5 ms·
I do love writing python, but it's pretty shocking when I find out you can write something like `event.__init__.__globals__[CONFIG][SECRET_KEY]`. That language
by dlbucci 10y ago
I do love writing python, but it's pretty shocking when I find out you can write something like `event.__init__.__globals__[CONFIG][SECRET_KEY]`. That language just does not care about privacy or information hiding at all, I guess.
- deleted 10y ago[deleted]
- hakanderyal 10y agoPython's general mentality can be summed as "We are all consenting adults here". If you want to access some part of program or data, you generally can, but the burden of not breaking anything while messing with internals is on you. This is a great power, but also can become an unlimited source of bugs.
- deleted 10y ago[deleted]
- brianwawok 10y agoYou can do the same thing in Java with reflection. Don't let users run untrusted code. Full stop. If you need templating use a sandbox like jinja2.
- Godel_unicode 10y agoThe discovered vulnerability manifested itself in jinja2. Edit: release notes https://www.palletsprojects.com/blog/jinja-281-released/ https://www.palletsprojects.com/blog/jinja-281-released/
- brianwawok 10y agoExactly it's already fixed. It's in the article.
- jsjohnst 10y agoI'd love to hear your perspectives on Ruby if this bothers you that much.
- anamoulous 10y agoWhat does Ruby have to do with any of this?
- goatlover 10y agoLike PHP and JS's template literals, it has full on string interpolation.
- anamoulous 10y agoArguably Ruby is worse because you can execute instance methods in interpolation, but I still don't see why that's germane to this discussion other than to pick a fight about languages.
- smitherfield 10y agoRuby string interpolation can only happen in literal source code, not in user input. 2.4.0 :001 > a = 5 => 5 2.4.0 :002 > gets.chomp #{a} => "\#{a}"
- Manishearth 10y agoThese are only in literals, however. You cannot have a string value with interpolation exprs inside it (both in JS and Ruby)
- jsjohnst 10y agoGuys, this has nothing to do with interpolation. I like both Python and Ruby's string interpolation. I'm replying to the incredulous parent of my post who's griping about magic methods (which admittedly Ruby likely takes the crown).
- jsjohnst 10y ago
- dom0 10y agoFormat strings aren't a template language (Python even has Template Strings for that purpose), and being able to do this is quite useful in eg. debug logs it's a shorter and easier to write "{foo.x} ({foo.__class__.__name__})".format(foo=something). Conversely they don't prohibit expensive properties either (eg. ORM-based lookups), or generating misleading output or whatever.