braces | Faster brace expansion for node.js | Regex library

I'm a long-time C# programmer but I'm completely new to WPF and XAML. I can find plenty of tutorials that say "this is how to achieve this specific thing" but not "this is why you do this to achieve this specific thing". I'm seriously struggling to understand the meaning of various syntax in XAML.

In this case, what do curly braces in attributes actually mean? What do they get translated to in terms of code? How do I reason about them? How do they get interpreted? Why does there seem to be multiple syntaxes (Binding="{Binding someProperty}" vs Binding="{Binding path=someProperty}")?

I must be missing something obvious, but I've spent literally days reading tutorials, watching tutorials, even fighting my way through the immensely dry and difficult-to-understand Microsoft documentation and I still can't seem to figure it out.

Let me try to illustrate where I'm getting stuck.

For example, say I was given this:

I added an inline style element to a div tag in a react component along with a className element. The className property renders but the style is not displaying. I am setting from an object variable. However, if I set the style element directly using double curly braces it works, just not working from a variable.

Here is an image of the object value I am using to set the style element.

This shows where the style element should be getting set as the component is rendering, the styleElement object has a value set at this point

This shows the component post rendering and the style element is not present

What would prevent the style element from rendering even though is it populated from an object containing CSS properties?

So basically, I want to create a function like this:

From various sources, I have come to the understanding that there are four main techniques of string formatting/interpolation in Python 3 (3.6+ for f-strings):

1. Formatting with %, which is similar to C's printf
2. The str.format() method
3. Formatted string literals/f-strings
4. Template strings from the standard library string module

My knowledge of usage mainly comes from Python String Formatting Best Practices (source A):

• str.format() was created as a better alternative to the %-style, so the latter is now obsolete
  • However, str.format() is vulnerable to attacks if user-given format strings are not properly handled
• f-strings allow str.format()-like behavior only for string literals but are shorter to write and are actually somewhat-optimized syntactic sugar for concatenation
• Template strings are safer than str.format() (demonstrated in the first source) and the other two methods (implied in the first source) when dealing with user input

I understand that the aforementioned vulnerability in str.format() comes from the method being usable on any normal strings where the delimiting braces are part of the string data itself. Malicious user input containing brace-delimited replacement fields can be supplied to the method to access environment attributes. I believe this is unlike the other ways of formatting where the programmer is the only one that can supply variables to the pre-formatted string. For example, f-strings have similar syntax to str.format() but, because f-strings are literals and the inserted values are evaluated separately through concatenation-like behavior, they are not vulnerable to the same attack (source B). Both %-formatting and Template strings also seem to only be supplied variables for substitution by the programmer; the main difference pointed out is Template's more limited functionality.

I have seen a lot of emphasis on the vulnerability of str.format() which leaves me with questions of what I should be wary of when using the other techniques. Source A describes Template strings as the safest of the above methods "due to their reduced complexity":

The more complex formatting mini-languages of the other string formatting techniques might introduce security vulnerabilities to your programs.

1. Yes, it seems like f-strings are not vulnerable in the same way str.format() is, but are there known concerns about f-string security as is implied by source A? Is the concern more like risk mitigation for unknown exploits and unintended interactions?

I am not familiar with C and I don't plan on using the clunkier %/printf-style formatting, but I have heard that C's printf had its own potential vulnerabilities. In addition, both sources A and B seem to imply a lack of security with this method. The top answer in Source B says,

String formatting may be dangerous when a format string depends on untrusted data. So, when using str.format() or %-formatting, it's important to use static format strings, or to sanitize untrusted parts before applying the formatter function.

1. Do %-style strings have known security concerns?
2. Lastly, which methods should be used and how can user input-based attacks be prevented (e.g. filtering input with regex)?
   • More specifically, are Template strings really the safer option? and Can f-strings be used just as easily and safely while granting more functionality?

Given the following code:

The sizeof builtin can take either a type or an expression, and will return the appropriate value.

I'd like to build a macro that uses _Generic() expressions to do something similar. In particular, I'd like to be able to pass either a type name or a value as the parameter, just like sizeof.

As a trivial example, I can do something like this:

In the following code there is an initialization of A objects with template argument deduction using two forms distinct by the type of braces:

I am having issues accessing the value of a 2-dimensional hash. From what I can tell online, it should be something like: %myHash{"key1"}{"key2"} #Returns value

However, I am getting the error: "Type Array does not support associative indexing."

Here's a Minimal Reproducible Example.