4 ms·

Ideally, but realistically, I have never heard of any major programming language that allows you to express "this function only accepts static constant string l

by lock1 10mo ago

Ideally, but realistically, I have never heard of any major programming language that allows you to express "this function only accepts static constant string literal".

zem 10mo ago
it does seem like something a good static analysis tool should be able to catch though
8n4vidtmkvmk 10mo ago
We have this in c++ at Google. It's like securitytypes::StringLiteral. I don't know how it works under the hood, but it indeed only allows string literals.
purkka 10mo ago
Python has LiteralString for this exact purpose. It's only on the type checker level, but type checking should be part of most modern Python workflows anyway. I've seen DB libraries use this a lot for SQL parameters. https://typing.python.org/en/latest/spec/literal.html#literalstring https://typing.python.org/en/latest/spec/literal.html#litera...
- Too 10mo ago
  Beyond LiteralString there is now also t-strings, introduced in Python 3.14, that eases how one writes templated strings without loosing out on security. Java has something similar with Template class in Java 21 as preview.
jval43 10mo ago
Not the language, but the linter can do it. IntelliJ inspections warn you if you do it: https://www.jetbrains.com/help/inspectopedia/StringConcatenationArgumentToLogCall.html https://www.jetbrains.com/help/inspectopedia/StringConcatena...
MereInterest 10mo ago
In Rust, this can almost be expressed as `arg: &'static str` to accept a reference to a string whose lifetime never ends. I say “almost” because this allows both string literals and references to static (but dynamically generated) string. For Rust’s macros, a literal can be expressed as `$arg:lit`. This does allow other literals as well, such as int or float literals, but typically the generated code would only work for a string literal.
stefanfisk 10mo ago
Even PHP has that these days via static analysis https://phpstan.org/writing-php-code/phpdoc-types#other-advanced-string-types https://phpstan.org/writing-php-code/phpdoc-types#other-adva...
pxx 10mo ago
c++20 offers `consteval` to make this clear, but you can do some simple macro wizardry in c++11 to do this: #define foo(x) ( \ (void)std::integral_constant<char, (x)[0]>::value, \ foo_impl(x) \ ) (the re-evaluation of x doesn't matter if it compiles). You can also use a user-defined literal which has a different ergonomic problem.

by lock1 10mo ago

Ideally, but realistically, I have never heard of any major programming language that allows you to express "this function only accepts static constant string literal".

zem 10mo ago

it does seem like something a good static analysis tool should be able to catch though

8n4vidtmkvmk 10mo ago

We have this in c++ at Google. It's like securitytypes::StringLiteral. I don't know how it works under the hood, but it indeed only allows string literals.

purkka 10mo ago

Python has LiteralString for this exact purpose. It's only on the type checker level, but type checking should be part of most modern Python workflows anyway. I've seen DB libraries use this a lot for SQL parameters. https://typing.python.org/en/latest/spec/literal.html#literalstring https://typing.python.org/en/latest/spec/literal.html#litera...

Too 10mo ago
Beyond LiteralString there is now also t-strings, introduced in Python 3.14, that eases how one writes templated strings without loosing out on security. Java has something similar with Template class in Java 21 as preview.

jval43 10mo ago

Not the language, but the linter can do it. IntelliJ inspections warn you if you do it: https://www.jetbrains.com/help/inspectopedia/StringConcatenationArgumentToLogCall.html https://www.jetbrains.com/help/inspectopedia/StringConcatena...

MereInterest 10mo ago

In Rust, this can almost be expressed as `arg: &'static str` to accept a reference to a string whose lifetime never ends. I say “almost” because this allows both string literals and references to static (but dynamically generated) string. For Rust’s macros, a literal can be expressed as `$arg:lit`. This does allow other literals as well, such as int or float literals, but typically the generated code would only work for a string literal.

stefanfisk 10mo ago

Even PHP has that these days via static analysis https://phpstan.org/writing-php-code/phpdoc-types#other-advanced-string-types https://phpstan.org/writing-php-code/phpdoc-types#other-adva...

pxx 10mo ago

c++20 offers `consteval` to make this clear, but you can do some simple macro wizardry in c++11 to do this: #define foo(x) ( \ (void)std::integral_constant<char, (x)[0]>::value, \ foo_impl(x) \ ) (the re-evaluation of x doesn't matter if it compiles). You can also use a user-defined literal which has a different ergonomic problem.