Mirror of forum.nim-lang.org

7858 :: What to use instead of TaintedString?

• tmsa04 (orginal) [2021-04-26T03:02:59+02:00] view original

  Building with a recent nim-git:

  Warning: Deprecated since 1.5; TaintedString is deprecated [Deprecated]

  var line = newStringOfCap(120).TaintedString

  Nothing came up about what to use instead of this on the forum when I searched - is there a suggested replacement?

---

• ynfle (orginal) [2021-04-26T03:27:29+02:00] view original

  Do you want something different than just string?

---

• tmsa04 (orginal) [2021-04-26T15:32:52+02:00] view original

  string seems fine in my use case. I had looked here: https://nim-lang.github.io/Nim/system.html and it didn't have any advice, unlike other deprecated items. Perhaps the answer is considered too simple to need explanation! But in truth I had adapted that from something else and did not really understand the purpose of TaintedString. Thank you for your reply, it is helpful to have some knowledgeable confirmation that string can be used for replacement. I was able to delete the .TaintedString and also some later .string conversions which were then no longer needed, and it works correctly.

---

• ynfle (orginal) [2021-04-26T23:00:33+02:00] view original

  The basic idea of TaintedString is that refers to a regular string that was received that could potentially have "bad" data, for example like user input, a file etc. It was a mode the could be set at compile-time to distinguish between TaintedString and string so that you would be mistake run a SQL command, for example, that was received from the user and would be forced to explicitly check it or convert so that you know what you are getting yourself in to. Turns out many people don't use so it was deprecated. It doesn't have any other meaning than that. See here for information on the string type

---

• cumulonimbus (orginal) [2021-04-27T09:55:01+02:00] view original

  It can be replaced by a library level "distinct string", and probably should.

---

• Araq (orginal) [2021-04-27T10:06:29+02:00] view original

  It can be replaced by a library level "distinct string", and probably should.

  Yes, however: distinct string types work much better for "output" types like XML, HTML, SQL... The input coming from readLine etc is tainted, yet you can use any operation to "validate" it. In other words the default string type is the tainted one.

---