3 ms·

String interpolation is only being added for string literals, not for generic strings. This means that you still wouldn't be able to read a template from a fil

String interpolation is only being added for string literals, not for generic strings. This means that you still wouldn't be able to read a template from a file, then format text in. with open('template.txt') as f: template = f.read() formatted = template.format(**values)

mixmastamyk 11y ago
That's a good thing due to security reasons as arbitrary expressions are allowed. There are plenty of templating solutions available.
- MereInterest 11y ago
  I agree. I was pointing out that the f'{a} {b}' syntax can't accomplish everything. Since it isn't intended as a complete replacement, the way `.format` is intended as a complete replacement for `%`, it will just add another string formatting technique without ever deprecating the old way.
- Animats 11y ago
  Arbitrary string interpolation was proposed, in a way sure to result in security problems: "PEP 498 proposes new syntactic support for string interpolation that is transparent to the compiler, allow name references from the interpolation operation full access to containing namespaces (as with any other expression), rather than being limited to explicit name references. These are referred to in the PEP as "f-strings" (a mnemonic for "formatted strings")." "Full access to containing namespaces?" From strings? Bad, bad idea. This is currently marked as "deferred", but should be marked "rejected with extreme prejudice".
  - mixmastamyk 11y ago
    FUD: applies to literals only. There is nothing that could happen in the string that couldn't happen in your code already. No new security concerns.
    - Animats 11y ago
      Example given: myquery = sql(i"SELECT {column} FROM {table};") What could possibly go wrong?
      - icebraining 11y ago
        How is that any different from any other string formatting mechanism? myquery = sql("SELECT %s FROM %s" % (column, table))
        berdario 11y ago
        plenty of things can go wrong, since you have control of how many and which variables to interpolate, e.g: i"SELECT {settings.SECRET_KEY};" PS: (I don't know why but HN is not updating the page with the reply links needed, so I'll just edit this) Yes, I agree. I think that the misunderstanding happened when mixmastamyk wrote > That's a good thing due to security reasons as arbitrary expressions are allowed. There are plenty of templating solutions available The point is that even if you don't allow arbitrary expressions (which imho are a mistake, and of which I haven't seen a single use case yet), having this kind of interpolation from strings that are not literals (i.e. are not in the trusted source code) would still be a security issue Since the PEPs apparently don't propose to extend this to non-literals, we're safe. But it's better to be wary and attentively review such proposals... In fact, I just realized right now that Animats might have misunderstood PEP 501, since sql(i"SELECT {column} FROM {table};") should be perfectly safe from sqli vulns PPS: Unless Animats is pointing out how switching i'' for f'' is a terribly simple mistake to do and hard to spot during a code review... I agree with that
        icebraining 11y ago
        But again, if you can inject that into the source code, why can't you just do "SELECT {};".format(settings.SECRET_KEY) Remember that the interpolation only works for string literals, you can't inject that from external input.
      - deleted 11y ago
Walkman 11y ago
Nothing wrong with this, because it's explicit. You could't be mo terse in this case, could you?

mixmastamyk 11y ago

That's a good thing due to security reasons as arbitrary expressions are allowed. There are plenty of templating solutions available.

MereInterest 11y ago
I agree. I was pointing out that the f'{a} {b}' syntax can't accomplish everything. Since it isn't intended as a complete replacement, the way `.format` is intended as a complete replacement for `%`, it will just add another string formatting technique without ever deprecating the old way.
Animats 11y ago
Arbitrary string interpolation was proposed, in a way sure to result in security problems: "PEP 498 proposes new syntactic support for string interpolation that is transparent to the compiler, allow name references from the interpolation operation full access to containing namespaces (as with any other expression), rather than being limited to explicit name references. These are referred to in the PEP as "f-strings" (a mnemonic for "formatted strings")." "Full access to containing namespaces?" From strings? Bad, bad idea. This is currently marked as "deferred", but should be marked "rejected with extreme prejudice".
- mixmastamyk 11y ago
  FUD: applies to literals only. There is nothing that could happen in the string that couldn't happen in your code already. No new security concerns.
  - Animats 11y ago
    Example given: myquery = sql(i"SELECT {column} FROM {table};") What could possibly go wrong?
    - icebraining 11y ago
      How is that any different from any other string formatting mechanism? myquery = sql("SELECT %s FROM %s" % (column, table))
      - berdario 11y ago
        plenty of things can go wrong, since you have control of how many and which variables to interpolate, e.g: i"SELECT {settings.SECRET_KEY};" PS: (I don't know why but HN is not updating the page with the reply links needed, so I'll just edit this) Yes, I agree. I think that the misunderstanding happened when mixmastamyk wrote > That's a good thing due to security reasons as arbitrary expressions are allowed. There are plenty of templating solutions available The point is that even if you don't allow arbitrary expressions (which imho are a mistake, and of which I haven't seen a single use case yet), having this kind of interpolation from strings that are not literals (i.e. are not in the trusted source code) would still be a security issue Since the PEPs apparently don't propose to extend this to non-literals, we're safe. But it's better to be wary and attentively review such proposals... In fact, I just realized right now that Animats might have misunderstood PEP 501, since sql(i"SELECT {column} FROM {table};") should be perfectly safe from sqli vulns PPS: Unless Animats is pointing out how switching i'' for f'' is a terribly simple mistake to do and hard to spot during a code review... I agree with that
        icebraining 11y ago
        But again, if you can inject that into the source code, why can't you just do "SELECT {};".format(settings.SECRET_KEY) Remember that the interpolation only works for string literals, you can't inject that from external input.
    - deleted 11y ago

Walkman 11y ago

Nothing wrong with this, because it's explicit. You could't be mo terse in this case, could you?