mesa: prevent common string formatting security issues