11–20 of 155 posts
Err, why would you allow for the user to enter arbitrary format strings in the first place? Might as well write "be careful about eval of arbitrary user provided strings".
Err, why would you allow for the user to enter arbitrary format strings in the first place? Might as well write "be careful about eval of arbitrary user provided strings".
Although if you are using templates in Python, you are likely using jinja2. And they just "fixed" the bug. So you are good to go if your upgrade.
I do love writing python, but it's pretty shocking when I find out you can write something like `event.__init__.__globals__[CONFIG][SECRET_KEY]`. That language just does not care about privacy or information hiding at all, I guess.
Don't let users run untrusted code. Full stop.
If you need templating use a sandbox like jinja2.
Edit: As correctly pointed out, this feature has been around since the introduction of str.format(). So this warning applies to all Python versions.
Err, why would you allow for the user to enter arbitrary format strings in the first place? Might as well write "be careful about eval of arbitrary user provided strings".
Internationalization, usually. Word order differs between languages, and this kind of format allows reordering the inserted values.
Look at MessageFormat or L20n. Yeah, I know that it's more complex than what you think you need (I've hear the "let's just use JS template literals" so many times) but you actually do.
Err, why would you allow for the user to enter arbitrary format strings in the first place? Might as well write "be careful about eval of arbitrary user provided strings".
Internationalization, usually. Word order differs between languages, and this kind of format allows reordering the inserted values.
No, Rust does not have the ability to access any variable in the program via a format string. Rust has this: format!("{argument}", argument = "test"); // => "test" That's just named arguments to the format. Also, that's a macro; it's expanded at compile time. Python's approach is lame. It should have used something with a limited list of named arguments, or maybe a dict.
The problem being discussed here is that the format string can access and attribute of the object passed in. From PEP3101 [0]:
" Unlike some other programming languages, you cannot embed arbitrary expressions in format strings. This is by design - the types of expressions that you can use is deliberately limited. Only two operators are supported: the '.' (getattr) operator, and the '[]' (getitem) operator. The reason for allowing these operators is that they don't normally have side effects in non-pathological code."
Err, why would you allow for the user to enter arbitrary format strings in the first place? Might as well write "be careful about eval of arbitrary user provided strings".
"Customize the look of your blog by editing these templates."
Post Title
Blog Name: Post Title
Blog Name - Post Title
Post Title - Blog Name
Blog Name ----embdash---- Post Title
~~~ xXx Post Title xXx ~~~
title = userformats.title.fmt(post)
"{post.title} - {post.blog.title}"
"{post.title}: Another fine post by "{post.author}"
"~~~ xXx {post.blog.__init__.dbconnection.__keys__.password} xXx ~~~"
No, Rust does not have the ability to access any variable in the program via a format string. Rust has this: format!("{argument}", argument = "test"); // => "test" That's just named arguments to the format. Also, that's a macro; it's expanded at compile time. Python's approach is lame. It should have used something with a limited list of named arguments, or maybe a dict.