Critique of PEP 501 (General purpose string interpolation)
I think it's too much effort for too little gain. The motivation feels very weak; surely writing os.system("echo " + message_from_user) is just as easy (as is the %s spelling), so the security issue can hardly be blamed on PEP 498. I also don't think that the current way to address such security issues is a big deal: - The subprocess module is complex for other reasons, and a simpler wrapper could easily be made; - Database wrappers have forever included their own solution for safely quoting query parameters, and people who still don't use that are not likely to care about i-strings either. - Logging: again, it's hard to beat the existing solution, which mostly comes down to using %r instead of %s for any user-supplied or otherwise unverified data. - HTML quoting is an art and I'm skeptical that the proposal will even work for that use case. -- --Guido van Rossum (python.org/~guido)
On 5 September 2015 at 13:04, Guido van Rossum <guido@python.org> wrote:
I think it's too much effort for too little gain.
The motivation feels very weak; surely writing
os.system("echo " + message_from_user)
is just as easy (as is the %s spelling), so the security issue can hardly be blamed on PEP 498.
That's fair - writing PEP 501 actually made *me* a lot more comfortable with PEP 498. Rather than asking for a pronouncement, I've marked 501 as Deferred - I still think it's potentially interesting, but I also think it's worth taking our time and seeing how far we can get with just eager rendering. If cases emerge where the lack of delayed rendering support is keenly felt, then it isn't hard to resurrect a deferred PEP. Regards, Nick. -- Nick Coghlan | ncoghlan@gmail.com | Brisbane, Australia
On Sat, Sep 5, 2015 at 5:11 AM, Nick Coghlan <ncoghlan@gmail.com> wrote:
On 5 September 2015 at 13:04, Guido van Rossum <guido@python.org> wrote:
I think it's too much effort for too little gain.
The motivation feels very weak; surely writing
os.system("echo " + message_from_user)
is just as easy (as is the %s spelling), so the security issue can hardly be blamed on PEP 498.
That's fair - writing PEP 501 actually made *me* a lot more comfortable with PEP 498.
Rather than asking for a pronouncement, I've marked 501 as Deferred - I still think it's potentially interesting, but I also think it's worth taking our time and seeing how far we can get with just eager rendering. If cases emerge where the lack of delayed rendering support is keenly felt, then it isn't hard to resurrect a deferred PEP.
Thank you. I agree with that assessment. -- --Guido van Rossum (python.org/~guido)
participants (2)
-
Guido van Rossum -
Nick Coghlan