Re:What's Coming in Python 3.8
by joshuamorton on Thursday July 18, 2019 @04:58PM
(#20473864)
What makes % better than .format for translations (and isn't something like Django's _(str) better anyway?
F strings are obviously non-lazy, but _(tmpl).format(_(part)) seems fine?
`.format` lets you dereference arbitrary attributes and indices (I don't think it lets you call methods though), meaning you can run code and exfiltrate data through translated strings if they're not extremely carefully reviewed, which they often are not.
% only lets you format the values you're given.
> and isn't something like Django's _(str) better anyway
They're orthogonal. You apply string formatting after you get the translated pattern string from gettext. In fact, Django's own documentation demonstrates this:
def my_view(request, m, d):
output = _('Today is %(month)s %(day)s.') % {'month': m, 'day': d}
return HttpResponse(output)
No, f-strings handle a subset of %-based interpolation. They're nice and convenient but e.g. completely unusable for translatable resources (so is str.format incidentally).