I tend to use the old style ("%s" % "lel"). Just wondering, does this affect that too?
Be Careful with Python's New-Style String Format
51–60 of 155 posts
Re: Be Careful with Python's New-Style String Format
#52Maybe a more fully worked example is needed. You're making a blog hosting service as a service service. Bloggers have different ideas about what page titles should be. Post Title Blog Name: Post Title Blog Name - Post Title Post Title - Blog Name Blog Name ----embdash---- Post Title ~~~ xXx Post Title xXx ~~~ It's a little overwhelming to put every possibility in a dropdown, so you allow the user to specify a format…
Isn't ingesting user input directly considered a bad idea all around though?
Re: Be Careful with Python's New-Style String Format
#53Re: Be Careful with Python's New-Style String Format
#54I tend to use the old style ("%s" % "lel"). Just wondering, does this affect that too?
The nice thing about the new format is that you can reverse the order of the variables inside the string, which is nice when you're localizing strings into languages with a reversed sentence structures, like Japanese. I haven't done a ton of Python, but the old style won't let you do that, will it?
Re: Be Careful with Python's New-Style String Format
#55Wow, I had no idea you could access attributes from within format strings.
Re: Be Careful with Python's New-Style String Format
#56While I agree this is a possible attack vector, I think it is extremely unlikely, at least in the localization realm, for several reasons: 1. The localization company should never know what programming language you're using. 2. You shouldn't give localization companies direct access to your internal strings. More than hacking your code, they're almost guaranteed to screw the formatting up. 3. Typically, translators a…
Most internationalization these days goes through things like transifex. Becoming a translator on a specific project is not completely unlikely if you want to target it.
I find it depends on the project and the localization company. I've used big ones, like Lingotek and LION (or whatever they're called now), but there are still a lot of small companies that do things manually, and for a lot less.
Re: Be Careful with Python's New-Style String Format
#57Maybe a more fully worked example is needed. You're making a blog hosting service as a service service. Bloggers have different ideas about what page titles should be. Post Title Blog Name: Post Title Blog Name - Post Title Post Title - Blog Name Blog Name ----embdash---- Post Title ~~~ xXx Post Title xXx ~~~ It's a little overwhelming to put every possibility in a dropdown, so you allow the user to specify a format…
Isn't ingesting user input directly considered a bad idea all around though?
ingesting raw user input is good
emitting raw user input is bad
Re: Be Careful with Python's New-Style String Format
#58Maybe a more fully worked example is needed. You're making a blog hosting service as a service service. Bloggers have different ideas about what page titles should be. Post Title Blog Name: Post Title Blog Name - Post Title Post Title - Blog Name Blog Name ----embdash---- Post Title ~~~ xXx Post Title xXx ~~~ It's a little overwhelming to put every possibility in a dropdown, so you allow the user to specify a format…
Isn't ingesting user input directly considered a bad idea all around though?
Yes, so someone might think to verify that it matches a seemingly safe pattern like "word characters separated by zero or more periods", which is still insufficient.
Re: Be Careful with Python's New-Style String Format
#59This article makes you thing the new f-strings will be discussed. What is really being discussed is 'string'.format(), which isn't new in any way.
It's referred to in the documentation as 'New-style', with the old style being the % operator.
Re: Be Careful with Python's New-Style String Format
#60Earlier quoted context omitted.
Neither does python. The problem being discussed here is that the format string can access and attribute of the object passed in. From PEP3101 [0]: " Unlike some other programming languages, you cannot embed arbitrary expressions in format strings. This is by design - the types of expressions that you can use is deliberately limited. Only two operators are supported: the '.' (getattr) operator, and the '[]' (getitem)…
> Neither does python. I would argue that being able to access any global value is a sufficient enough concern.
[deleted]