News for hackers. Stuff that matters.
Re:We fixed f-string typos in popular Python repos by dumpsterdiver on Friday April 29, 2022 @11:38PM (#31213152)
> And, by the by, more 'smarts' can be applied to automatic f-string determination. If "{variable-that-exists} foobar" is seen it could plausibly be converted to an f-string.

One obvious and dangerous application of these "smarts" is when people expect curly braces to be treated as string literals. What if a string contained an example f-string that contained {sensitive-server-information}? It's reasonable to expect that code like that wouldn't later become vulnerable to injection attacks.

There are no comments on this comment yet.