4 ms·
Although I strongly disagree with pron's point, format strings aren't limited to printing them to stdout. There's format!(), for example, which returns a String
by adwn 5y ago
Although I strongly disagree with pron's point, format strings aren't limited to printing them to stdout. There's format!(), for example, which returns a String for further use, and you could even write a sql_query!() macro, which creates an SQL query from a format string:
let query = sql_query!("SELECT * FROM users WHERE id = {}", user_id);
query.execute();
Of course, this isn't a valid argument against format strings, because you could just as well write a function which does the same thing without language-level format strings (although it would be a lot less flexible than format strings):
let query = sql_query("SELECT * FROM users WHERE id = @PLACEHOLDER@", user_id);
query.execute();
EDIT: Actually, it would be possible to write a Rust macro sql_query! which takes a format string and creates a sanitized SQL query from it. That's because the actual string interpolation isn't built into the language, only the format_args! helper macro [1]. This macro doesn't insert the arguments into the format string, it only associates the placeholders with the arguments and returns a struct which can be used to create the output string – or a sanitized SQL query.
[1] https://doc.rust-lang.org/std/macro.format_args.html https://doc.rust-lang.org/std/macro.format_args.html
- pron 5y ago> Of course, this isn't a valid argument against format strings, because you could just as well write a function which does the same thing without language-level format strings In that case, you should ask yourself what's the point of format strings at all? The answer is that they're more attractive because using them is more convenient. You want to make the more attractive feature the safer feature to draw people away from danger, not toward it.
- thinkharderdev 5y agoIt seems perverse to make a ubiquitous operation (formatting a string) intentionally hard just because some people may use it for inappropriate purposes such as building SQL queries from untrusted input. Sure, we should have ergonomic easy of building prepared statements and such but that doesn't seem like something that belongs in the standard library. Or maybe it does. But either way there are many, many legitimate use cases for string formatting.
- pron 5y agoBut you don't need to make it harder in order to make it safer. You just need to think more about the security concerns and come up with solutions, as others have.
- adwn 5y ago> You want to make the more attractive feature the safer feature to draw people away from danger, not toward it. There's an entire world of software which does something else than creating SQL queries or HTML pages. Rust is a general purpose language, not some niche DSL. I use format strings all the time in my Rust code, yet I've never been in a situation where those strings should or could have been sanitized.