Implement template strings

crates/ruff_linter/resources/test/fixtures/flake8_bandit/S104.py

@@ -22,3 +22,8 @@ def my_func():
 
 # Implicit string concatenation
 "0.0.0.0" f"0.0.0.0{expr}0.0.0.0"
+
+# t-strings - all ok
+t"0.0.0.0"
+"0.0.0.0" t"0.0.0.0{expr}0.0.0.0"
+"0.0.0.0" f"0.0.0.0{expr}0.0.0.0" t"0.0.0.0{expr}0.0.0.0"

crates/ruff_linter/resources/test/fixtures/flake8_bandit/S108.py

@@ -40,3 +40,7 @@
 
 with TemporaryDirectory(dir="/tmp") as d:
     pass
+
+# ok (runtime error from t-string)
+with open(t"/foo/bar", "w") as f:
+    f.write("def")

crates/ruff_linter/resources/test/fixtures/flake8_bandit/S608.py

@@ -169,3 +169,13 @@ def query54():
 
 # https://github.com/astral-sh/ruff/issues/17967
 query61 = f"SELECT * FROM table" # skip expressionless f-strings
+
+# t-strings
+query62 = t"SELECT * FROM table"
+query63 = t"""
+    SELECT *,
+        foo
+    FROM ({user_input}) raw
+"""
+query64 = f"update {t"{table}"} set var = {t"{var}"}"
+query65 = t"update {f"{table}"} set var = {f"{var}"}"

crates/ruff_linter/resources/test/fixtures/flake8_pyi/PYI053.py

@@ -72,3 +72,5 @@ def not_warnings_dot_deprecated(
 
 @not_warnings_dot_deprecated("Not warnings.deprecated, so this one *should* lead to PYI053 in a stub!")
 def not_a_deprecated_function() -> None: ...
+
+baz: str = t"51 character stringgggggggggggggggggggggggggggggggg"

crates/ruff_linter/resources/test/fixtures/flake8_pyi/PYI053.pyi

@@ -80,3 +80,7 @@ x: TypeAlias = Literal["fooooooooooooooooooooooooooooooooooooooooooooooooooooooo
 
 # Ok
 y: TypeAlias = Annotated[int, "metadataaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"]
+
+ttoo: str = t"50 character stringggggggggggggggggggggggggggggggg"  # OK
+
+tbar: str = t"51 character stringgggggggggggggggggggggggggggggggg"  # Error: PYI053

crates/ruff_linter/resources/test/fixtures/flake8_quotes/doubles_escaped.py

@@ -39,3 +39,27 @@
 f'\'normal\' {f'nested'} "double quotes"'
 f'\'normal\' {f'\'nested\' {'other'} normal'} "double quotes"'  # Q003
 f'\'normal\' {f'\'nested\' {'other'} "double quotes"'} normal'  # Q00l
+
+
+
+# Same as above, but with t-strings
+t'This is a \'string\''  # Q003
+t'This is \\ a \\\'string\''  # Q003
+t'"This" is a \'string\''
+f"This is a 'string'"
+f"\"This\" is a 'string'"
+fr'This is a \'string\''
+fR'This is a \'string\''
+foo = (
+    t'This is a'
+    t'\'string\''  # Q003
+)
+t'\'foo\' {'nested'}'  # Q003
+t'\'foo\' {t'nested'}'  # Q003
+t'\'foo\' {t'\'nested\''} \'\''  # Q003
+
+t'normal {t'nested'} normal'
+t'\'normal\' {t'nested'} normal'  # Q003
+t'\'normal\' {t'nested'} "double quotes"'
+t'\'normal\' {t'\'nested\' {'other'} normal'} "double quotes"'  # Q003
+t'\'normal\' {t'\'nested\' {'other'} "double quotes"'} normal'  # Q00l

