string.Template and string.Formatter. Template($var) substitution is safe when placeholders are explicit. Formatter.format() with user-controlled format_spec is a format-string injection vector.
.Formatter().Formatter()Sinkstring.Formatter() -> Formatter
Advanced str.format interface. Format-string injection sink when format string is user-controlled.
.Template()Neutralstring.Template(template: str) -> Template
Creates a $-substitution template. Neutral; substitute() is the rendering step.
| FQN | Field | |
|---|---|---|
| string | fqns[0] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyStringTemplate