StrawMan : String Interpolation for ES Harmony

• Why String Interpolation Is Awesome

  • Solves problems in many domains
    • HTML/SQL/URL/XPATH Templates
    • Text L10N, message strings
    • Logging
  • Understood by developers
  • Easy to read & write
  • Concise
  • O(1) cognitive load

• Why String Interpolation Sucks

  • There is almost always a mismatch between the semantics the user wants and what they get.
  • This semantic mismatch leads to XSS, SQL Injection, Shell Injection, …

• The Mismatch is Corrigible

  • The problem is one of early binding.
  • If innerHTML knew which chars came from literal HTML, and which from interpolated values, it could escape the interpolated values properly.
  • A string interpolation produces an array of string parts. Each part is either literal or interpolated.
  "Hello, $planetoid!"
  ↓
  (('literal "Hello, "), ('interp planetoid),
('literal "!"))

• Interpolation can be bolted onto JS

  eval(Template('Hello, ${planetoid}'))
  ↓
  eval(Interp('Hello, ', (planetoid), ''))
  
  
  • Can be implemented in terms of desugaring and library code to
    • Define an Interpolation type
    • Define an Interpolator that allows SQL libraries, document.write, etc. to specify context-dependent escaping.
  • Escaping decisions can be made by a LTR pass with a state machine, and a side-table that maps states to (escapingFunction, end-state) pairs.

• Interpolations Composes

  var row = eval(Template('<tr><td>$cellContent</tr>'));
  return eval(Template('<table>$row</table>'));

  • When an interpolation is a value, it can be flattened into the enclosing interpolation without changing semantics.
  
  ((('lit "foo")), (('interp x)))
  ≍
  (('lit "foo"), ('interp x))

• Auditable Exemptions

  • It is better to build in auditable exemptions to security rules than to force people to use less secure alternatives.
  unsafeInterp(s) → (('literal s))

• Differences between Strings and Interpolations

  • API-wise: none
  • Interpolations could support substring, charAt, indexOf, etc.
  • But not always meaningful. A substring of a well-formed email address is not always a well-formed email addy.
  • Same problem exists if represented as string.

• Grammar Bikeshedding 1

  • No changes to escaping conventions for single quoted and double quoted strings — JSON embedded in EcmaScript should not change meaning.
  • But boilerplate should be low.
  """Interpolate $this!"""
i"Interpolate $this!"
`Interpolate $this!`
{{"Interpolate $this!"}}
(:"Interpolate $this!":)
\"Interpolate $this!"

• Grammar Bikeshedding 2

  • Can use a simple syntax for interpolations E.g., just identifiers with dots
  • Can delimit, as with ${...} or $(...)
  • Can switch lexical grammar mid-stream
    • Allow arbitrary expressions (parenthetically balanced) inside ${...}
    • or arbitrary expressions minus ["/\r\n\\]
  
  """ $foo """
""" $(foo()) """
""" ${foo()} """
""" $foo[bar] """
""" $foo.bar """