News for hackers. Stuff that matters.
Re:We fixed f-string typos in popular Python repos by HL33tibCe7 on Friday April 29, 2022 @02:46PM (#31209152)
> > We may be looking too deep into this but it seems like many developers think when string concatenation occurs it’s enough to declare the first string as an f-string and the other strings are turned into f-strings by osmosis. It doesn’t. We’re not suggesting this is the case for all developers that accidentally did this error, but interesting nonetheless.

I highly doubt that people believed that f-strings worked this way. Far more likely is that, for example, the expression started as one line, then got split onto two, or some such similar scenario.

Re:We fixed f-string typos in popular Python repos by johnny_castaway on Friday April 29, 2022 @03:55PM (#31209915)
This may be also caused by confusing syntax highlighting in some editors, for example in VSCode [1]

The variable in the second string gets highlighted (with slightly different color, but still) because it would still work with `str.format()`. GitHub doesn't seem to do this.

[1] https://imgur.com/a/9KGWVG0

Re:We fixed f-string typos in popular Python repos by totony on Friday April 29, 2022 @05:10PM (#31210619)
Yeah I got bitten by the same-color syntax highlighting a few times.
Re:We fixed f-string typos in popular Python repos by badrabbit on Friday April 29, 2022 @03:17PM (#31209531)
You'd be surprised, people who expect python to be "smart" and "figure it out" might think that way.
Re:We fixed f-string typos in popular Python repos by groestl on Friday April 29, 2022 @03:25PM (#31209611)
Well, it's not completely unlogical.

'a' is str

b'a' is bytes

f'something' might be a separate f-str-type too?

1 is an int

1.2 is a float

(1.2 + 1) is a float

Re:We fixed f-string typos in popular Python repos by GeorgeTirebiter on Friday April 29, 2022 @03:37PM (#31209735)
Indeed, if "{value} is bad" can be automatically f-stringed by an external program automatically --- then why can't Python do this automatically -- so we can get rid of the f-string type as a required explicit declaration? After all, we don't specifically add a type to a number like 42 or 3.14159 --- those are implicitly 'int' and 'float' types.

I would use such a feature, as I always use f-strings when formatting.

Re:We fixed f-string typos in popular Python repos by masklinn on Friday April 29, 2022 @03:59PM (#31209960)
> Indeed, if "{value} is bad" can be automatically f-stringed by an external program automatically --- then why can't Python do this automatically -- so we can get rid of the f-string type as a required explicit declaration?

Because it would break existing strings containing braces, such as those used with `str.format`, or string.Template, or literal Jinja templates, ...

Re:We fixed f-string typos in popular Python repos by GeorgeTirebiter on Friday April 29, 2022 @04:07PM (#31210051)
Yes, my use case was "I always use F-strings" so these other breakages could not occur, by definition.

I suppose it's not that much of a problem to run a program to preprocess source and add in the F

But.. Python has a history of introducing new features that break old ones. That seems to me a balance between backward compatibility and future goodness.

the "from future import auto-fstring" construct could do it...

And, as for having to run the f-string parser: yes, but only once on static strings, which are most of them.

Re:We fixed f-string typos in popular Python repos by chrisshroba on Friday April 29, 2022 @04:54PM (#31210474)
It's not clear to me that folks would want this behavior globally - I personally would not, because sometimes I want to be able to include curly braces in my strings without it being interpolated, and I prefer the current syntax of having that just work. I'm very comfortable with having to add the 'f' to the string syntax to declare that this particular string should be interpolated.

There are other issues you'd have to deal with as well. Would you interpolate non-literal strings (e.g. in the code `print(input())`, if the user inputs the string "{1+1}", what would be printed?)? How would you propose dealing with jinja and other strings that typically contain curly braces that should not be interpolated? This could also be an issue with (potentially long) strings containing lots of random characters: if a '}' showed up in a string somewhere after a '{', even if separated by tens or hundreds of characters, then you'll run into errors. This could be a problem if you're dealing with pseudorandom or base-92 encoded strings, or even just strings representing code (imagine a python library that generates C++ or Java code which has lots of hard coded strings with braces).

I think overall, having to specify that a particular string should be interpolated is a better solution than having to specify that a string should not be interpolated.

Re:We fixed f-string typos in popular Python repos by GeorgeTirebiter on Friday April 29, 2022 @05:16PM (#31210658)
Well, you could put a N" your string with{} in it" to type-specify that you are not F-string. In fact, WHY are strings not fully specified every time? There is nothing wrong with F"This is also an f-string". After all, strings are just number sequences with special meanings assigned to some values in some circumstances.

Seems to me the problem is similar to wanting 1 be interpreted as an int --- if you want float, you change the syntax (and therefore semantics) to 1. or 1.0

It's always possible to conjure corner-case failure modes; but shouldn't the 'common case' be catered to, more than some base-92 encoded strings?

And, by the by, more 'smarts' can be applied to automatic f-string determination. If "{variable-that-exists} foobar" is seen it could plausibly be converted to an f-string.

This leads into a much longer discussion of how our compilers/interpreters are too stupid today, and need to up their game. But probably not here, not now.... and also, thank you for your observations & comments.

Re:We fixed f-string typos in popular Python repos by dragonwriter on Friday April 29, 2022 @05:22PM (#31210719)
> It's always possible to conjure corner-case failure modes; but shouldn't the 'common case' be catered to

It is: normal strings are the common case.

Re:We fixed f-string typos in popular Python repos by GeorgeTirebiter on Friday April 29, 2022 @11:49PM (#31213202)
That's true, 'normal' strings are the common case -- IF what you are doing requires the use of 'normal strings'. If you are doing formatting for output, then the 'normal' string is an f-string.

