3 ms·

Python doesn't have type safety to begin so those sort of checks have less utility to me and since json.loads returns a dictionary and python objects are effect

Python doesn't have type safety to begin so those sort of checks have less utility to me and since json.loads returns a dictionary and python objects are effectively dictionaries you are pretty much done.

dragonwriter 7y ago
> Python doesn't have type safety It does, if you want it to, with several typecheckers available.
- fuzz4lyfe 7y ago
  Type annotations were recently introduced as a standard library feature as well though they aren't enforced and require a third party tool like you are describing. I've found that 90% of the time you don't actually care what type something actually is and instead you care what it needs to be.
fastball 7y ago
You don't validate incoming request types / values?
- fuzz4lyfe 7y ago
  I validate at the point of use/when it matters. For example if I'm going to use a value in a query, because I'm using parameterized queries the type conversion to string happens implicitly so type doesn't actually matter. If I get 2 or '2' it all ends up as '2' and the database infers type by the column type. If I need something to be a integer and I don't trust the upstream system then you have to: int(*number*) At the end of the day if my JSON is going back to JavaScript I can't trust types either so I have to take the same precautions.
  - fastball 7y ago
    I gotcha. I work on a lot of user-facing stuff, so if the type is somehow wrong, I generally prefer to let the user know, which is a lot easier with models.
    - fuzz4lyfe 7y ago
      That is sensible and is generally the approach I take in user facing code. When I have my way I have validators on all input fields in the UI to warn users of invalid input. I like them to be very specific, checking to see if a phone number is formatted in such a way that it is usable by Twillo for example. On the other hand services that aren't actively utilizing data I write to be fairly agnostic about that data. "be conservative in what you do, be liberal in what you accept from others." is sort of how I aim.
ivalm 7y ago
Python doesn't force type safety but there benefits of being type safe to ensure things stay valid/bugs are caught/defense in depth for malicious requests.

dragonwriter 7y ago

> Python doesn't have type safety It does, if you want it to, with several typecheckers available.

fuzz4lyfe 7y ago
Type annotations were recently introduced as a standard library feature as well though they aren't enforced and require a third party tool like you are describing. I've found that 90% of the time you don't actually care what type something actually is and instead you care what it needs to be.

fastball 7y ago

You don't validate incoming request types / values?

fuzz4lyfe 7y ago
I validate at the point of use/when it matters. For example if I'm going to use a value in a query, because I'm using parameterized queries the type conversion to string happens implicitly so type doesn't actually matter. If I get 2 or '2' it all ends up as '2' and the database infers type by the column type. If I need something to be a integer and I don't trust the upstream system then you have to: int(*number*) At the end of the day if my JSON is going back to JavaScript I can't trust types either so I have to take the same precautions.
- fastball 7y ago
  I gotcha. I work on a lot of user-facing stuff, so if the type is somehow wrong, I generally prefer to let the user know, which is a lot easier with models.
  - fuzz4lyfe 7y ago
    That is sensible and is generally the approach I take in user facing code. When I have my way I have validators on all input fields in the UI to warn users of invalid input. I like them to be very specific, checking to see if a phone number is formatted in such a way that it is usable by Twillo for example. On the other hand services that aren't actively utilizing data I write to be fairly agnostic about that data. "be conservative in what you do, be liberal in what you accept from others." is sort of how I aim.

ivalm 7y ago

Python doesn't force type safety but there benefits of being type safe to ensure things stay valid/bugs are caught/defense in depth for malicious requests.