3 ms·

That's pointless nitpicking. The point is that user specified format strings allow the user to access things they shouldn't be able to access. It's the same i

• cyphar 10y ago
  > That's pointless nitpicking. The point is that user specified format strings allow the user to access things they shouldn't be able to access. It's the same in every language that has format strings. It's not nitpicking. Go's format strings don't allow you to access stuff you shouldn't be able to. In fact, Go's templating language[1] doesn't allow you to access anything that you haven't explicitly provided to the template instance. Allowing users to format text is not an impossible problem. It's the fault of language creators that they don't make this easier. [1]: https://golang.org/pkg/text/template/ https://golang.org/pkg/text/template/