3 ms·

I think the point is that they may well be used like that. Maybe not explicitly, but I bet you that any language has a user that uses string formatting to build

by gspr 5y ago

I think the point is that they may well be used like that. Maybe not explicitly, but I bet you that any language has a user that uses string formatting to build, say, an SQL query that is then passed as a string to the SQL engine.

adwn 5y ago
You don't need format strings to create vulnerable queries. If you can't use them, this code: let query = format!("SELECT name FROM users WHERE id = {}", user_id); can easily be replaced by this: let mut query = String::from("SELECT name FROM users WHERE id = "); query += user_id; What, are you also going to forbid simple string operations? There will be some user that will use them to create an unsanitized query.
- gspr 5y ago
  > You don't need format strings to create vulnerable queries. If you can't use them, this code: I know, thank you. > What, are you also going to forbid simple string operations? Dude, chill. Why do you feel attacked? I'm just stating facts. Those facts are not a critique of you (or of Rust, a language I love).
  - adwn 5y ago
    I'm not feeling "attacked". I'm trying to help you understand that the argument "feature X might be used in a way that could lead to a incorrect behavior" on its own isn't enough to warrant exclusion of that feature, because that same argument can be used against basically all features of a language.
jamincan 5y ago
There is a legitimate point that some programmers might misuse format strings and that by using named capturing in the format string, this misuse would be slightly more ergonomic. Nevertheless, legitimate uses of format strings also become more ergonomic, and legitimate uses would seem to far out-strip illegitimate uses. Furthermore, within the Rust ecosystem, the tools to build SQL queries, or serialize/deserialize JSON generally provide interfaces that are more ergonomic than manually using format strings, so a programmer has little incentive to do so as it would constitute more work on their part.

by gspr 5y ago

adwn 5y ago

You don't need format strings to create vulnerable queries. If you can't use them, this code: let query = format!("SELECT name FROM users WHERE id = {}", user_id); can easily be replaced by this: let mut query = String::from("SELECT name FROM users WHERE id = "); query += user_id; What, are you also going to forbid simple string operations? There will be some user that will use them to create an unsanitized query.

gspr 5y ago
> You don't need format strings to create vulnerable queries. If you can't use them, this code: I know, thank you. > What, are you also going to forbid simple string operations? Dude, chill. Why do you feel attacked? I'm just stating facts. Those facts are not a critique of you (or of Rust, a language I love).
- adwn 5y ago
  I'm not feeling "attacked". I'm trying to help you understand that the argument "feature X might be used in a way that could lead to a incorrect behavior" on its own isn't enough to warrant exclusion of that feature, because that same argument can be used against basically all features of a language.

jamincan 5y ago

There is a legitimate point that some programmers might misuse format strings and that by using named capturing in the format string, this misuse would be slightly more ergonomic. Nevertheless, legitimate uses of format strings also become more ergonomic, and legitimate uses would seem to far out-strip illegitimate uses. Furthermore, within the Rust ecosystem, the tools to build SQL queries, or serialize/deserialize JSON generally provide interfaces that are more ergonomic than manually using format strings, so a programmer has little incentive to do so as it would constitute more work on their part.