21–30 of 155 posts
Earlier quoted context omitted.
Internationalization, usually. Word order differs between languages, and this kind of format allows reordering the inserted values.
Yes, but that's meant for trusted translators of the UI, nor arbitrary users, right?
Earlier quoted context omitted.
"Customize the look of your blog by editing these templates."
Shouldn't that be based not on the built-in string capabilities, but on a template engine, that must also take care for much more narrow cases of abuse (e.g. SQL injection, or access to only of a restricted number of helper functions within the template)?
Until now I thought the new features were confined to `f""` format strings. Edit: As correctly pointed out, this feature has been around since the introduction of str.format(). So this warning applies to all Python versions.
Earlier quoted context omitted.
"Customize the look of your blog by editing these templates."
Shouldn't that be based not on the built-in string capabilities, but on a template engine, that must also take care for much more narrow cases of abuse (e.g. SQL injection, or access to only of a restricted number of helper functions within the template)?
Until now I thought the new features were confined to `f""` format strings. Edit: As correctly pointed out, this feature has been around since the introduction of str.format(). So this warning applies to all Python versions.
Until now I thought the new features were confined to `f""` format strings. Edit: As correctly pointed out, this feature has been around since the introduction of str.format(). So this warning applies to all Python versions.
No, Rust does not have the ability to access any variable in the program via a format string. Rust has this: format!("{argument}", argument = "test"); // => "test" That's just named arguments to the format. Also, that's a macro; it's expanded at compile time. Python's approach is lame. It should have used something with a limited list of named arguments, or maybe a dict.
Also, in C# the string interpolation works only on literal strings at compile time. So it's not possible to inject a malicious code this way from outside of the source code.
http://docs.scala-lang.org/overviews/core/string-interpolati...
For example Groovy on the JVM has GStrings which one can do fairly nasty things.
As well it actually is fairly hard to lock down most of the template languages on the JVM for user templates. (If you are going to allow user templates I recommend one of the Java Mustache-like implementations).