4 ms·

This is the same principle for not passing user input to the first argument of `printf(3)` in C. Coming from C, I would never allow the user control of the form

• cyphar 10y ago
  The reasoning why printf strings in C are unsafe is not applicable in python though. You cannot access memory directly, and %n doesn't exist (nor other other fun POSIX requirements that write to random places on the stack). In fact, Python's C-style formatting strings are immune to this problem (even the extended form that allows you to name arguments).
  • jlarocco 10y ago
    That's pointless nitpicking. The point is that user specified format strings allow the user to access things they shouldn't be able to access. It's the same in every language that has format strings.
    • cyphar 10y ago
      > That's pointless nitpicking. The point is that user specified format strings allow the user to access things they shouldn't be able to access. It's the same in every language that has format strings. It's not nitpicking. Go's format strings don't allow you to access stuff you shouldn't be able to. In fact, Go's templating language[1] doesn't allow you to access anything that you haven't explicitly provided to the template instance. Allowing users to format text is not an impossible problem. It's the fault of language creators that they don't make this easier. [1]: https://golang.org/pkg/text/template/ https://golang.org/pkg/text/template/