extra space for '\0'
	if (size_s <= 0) {
	throw Exception("Error during formatting.");
	}
	auto size = static_cast<size_t>(size_s);
	auto buf = std::make_unique<char[]>(size);
	snprintf(buf.get(), size, format.c_str(), args...);
	return {buf.get(), buf.get() + size - 1}; // We don't want the '\0' inside
	}

), snprintf is used where the format string is not a string literal. This is considered as a bad practice (https://fedoraproject.org/wiki/Format-Security-FAQ) and also breaks the build process (#1303) if a more restricted option Werror=format-security is used. If possible, we should find a way to change this.

[vbmithr]

Apparently (not a C++ expert) you can use a C++20 function for that:

https://en.cppreference.com/w/cpp/utility/format/format

[acquamarin]

Apparently (not a C++ expert) you can use a C++20 function for that:

https://en.cppreference.com/w/cpp/utility/format/format

Unfortunately, the c++ std::format function is not available in every compiler according to this page:
https://en.cppreference.com/w/cpp/compiler_support