<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<br>
<blockquote type="cite" cite="mid:MN0PR19MB5729184F3A53E3001E7A60A4FC4F9@MN0PR19MB5729.namprd19.prod.outlook.com">
<div dir="ltr">
<div style="">
<div>
<div dir="ltr"><span id="ms-outlook-ios-cursor"></span>Just
curious, doesn’t JSP/JSF processing already use a “string
template” type paradigm using a ${} type syntax. Would
any changes here be usable either or or there?</div>
</div>
</div>
</div>
</blockquote>
<br>
You're thinking of "EL" (expression language). This works by using
a Map-like context for key-values pairs, but the expressions are
encoded as strings: "${foo.bar.baz}" where it looks in the context
for "foo", then looks for a bar() / getBar() method or bar field,
etc. String templates would have given us a better way to express
such things, that aren't quite so stringly typed.<br>
<br>
<blockquote type="cite" cite="mid:MN0PR19MB5729184F3A53E3001E7A60A4FC4F9@MN0PR19MB5729.namprd19.prod.outlook.com">
<div dir="ltr">
<div style="">
<div>
</div>
<div dir="ltr">Given recent log4j security issues, is there
any possible risk that expansion could introduce some
exploitable logic? Does any sort of constraint or mechanism
need to protect against that or am I I er thinking it?</div>
</div>
</div>
</blockquote>
<br>
That would be a function of the template processor. One could
certainly write a template processor that was vulnerable in the same
way Log4j was. <br>
<br>
<blockquote type="cite" cite="mid:MN0PR19MB5729184F3A53E3001E7A60A4FC4F9@MN0PR19MB5729.namprd19.prod.outlook.com">
<div dir="ltr">
<div style="">
<div dir="ltr"><br>
</div>
<div dir="ltr"><br>
</div>
<div id="ms-outlook-mobile-signature">
<div><br>
</div>
Get <a href="https://urldefense.com/v3/__https://aka.ms/o0ukef__;!!ACWV5N9M2RV99hQ!PybBKxO0tCvcjBLrZ2nYFX_Q2Towex3Sa0F-v6rHj0z5R2gxJLhUaHpUHx5f9yQxbxcXGVtQMBXIXZsZ$" style="" moz-do-not-send="true">Outlook for iOS</a></div>
<div id="mail-editor-reference-message-container" class="ms-outlook-mobile-reference-message">
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri,
sans-serif"><b>From:</b> jdk-dev
<a class="moz-txt-link-rfc2396E" href="mailto:jdk-dev-retn@openjdk.org"><jdk-dev-retn@openjdk.org></a> on behalf of Attila
Kelemen <a class="moz-txt-link-rfc2396E" href="mailto:attila.kelemen85@gmail.com"><attila.kelemen85@gmail.com></a><br>
<b>Sent:</b> Wednesday, September 21, 2022 6:20 PM<br>
<b>To:</b> Brian Goetz <a class="moz-txt-link-rfc2396E" href="mailto:brian.goetz@oracle.com"><brian.goetz@oracle.com></a><br>
<b>Cc:</b> <a class="moz-txt-link-abbreviated" href="mailto:amber-dev@openjdk.org">amber-dev@openjdk.org</a>
<a class="moz-txt-link-rfc2396E" href="mailto:amber-dev@openjdk.org"><amber-dev@openjdk.org></a>; <a class="moz-txt-link-abbreviated" href="mailto:jdk-dev@openjdk.org">jdk-dev@openjdk.org</a>
<a class="moz-txt-link-rfc2396E" href="mailto:jdk-dev@openjdk.org"><jdk-dev@openjdk.org></a><br>
<b>Subject:</b> Re: New candidate JEP: 430: String
Templates (Preview)
<div> </div>
</font></div>
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Thanks for the responses. See
some of my clarifications below.<br>
<br>
> ><br>
> > 1. Might be a personal preference, but I
find the<br>
> > `TemplateProcessorExpression . Template`
syntax bizarre.<br>
><br>
> We knew that at least one out of the 10M Java
developers would loudly<br>
> proclaim "I hate the syntax", so congratulations,
it's you :) New<br>
> syntaxes are risky; people are used to "${foo}"
in other languages, and<br>
> this is new and different, and sometimes
different is scary. But, it<br>
> wasn't picked out of a hat; a good deal of
thought has gone into this,<br>
> and so while it may seem weird now, give it a
year and I suspect it will<br>
> not seem so odd. (In any case, amber-dev isn't
the forum for syntax<br>
> discussions, so let's leave this here.)<br>
<br>
Just to clear the misunderstanding: I was not
commenting on the "\{foo}",<br>
I consider that a good thing (better than "${foo}" for
sure, and "${foo}"<br>
would not even be a compatible change). I was talking
about the:<br>
`STR."bla ${myVar} bla"`. As opposed to just calling
the respective methods.<br>
</div>
</span></font></div>
</div>
</div>
</blockquote>
<br>
</body>
</html>