News for hackers. Stuff that matters.
Re:We fixed f-string typos in popular Python repos by MauranKilom on Friday April 29, 2022 @03:04PM (#31209359)
I don't think this makes sense. Plain strings and format strings are not interchangeable, and using one where the other was meant is probably a bug.

Would you expect that a user input like "{secret} please" is interpolated? If so, we hopefully agree that this would blow major security holes into any python script processing untrusted user input. And if not... Why not?

Re:We fixed f-string typos in popular Python repos by kgeist on Friday April 29, 2022 @03:39PM (#31209751)
>Would you expect that a user input like "{secret} please" is interpolated?

That's basically what the recent log4j security vulnerability was all about. "Helpfully" interpolating logs by default.

Re:We fixed f-string typos in popular Python repos by boxed on Friday April 29, 2022 @04:17PM (#31210134)
Look up how this works in Swift. They only have one string. No raw strings or f strings. Yet they have all the power of all three python string types and less syntax. It's very nice.
Re:We fixed f-string typos in popular Python repos by minitech on Friday April 29, 2022 @10:18PM (#31212780)
Swift does have raw strings (the #"extended delimiter"# syntax).
Re:We fixed f-string typos in popular Python repos by boxed on Thursday May 12, 2022 @01:55PM (#31357670)
No. Those ALSO have string interpolation!

#"\#(expression)"#

That is exactly the point.

Re:We fixed f-string typos in popular Python repos by minitech on Friday May 13, 2022 @10:45PM (#31374657)
But they’re a distinct string syntax. Your point seemed to be that there was only one. rf"{expression}" works in Python too, note, so either way you want to interpret it, raw strings aren’t a difference.
Re:We fixed f-string typos in popular Python repos by boxed on Saturday May 21, 2022 @02:20PM (#31460410)
No, they aren't. You can have any number of #. Including zero. It's ONE syntax.
Re:We fixed f-string typos in popular Python repos by asvitkine on Friday April 29, 2022 @03:18PM (#31209535)
If you only make it work with string literals (e.g. generate the underlying formatting logic at parse time), it wouldn't allow arbitrary inputs to be treated as f strings.
Re:We fixed f-string typos in popular Python repos by noobermin on Friday April 29, 2022 @03:16PM (#31209515)
The assumption I'm thinking they mean is to make formatting default and unformatted not default, for example, how "raw" strings were treated, escaped characters are replaced with the ascii code by default unless the string is raw, signified by an 'r' prefixed in front.
Re:We fixed f-string typos in popular Python repos by Sohcahtoa82 on Friday April 29, 2022 @03:42PM (#31209781)
Adding that behavior would break existing code that uses str.format, and Python tries to avoid breaking code between minor releases.