On Thu, Sep 28, 2017 at 5:25 PM, Sven Van Caekenberghe <sven@stfx.eu> wrote:

> On 28 Sep 2017, at 17:13, Thierry Goubier <thierry.goubier@gmail.com> wrote:
>
>
>
> 2017-09-28 17:08 GMT+02:00 Sven Van Caekenberghe <sven@stfx.eu>:
>
>
> > On 28 Sep 2017, at 16:58, phil@highoctane.be wrote:
> >
> > I stand corrected.
> >
> > Nuclear style feature then.
> >
> > 'Let me get out of here {Smalltalk snapshot:false andQuit: true}. BOOM' interpolate
> >
> > Feels like
> >
> > STR='sudo reboot'; $(STR)
> >
> > in bash when one is sudoer.
>
> Yeah, but it is always the original programmer who writes the template (including the 'Smalltalk snapshot:false andQuit: true' and the 'sudo reboot' in you examples), you would not do that for any good reason.
>
> Typically, you would write something like
>
>�� 'My name is {firstname} {lastname}' interpolate.
>
> in a method of an object with firstname and lastname as instance variables. To access the binding, #evaluate: is used. Though a malicious person could enter 'Smalltalk snapshot:false andQuit: true' as name, it is not that expression that gets evaluated. So in that respect there is no risk.
>
> The risk would be when the template string itself would be (partially) based on used input.
>
> which is easy to overlook:
>
> aString interpolate
>
> People are on average a bit more carefull when they use #compile: or #evaluate:.
>
> Thierry

100% correct, hence my warning.

> > Phil
> >
> > On Thu, Sep 28, 2017 at 4:43 PM, Sven Van Caekenberghe <sven@stfx.eu> wrote:
> >
> >
> > > On 28 Sep 2017, at 16:27, phil@highoctane.be wrote:
> > >
> > > We also have http://norbert.hartl.name/blog/2013/10/03/mustache-templates-for-smalltalk/
> > >
> > > Phil
> >
> > Yes, Mustache is a cool templating engine, but it is similar to #format: not to #interpolate. With true string interpolation, you do not provide a context, you just write the expressions inline. Compare the following two:
> >
> > 'Today is {1} format: { Date today }.
> >
> > 'Today is { Date today }' interpolate.
> >
> > > On Thu, Sep 28, 2017 at 4:20 PM, Sven Van Caekenberghe <sven@stfx.eu> wrote:
> > > Hi,
> > >
> > > I got into a little office discussion about string interpolation as it is done in different programming languages.
> > >
> > > In Pharo we have String>>#format: which is pretty nice. It works as follows:
> > >
> > > | x y |
> > > x := 123.
> > > y := #foo.
> > > 'x={1} and y={2}' format: { x. y }.
> > >
> > > It is also possible to use a dictionary with keys, like this:
> > >
> > > | x y |
> > > x := 123.
> > > y := #foo.
> > > 'x={x} and y={y}' format: { #x->x. #y->y } asDictionary.
> > >
> > > But this is not true string interpolation as described in [ https://en.wikipedia.org/wiki/String_interpolation ]. The idea is to write the value generating expressions directly inside the strings.
> > >
> > > Since in Pharo we add features not by extending the syntax but by adding messages I wondered if it could be done for string interpolation. The goal is to make the following work:
> > >
> > > | x y |
> > > x := 123.
> > > y := #foo.
> > > 'It seems x equals {x} and y equals {y} while Pi is still {Float pi}' interpolate.
> > >
> > >�� => 'It seems x equals 123 and y equals foo while Pi is still 3.141592653589793'
> > >
> > > Here is the implementation I came up with:
> > >
> > > String>>#interpolate
> > >�� "Format the receiver by interpolating the evaluation of expressions
> > >�� in between curly brackets in the context of the sender as in the following 3 oneline examples.
> > >�� 'Today is {Date today}' interpolate.
> > >�� | x | x := 123. 'x equals {x} and pi equals {Float pi}' interpolate.
> > >�� 'In {#strings} you can escape \{ by prefixing it with \\' interpolate."
> > >
> > >�� | senderContext |
> > >�� senderContext := thisContext sender.
> > >�� ^ self class new: self size streamContents: [ :out | | stream |
> > >�� stream := self readStream.
> > >�� [ stream atEnd ] whileFalse: [ | currentChar |
> > >�� (currentChar := stream next) == ${
> > >�� ifTrue: [ | expression result |
> > >�� expression := stream upTo: $}.
> > >�� result := Compiler new
> > >�� evaluate: expression in: senderContext to: nil notifying: nil ifFail: [ ^ nil ] logged: false.
> > >�� out nextPutAll: result asString ]
> > >�� ifFalse: [
> > >�� currentChar == $\
> > >�� ifTrue: [ stream atEnd ifFalse: [ out nextPut: stream next ] ]
> > >�� ifFalse: [ out nextPut: currentChar ] ] ] ]
> > >
> > > It is a hack that could certainly be improved. And there is of course an obvious security problem.
> > >
> > > Thoughts ?
> > >
> > > Sven
> > >
> > >
> > >
> >
> >
> >