6 ms·

I don't think this makes sense. Plain strings and format strings are not interchangeable, and using one where the other was meant is probably a bug. Would you

I don't think this makes sense. Plain strings and format strings are not interchangeable, and using one where the other was meant is probably a bug. Would you expect that a user input like "{secret} please" is interpolated? If so, we hopefully agree that this would blow major security holes into any python script processing untrusted user input. And if not... Why not?

asvitkine 4y ago
If you only make it work with string literals (e.g. generate the underlying formatting logic at parse time), it wouldn't allow arbitrary inputs to be treated as f strings.
noobermin 4y ago
The assumption I'm thinking they mean is to make formatting default and unformatted not default, for example, how "raw" strings were treated, escaped characters are replaced with the ascii code by default unless the string is raw, signified by an 'r' prefixed in front.
kgeist 4y ago
>Would you expect that a user input like "{secret} please" is interpolated? That's basically what the recent log4j security vulnerability was all about. "Helpfully" interpolating logs by default.
Sohcahtoa82 4y ago
Adding that behavior would break existing code that uses str.format, and Python tries to avoid breaking code between minor releases.
boxed 4y ago
Look up how this works in Swift. They only have one string. No raw strings or f strings. Yet they have all the power of all three python string types and less syntax. It's very nice.
- minitech 4y ago
  Swift does have raw strings (the #"extended delimiter"# syntax).
  - boxed 4y ago
    No. Those ALSO have string interpolation! #"\#(expression)"# That is exactly the point.
    - minitech 4y ago
      But they’re a distinct string syntax. Your point seemed to be that there was only one. rf"{expression}" works in Python too, note, so either way you want to interpret it, raw strings aren’t a difference.
      - boxed 4y ago
        No, they aren't. You can have any number of #. Including zero. It's ONE syntax.
        deleted 4y ago
        [deleted]

asvitkine 4y ago

If you only make it work with string literals (e.g. generate the underlying formatting logic at parse time), it wouldn't allow arbitrary inputs to be treated as f strings.

noobermin 4y ago

The assumption I'm thinking they mean is to make formatting default and unformatted not default, for example, how "raw" strings were treated, escaped characters are replaced with the ascii code by default unless the string is raw, signified by an 'r' prefixed in front.

kgeist 4y ago

>Would you expect that a user input like "{secret} please" is interpolated? That's basically what the recent log4j security vulnerability was all about. "Helpfully" interpolating logs by default.

Sohcahtoa82 4y ago

Adding that behavior would break existing code that uses str.format, and Python tries to avoid breaking code between minor releases.

boxed 4y ago

Look up how this works in Swift. They only have one string. No raw strings or f strings. Yet they have all the power of all three python string types and less syntax. It's very nice.

minitech 4y ago
Swift does have raw strings (the #"extended delimiter"# syntax).
- boxed 4y ago
  No. Those ALSO have string interpolation! #"\#(expression)"# That is exactly the point.
  - minitech 4y ago
    But they’re a distinct string syntax. Your point seemed to be that there was only one. rf"{expression}" works in Python too, note, so either way you want to interpret it, raw strings aren’t a difference.
    - boxed 4y ago
      No, they aren't. You can have any number of #. Including zero. It's ONE syntax.
      - deleted 4y ago
        [deleted]