4 ms·
> Allowing library developers to do whatever they want with {} expansions is a good thing, and will probably spawn some good uses. I completely disagree with t
by VWWHFSfQ 1y ago
> Allowing library developers to do whatever they want with {} expansions is a good thing, and will probably spawn some good uses.
I completely disagree with this. Look what happened to Log4J when it was given similar freedoms.
- serbuvlad 1y agoI think this would have solved the log4j vulnerability, no? As I understand it, log4j allowed malicious ${} expansion in any string passed to logging functions. So logging user generated code at all would be a security hole. But Python's t-strings purposely _do not_ expand user code, they only expand the string literal.