As to 'injection' attacks -- I have no sympathy for somebody who takes user input, does not check it, and throws it at SQL. All user input should be checked 7 ways from Sunday before it's even passed to a part of the program that's supposed to deal with said input.

From my perspective, I'm just trying to say "there has got to be a better way". yes, we can survive, but -- as the OP shows -- a bunch of auto-fixed bugs went away. Why were the bugs there in the first place?

I have a saying that programmers spend too much time debugging; and if they would just not put the bugs in, in the first place, debugging could be reduced. To do that, you need help from your language. Other things also matter, sure. But give me constructs that make it hard for me to screw up.

Re:We fixed f-string typos in popular Python repos by chrisshroba on Saturday April 30, 2022 @01:38AM (#31213627)
I agree that the language should lend itself to being as bug-free as possible, but you and I disagree on which case is the common, less-likely-to-cause-bugs case. I think it's normal strings, you think it's f-strings. Fair enough.

I do want to point out that only interpolating f-strings containing variables that exist is actually more likely to cause bugs because a string "{foo}" may be fine at one point, but then down the road another programmer happens to declare a global variable foo somewhere completely different, thus causing this string to change. The more important issue, though, is that f-strings contain expressions, not just variables, so you can do things like f'{1+1}' or f'There are {len(os.environ)} env vars defined.'. It's not clear what special cases for expressions inside the braces would magically become f-strings and which would not.

Re:We fixed f-string typos in popular Python repos by dumpsterdiver on Friday April 29, 2022 @11:38PM (#31213152)
> And, by the by, more 'smarts' can be applied to automatic f-string determination. If "{variable-that-exists} foobar" is seen it could plausibly be converted to an f-string.

One obvious and dangerous application of these "smarts" is when people expect curly braces to be treated as string literals. What if a string contained an example f-string that contained {sensitive-server-information}? It's reasonable to expect that code like that wouldn't later become vulnerable to injection attacks.

Re:We fixed f-string typos in popular Python repos by masklinn on Saturday April 30, 2022 @04:52AM (#31214448)
> Yes, my use case was "I always use F-strings" so these other breakages could not occur, by definition.

Unless you're using any dependency at all, including the standard library.

> But.. Python has a history of introducing new features that break old ones.

It doesn't tho.

> That seems to me a balance between backward compatibility and future goodness.

That assumes "everything is an fstring" is considered "future goodness", which I'm not sure is a widely shared view.

> the "from future import auto-fstring" construct could do it...

That seems unlikely as the __future__ pseudo-package has generally been used to opt into hopefully future behaviour.

Given the Python 3 experience, somehow, I don't see "let's make all string literals into fstrings" happen any time soon, but hey feel free to create a PEP proposing that.

Alternatively, create your own import hook which does this swap before handing the module off of to the compiler.

Re:We fixed f-string typos in popular Python repos by dragonwriter on Friday April 29, 2022 @04:07PM (#31210048)
If all strings with what looks like format specs are implicitly f-strings, how do you use reusable template strings, which use the same basic internal syntax, for formatting?

f-strings, like r-strings, have uses, but, like r-strings, I wouldn't want to replace plain strings with them.

Re:We fixed f-string typos in popular Python repos by ArchOversight on Friday April 29, 2022 @04:01PM (#31209975)
Because in some cases it is not desired, if for example the string is used in something that expands it further down the line (think SQL injection potential).
Re:We fixed f-string typos in popular Python repos by bagels on Friday April 29, 2022 @04:02PM (#31209995)
Backwards compatibility for one. Code existed before fstrings that may use curly braces, and you can currently use curly braces in non fstrings without escaping them.

Might also be a performance penalty for always having to run the fstring parser.

Re:We fixed f-string typos in popular Python repos by HL33tibCe7 on Friday April 29, 2022 @03:59PM (#31209964)
As a beginner, maybe. But this is code in some of the biggest open-source Python repos in existence. Probably written by someone with a reasonable level of Python expertise.
Re:We fixed f-string typos in popular Python repos by genewitch on Saturday April 30, 2022 @02:07AM (#31213767)
... and yet?
Re:We fixed f-string typos in popular Python repos by groestl on Friday April 29, 2022 @03:20PM (#31209562)
I think what's happening is that people assume there's type coercion going on here.
Re:We fixed f-string typos in popular Python repos by jldugger on Friday April 29, 2022 @05:16PM (#31210661)
I wonder if an autoformatter like black is at play here.
Re:We fixed f-string typos in popular Python repos by saila on Friday April 29, 2022 @05:32PM (#31210798)
Black doesn't split strings, and I doubt they'd choose to use concatenation if they did.
Re:We fixed f-string typos in popular Python repos by hathawsh on Friday April 29, 2022 @07:11PM (#31211669)
I kind of wish Black would split and join literal strings. I've seen several times when Black converted code like this:

    raise SomeError(
        "Explanation... "
        "yet more explanation"
    )
To this:

    raise SomeError(
        "Explanation... " "yet more explanation"
    )
That just looks odd. Black is fantastic, but not perfect.
Re:We fixed f-string typos in popular Python repos by d0mine on Friday April 29, 2022 @10:53PM (#31212936)
Black does split strings if configured and it does use implicit concatenation of Python string literals.
Re:We fixed f-string typos in popular Python repos by saila on Sunday May 01, 2022 @12:44AM (#31222268)
There's an experimental option for splitting long strings using the --preview flag, but it still seems to have some potential issues. That seems like it would be extremely hard to solve correctly.
Re:We fixed f-string typos in popular Python repos by xigoi on Saturday April 30, 2022 @04:50AM (#31214438)
Black doesn't change the semantics of code.