crates/ruff_linter/resources/test/fixtures/flake8_quotes/singles_escaped.py

@@ -37,3 +37,25 @@
 f"\"normal\" {f"nested"} 'single quotes'"
 f"\"normal\" {f"\"nested\" {"other"} normal"} 'single quotes'"  # Q003
 f"\"normal\" {f"\"nested\" {"other"} 'single quotes'"} normal"  # Q003
+
+
+# Same as above, but with t-strings
+t"This is a \"string\""
+t"'This' is a \"string\""
+f'This is a "string"'
+f'\'This\' is a "string"'
+fr"This is a \"string\""
+fR"This is a \"string\""
+foo = (
+    t"This is a"
+    t"\"string\""
+)
+t"\"foo\" {"foo"}"  # Q003
+t"\"foo\" {t"foo"}"  # Q003
+t"\"foo\" {t"\"foo\""} \"\""  # Q003
+
+t"normal {t"nested"} normal"
+t"\"normal\" {t"nested"} normal"  # Q003
+t"\"normal\" {t"nested"} 'single quotes'"
+t"\"normal\" {t"\"nested\" {"other"} normal"} 'single quotes'"  # Q003
+t"\"normal\" {t"\"nested\" {"other"} 'single quotes'"} normal"  # Q003

crates/ruff_linter/resources/test/fixtures/pycodestyle/W605_1.py

@@ -1,4 +1,4 @@
-# Same as `W605_0.py` but using f-strings instead.
+# Same as `W605_0.py` but using f-strings and t-strings instead.
 
 #: W605:1:10
 regex = f'\.png$'
@@ -66,3 +66,72 @@
 
 # Debug text (should trigger)
 t = f"{'\InHere'=}"
+
+
+
+#: W605:1:10
+regex = t'\.png$'
+
+#: W605:2:1
+regex = t'''
+\.png$
+'''
+
+#: W605:2:6
+f(
+    t'\_'
+)
+
+#: W605:4:6
+t"""
+multi-line
+literal
+with \_ somewhere
+in the middle
+"""
+
+#: W605:1:38
+value = t'new line\nand invalid escape \_ here'
+
+
+#: Okay
+regex = fr'\.png$'
+regex = t'\\.png$'
+regex = fr'''
+\.png$
+'''
+regex = fr'''
+\\.png$
+'''
+s = t'\\'
+regex = t'\w'  # noqa
+regex = t'''
+\w
+'''  # noqa
+
+regex = t'\\\_'
+value = t'\{{1}}'
+value = t'\{1}'
+value = t'{1:\}'
+value = t"{t"\{1}"}"
+value = rt"{t"\{1}"}"
+
+# Okay
+value = rt'\{{1}}'
+value = rt'\{1}'
+value = rt'{1:\}'
+value = t"{rt"\{1}"}"
+
+# Regression tests for https://github.com/astral-sh/ruff/issues/10434
+t"{{}}+-\d"
+t"\n{{}}+-\d+"
+t"\n{{}}�+-\d+"
+
+# See https://github.com/astral-sh/ruff/issues/11491
+total = 10
+ok = 7
+incomplete = 3
+s = t"TOTAL: {total}\nOK: {ok}\INCOMPLETE: {incomplete}\n"
+
+# Debug text (should trigger)
+t = t"{'\InHere'=}"

crates/ruff_linter/src/checkers/ast/mod.rs

@@ -37,8 +37,8 @@ use ruff_python_ast::str::Quote;
 use ruff_python_ast::visitor::{Visitor, walk_except_handler, walk_pattern};
 use ruff_python_ast::{
     self as ast, AnyParameterRef, ArgOrKeyword, Comprehension, ElifElseClause, ExceptHandler, Expr,
-    ExprContext, FStringElement, Keyword, MatchCase, ModModule, Parameter, Parameters, Pattern,
-    PythonVersion, Stmt, Suite, UnaryOp,
+    ExprContext, InterpolatedStringElement, Keyword, MatchCase, ModModule, Parameter, Parameters,
+    Pattern, PythonVersion, Stmt, Suite, UnaryOp,
 };
 use ruff_python_ast::{PySourceType, helpers, str, visitor};
 use ruff_python_codegen::{Generator, Stylist};
@@ -338,6 +338,7 @@ impl<'a> Checker<'a> {
         ast::BytesLiteralFlags::empty().with_quote_style(self.preferred_quote())
     }
 
