f-strings vs. format strings #15

New Issue

phryk · 2020-06-06T15:58:06Z

phryk commented

2020-06-06 15:58:06 +00:00

(Migrated from rnd.phryk.net)

Get langsec clarity on usage of f-strings (f"foo{bar}") vs format strings ("foo%s" % bar) and adjust any places using the inferior option.

Get langsec clarity on usage of f-strings (`f"foo{bar}"`) vs format strings (`"foo%s" % bar`) and adjust any places using the inferior option.

phryk commented

2020-06-06 16:49:57 +00:00

(Migrated from rnd.phryk.net)

According to GothAlice (tyvm!) format strings/sprintf substitutions are "too inconsistent in use and application". Whoopsie. ¯_(ツ)_/¯

f-strings deemed best option since their base string can't be dynamic.

>>> x = "}{__name__"; f"{x}"
'}{__name__'

↑ Seems to be at least immediately injection resistant in practical test, too.

According to GothAlice (tyvm!) format strings/sprintf substitutions are "too inconsistent in use and application". Whoopsie. ¯\_(ツ)_/¯ f-strings deemed best option since their base string can't be dynamic. ``` >>> x = "}{__name__"; f"{x}" '}{__name__' ``` ↑ Seems to be at least immediately injection resistant in practical test, too.

phryk referenced this issue from a commit

2021-05-14 19:04:42 +00:00

replace all format string substitutions with f-strings. closes #15

phryk closed this issue

2021-05-14 19:04:42 +00:00

Sign in to join this conversation.