4 ms·

But if someone omits the `safe` it may still work but allow injection.

• thunky 2y ago
  Same is true if someone forgets to use t" and uses f" instead. At least db.safe says what it does, unlike t".
  • ewidar 2y ago
    Not really, since f"" is a string and t"" is a template, you could make `db.execute` only accept templates, maybe have `db.execute(Template)` and `db.unsafeExecute(str)`
    • thunky 2y ago
      agreed. but then you're breaking the existing `db.execute(str)`. if you don't do that, and instead add `db.safe_execute(tpl: Template)`, then you're back to the risk that a user can forget to call the safe function. also, you're trusting that the library implementer raises a runtime exception if a string a passed where a template is expected. it's not enough to rely on type-checks/linting. and there is probably going to be a temptation to accept `db.execute(sql: Union[str, Template])` because this is non-breaking, and sql without params doesn't need to be templated - so it's breaking some stuff that doesn't need to be broken. i'm not saying templates aren't a good step forward, just that they're also susceptible to the same problems we have now if not used correctly.
      • ubercore 2y ago
        Then make `db.unsafe_execute` take a string.
        • thunky 2y ago
          Yeah, you could. I'm just saying that by doing this you're breaking `db.execute` by not allowing it to take it string like it does now. Libraries may not want to add a breaking change for this.
  • fwip 2y ago
    Your linter can flag the type mismatch, and/or the function can reject f"" at runtime. This is because t"" yields a Template, not a str. Template is also more powerful/concise in that the stringify function can handle the "formatting" args however it looks. Note also, that there's no requirement that the template ever become a str to be used.