<p dir="ltr">On Aug 20, 2015 23:40, "Nick Coghlan" <<a href="mailto:ncoghlan@gmail.com">ncoghlan@gmail.com</a>> wrote:<br>
><br>
[...]<br>
> myquery = i"SELECT $column FROM $table;"<br>
> mycommand = i"cat $filename"<br>
> mypage = i"<html><body>$content</body></html>"<br>
><br>
> It's the opposite of the "interpolating untrusted strings that may<br>
> contain aribtrary expressions" problem - what happens when the<br>
> variables being *substituted* are untrusted? It's easy to say "don't<br>
> do that", but if doing the right thing incurs all the repetition<br>
> currently involved in calling str.format, we're going to see a *lot*<br>
> of people doing the wrong thing. At that point, the JavaScript<br>
> backticks-with-arbitrary-named-callable solution starts looking very<br>
> attractive:<br>
><br>
> myquery = sql`SELECT $column FROM $table;`<br>
> mycommand = sh`cat $filename`<br>
> mypage = html`<html><body>$content</body></html>`</p>
<p dir="ltr">Surely if using backticks we would drop the ugly prefix syntax and just make it a function call?</p>
<p dir="ltr">myquery = sql(`SELECT $column FROM $table;`)</p>
<p dir="ltr">etc., where `...` returns an object with the string and substitution info inside it.</p>
<p dir="ltr">I can certainly appreciate the argument that safe quoting for string interpolation deserves as much attention at the language level in 2015 as buffer overflow checking deserved back in the day.</p>
<p dir="ltr">Taking that problem seriously though is perhaps an argument against even having a trivial string version, because if it's legal then people will still write</p>
<p dir="ltr">do_sql("SELECT $column FROM $table;")</p>
<p dir="ltr">instead and the only way to get them to consistently use delayed (safe) evaluation would be to constantly educate and audit, which is the opposite of good design for security and exactly the problem we have now. Really what we want from this perspective is that it should be *harder* to get it wrong than to get it right.</p>
<p dir="ltr">Maybe simple no-quoting interpolation should be spelled</p>
<p dir="ltr">str(`hello $planet`)</p>
<p dir="ltr">(or substitute favorite prefix tag if allergic to backticks), so you have to explicitly specify a quoting syntax even if only to say that you want the null syntax.</p>
<p dir="ltr">Alternatively I guess it would be enough if interfaces like our hypothetical sql(...) simply refused to accept raw strings and required delayed interpolation objects only, even for static/constant queries. But I'm unconvinced that this would happen, given the number of preexisting APIs that already accept strings, and the need to continue supporting pre-3.6 versions of python.</p>
<p dir="ltr">-n</p>