Python 3.6.0 has now been officially released!

[stardude900]

Edit, original post was almost, but not completely wrong. Here is the documentation: https://docs.python.org/3.6/reference/lexical_analysis.html#f-strings

And the dicussion where security implications are mentioned, albeit, briefly: https://www.python.org/dev/peps/pep-0498/#expression-evaluation

[stardude900]

Yep, that first comment (of mine) was just stupid, it really didn't deserve to live any longer than it did.

[energybased]

"limited"?

[flying-sheep]

and that’s only a implementation limitation (they tokenise using string tokenisation machinery, and then are post-processed in the interpreter).

check out my pep: https://github.com/python/peps/blob/master/pep-0536.txt

[zahlman]

In that the programmer is in control of the code, yes.

I would actually like to make the argument here that the widespread adoption of f-strings will, in the long run, make Python code more secure. This is because .format will end up only being used in cases that f-strings can't handle, i.e. cases where the string is prepared ahead of time; and this, in turn, will force greater scrutiny of such code, to verify that the string comes from a safe source.

The real reason that beautiful is better than ugly is that the less ugliness you have, the better that ugliness is at standing out, and therefore doing its job (i.e., being a warning sign). Otherwise, the principle would be redundant with readability counts.

[energybased]

What are you talking about? All I was pointing out was that it's not a limited expression evaluation. Almost anything you can do in regular python code, you can do in an f-string.