api_path = base_url + urllib.parse.urlencode({
'action': action,
'format': letThisBeVariable,
...
'gscoord': str(latitude.value) + '|' + str(longitude.value)
})
Mantra: when inserting data into a context (like an url) escape the data for that context.
Use something like URLBuilder, or URIParams, or whatever your platform supports. Don't use string concatenation ever, if at all possible, and if not possible (wtf?), then at least escape strings.
https://docs.python-requests.org/en/latest/user/quickstart/#...
One correlated but ancillary benefit, is that there are fewer variables to simulate the state for in your brain, while you're reading the code. You don't have to wonder if a variable is going to change on you, in-between when it is initialized and when it is used.
It's safer still to use a library (e.g. urllib3) that does encoding for you (allowing you to omit magic strings like `"%7C"` from the logic of this function alltogther).
Like GP said, very handy for one-off scripts or areas of your codebase where quality is "less important". I may be pedantic, but I wouldn't give this a pass on code review.
So I would build the query like so:
from urllib.parse import urlencode
urlencode({
"action": "query",
"format": "json",
...
"gscoord": f"{str(latitude.value)}|{str(longitude.value)}",
})
Or did you mean something else?
They're the only data you can control, and unless they're strings, it's useless for exploitation. Even denormal floats / INF / NAN won't help achieve an objective.
I broadly agree with you, but people are pummeling Copilot for writing code that I saw hundreds of times. Yes, sometimes I was able to exploit some of that code. But the details matter.
>>> import requests, pprint
>>>
>>>
>>> url = "https://en.wikipedia.org/w/api.php"
>>> resp = requests.get(
... url,
... params=dict(
... action="query",
... list="geosearch",
... format="json",
... gsradius=10000,
... gscoord=f"{latitude.value}|{longitude.value}"
... )
... )
>>>
>>> pprint.pprint(resp.json())
{'batchcomplete': '',
'query': {'geosearch': [{'dist': 26.2,
'lat': 37.7868194444444,
'lon': -122.399905555556,
'ns': 0,
...Oxford English Dictionary, for example, is a human version of defining language and a thesaurus is a completion engine.
Human language didn't suffer by having a dictionary and thesaurus. Computer language doesn't suffer either.
Isn't that a pretty big risk though? Specifically, that people will use co-pilot recommendations "as-is" and give little thought to the actual workings of the recommendation?
After all, if you have to intimately understand the code it's recommending are you really saving that much time over vetting a Googled solution yourself?
I typed the following prompt:
def search_wikipedia(lat, lon):
"""
use "requests" to do a geosearch on Wikipedia and pretty-print the resulting JSON
"""
r = requests.get('https://en.wikipedia.org/w/api.php?action=query&list=geosearch&gsradius=10000&gscoord={0}|{1}&gslimit=20&format=json'.format(lat, lon))
pprint.pprint(r.json())We just had a major failure at work recently because someone decided to not decode URL params and their code worked fine for years because it never mattered… until it did.
Just do it right. It’s so easy. Why risk yourself a ton of headache in the future to save you a few seconds?