eg 1
I can maybe try to think of situations where one is quoting a list[str | None], eg reading usernames, ages, and optional comments out of a dataclass or something, and a lazy developer using
argv = ["db", "insert"]
argv.extend(["--username", shlex.quote(user.username)])
argv.extend(["--age", shlex.quote(str(user.age))])
argv.extend(["--comment", shlex.quote(user.comment)])
to mimic
$ db insert --username 'foo' --age '67' --comment ''
when really they should have looked at if the comment field is None:
argv = ["db", "insert"]
argv.extend(["--username", shlex.quote(user.username)])
argv.extend(["--age", shlex.quote(str(user.age))])
if user.comment is not None:
argv.extend(["--comment", shlex.quote(user.comment)])
but surely the latter case is the most likely anyways, because if one is paying attention to age being an int which needs converting to a str, then one would also pay attention to comment being optional, and not wanting to clog one’s database with tonnes of empty comment entries?
eg 2
Plenty of coreutils like ls, touch, mkdir, ln, rm, find gently exit with failure and perror of ENOENT when doing eg $ mkdir '' so I don’t think None being coerced to "''" is super bad (any security vulnerabilities), but maybe there’s less gentle failures, like testing the length of a string vs a string being unset causing issues on a command line.
Anyone else got opinions?