|
|
|
|
|
by MauranKilom
1506 days ago
|
|
I don't think this makes sense. Plain strings and format strings are not interchangeable, and using one where the other was meant is probably a bug. Would you expect that a user input like "{secret} please" is interpolated? If so, we hopefully agree that this would blow major security holes into any python script processing untrusted user input. And if not... Why not? |
|
That's basically what the recent log4j security vulnerability was all about. "Helpfully" interpolating logs by default.