Decoding the Frustrations and Vulnerabilities of Modern Text Processing
summary
Covers concrete failure modes and fixes: Python 3 treats text as Unicode so printing raw bytes breaks common exploit payloads and the pragmatic fix is sys.stdout.buffer.write rather than hacking encodings; shows how encoding choices and the surrogateescape error handler preserve round‑trip byte sequences; demonstrates a format string exploit revealing Flask secret_key by abusing str.format on user input; enumerates f‑string limits (no globals/locals, limited nesting, backslash issues) and points to PEP proposals for safer interpolations.
AI-written summary · about
chapters (7)
- 0:00Introduction to text processing
- 1:20Bytes versus Unicode strings
- 4:12Security and buffer overflows
- 6:58Encoding and error handling
- 11:04String format vulnerabilities
- 16:40F-string mechanics and risks
- 23:12Q&A session
related talks
35mText Is Not Text: The History of Strings in Python
59mCommon Python Coding Mistakes
25mUnexpected Execution: Wild Ways Code Execution can Occur in Python
26mTesting Python Security
33mPython's Transition to Multilingual Programming
45mPython common security mistakes in 2022
12mMojibake! What the h—ck happened to these strings?
28mSecuring Code with the Python Type System