<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 8/11/2015 11:28, Wes Turner wrote:<br>
<blockquote
cite="mid:CACfEFw_1Qw-n0bxkhSsvBJhw+SaF1TQMRUYon=9=bTBcK0ckog@mail.gmail.com"
type="cite">
<p dir="ltr"><br>
On Aug 11, 2015 10:19 AM, "Wes Turner" <<a
moz-do-not-send="true" href="mailto:wes.turner@gmail.com">wes.turner@gmail.com</a>>
wrote:<br>
</p>
<p dir="ltr">- [ ] review all string interpolation (for
"injection")<br>
* [ ] review every '%'<br>
* [ ] review every ".format()"<br>
* [ ] review every f-string (AND LOCALS AND GLOBALS)<br>
* every os.system, os.exec*, subprocess.Popen<br>
* every unclosed tag<br>
* every unescaped control character</p>
<p dir="ltr">This would create work we don't need.</p>
<p dir="ltr">Solution: __str_shell_ escapes, adds slashes, and
quotes. __str__SQL__ refs a global list of reserved words.</p>
</blockquote>
I don't understand why % and .format got interjected into this.<br>
<br>
If you are mentioning them as 'get the unprocessed version of any
string formatting', that is a bad idea, and not needed, since you
already have an unprocessed string object. Assuming the method were
named "hypothetical":<br>
<br>
>>> 'foo bar'.hypothetical() # returns 'foo bar'<br>
>>> '{0} bar'.format('foo').hypothetical() # returns
'foo bar'<br>
>>> ('%s bar' % ('foo',)).hypothetical() # returns 'foo
bar'<br>
>>> f'{foo} bar'.hypothetical() # returns '{foo} bar',
prime for translation.<br>
<br>
could gettext not be modified to create the same AST as f'{foo} bar'
when it is translated to '{foo} le bar.' and inject it back into the
runtime?<br>
</body>
</html>