[Alex3917]

> `for i in range(5): ...` will leave `i` bound to 4 after the loop. reply

This "feature" was responsible for one of the worst security issues I've seen in my career. I love Python, but the scope leakage is a mess. (And yes, I know it's common in other languages, but that shouldn't excuse it.)

[anitil]

I would love to hear about the security issue if you're able to talk about it

[Alex3917]

I don't remember the exact details, but it basically involved something along the lines of:

1) Loop through a list of permissions in a for list

2) After the loop block, check if the user had a certain permission. The line of code performing the check was improperly indented and should have failed, but instead succeeded because the last permission from the previous loop was still in scope.

Fortunately there was no real impact because it only affected users within the same company, but it was still pretty bad.

[anitil]

Oof that's a near miss. That's the sort of hard-to-find issue that keeps me up at night. Although maybe these days some ai tool would be able to pick them up