News for hackers. Stuff that matters.

A comment on PEP 750 – Template Strings (t-strings) have been accepted. Parent comment

Re:PEP 750 – Template Strings (t-strings) have been accepted by bcoates on Sunday April 13, 2025 @04:44PM (#43675704)
Right, and then if you do literally anything with the output other than print() to a tty, it’s an escaping/injection attack.

any_func(f"{attacker_provided}") <=> eval(attacker_provided), from a security/correctness perspective

[ Parent | on HN ]
Re:PEP 750 – Template Strings (t-strings) have been accepted by saagarjha on Tuesday April 15, 2025 @01:33AM (#43689269)
How is this any different from any_func(attacker_provided)
[ Parent | on HN ]
Re:PEP 750 – Template Strings (t-strings) have been accepted by rowanG077 on Wednesday April 23, 2025 @04:53PM (#43776519)
Shooting any unsanitized input into your application is bad. template strings don't make this worse. any_func(attacker_provided) is even worse then any_func(t"{attacker_provided}") since in the later case you actually have reduced the attack surface to just strings.
[ Parent | on HN ]