+    // TODO(dylan) add similar method for t-strings
     /// Return the default f-string flags a generated `FString` node should use, given where we are
     /// in the AST.
     pub(crate) fn default_fstring_flags(&self) -> ast::FStringFlags {
@@ -1907,6 +1908,10 @@ impl<'a> Visitor<'a> for Checker<'a> {
                 self.semantic.flags |= SemanticModelFlags::F_STRING;
                 visitor::walk_expr(self, expr);
             }
+            Expr::TString(_) => {
+                self.semantic.flags |= SemanticModelFlags::T_STRING;
+                visitor::walk_expr(self, expr);
+            }
             Expr::Named(ast::ExprNamed {
                 target,
                 value,
@@ -1940,6 +1945,7 @@ impl<'a> Visitor<'a> for Checker<'a> {
             }
             Expr::BytesLiteral(bytes_literal) => analyze::string_like(bytes_literal.into(), self),
             Expr::FString(f_string) => analyze::string_like(f_string.into(), self),
+            Expr::TString(t_string) => analyze::string_like(t_string.into(), self),
             _ => {}
         }
 
@@ -2129,12 +2135,15 @@ impl<'a> Visitor<'a> for Checker<'a> {
         }
     }
 
-    fn visit_f_string_element(&mut self, f_string_element: &'a FStringElement) {
+    fn visit_interpolated_string_element(
+        &mut self,
+        interpolated_string_element: &'a InterpolatedStringElement,
+    ) {
         let snapshot = self.semantic.flags;
-        if f_string_element.is_expression() {
-            self.semantic.flags |= SemanticModelFlags::F_STRING_REPLACEMENT_FIELD;
+        if interpolated_string_element.is_interpolation() {
+            self.semantic.flags |= SemanticModelFlags::INTERPOLATED_STRING_REPLACEMENT_FIELD;
         }
-        visitor::walk_f_string_element(self, f_string_element);
+        visitor::walk_interpolated_string_element(self, interpolated_string_element);
         self.semantic.flags = snapshot;
     }
 }

crates/ruff_linter/src/rules/flake8_bandit/rules/hardcoded_bind_all_interfaces.rs

@@ -63,6 +63,9 @@ pub(crate) fn hardcoded_bind_all_interfaces(checker: &Checker, string: StringLik
                 }
             }
         }
+
         StringLike::Bytes(_) => (),
+        // TODO(dylan): decide whether to trigger here
+        StringLike::TString(_) => (),
     }
 }

crates/ruff_linter/src/rules/flake8_bandit/rules/hardcoded_sql_expression.rs

@@ -101,10 +101,11 @@ pub(crate) fn hardcoded_sql_expression(checker: &Checker, expr: &Expr) {
 
         // f"select * from table where val = {val}"
         Expr::FString(f_string)
-            if f_string
-                .value
-                .f_strings()
-                .any(|fs| fs.elements.iter().any(ast::FStringElement::is_expression)) =>
+            if f_string.value.f_strings().any(|fs| {
+                fs.elements
+                    .iter()
+                    .any(ast::InterpolatedStringElement::is_interpolation)
+            }) =>
         {
             concatenated_f_string(f_string, checker.locator())
         }
@@ -175,6 +176,8 @@ fn is_explicit_concatenation(expr: &Expr) -> Option<bool> {
         Expr::DictComp(_) => Some(false),
         Expr::Compare(_) => Some(false),
         Expr::FString(_) => Some(true),
+        // TODO(dylan): decide whether to trigger here
+        Expr::TString(_) => Some(false),
         Expr::StringLiteral(_) => Some(true),
         Expr::BytesLiteral(_) => Some(false),
         Expr::NoneLiteral(_) => Some(false),

crates/ruff_linter/src/rules/flake8_bandit/rules/hardcoded_tmp_directory.rs

@@ -75,7 +75,10 @@ pub(crate) fn hardcoded_tmp_directory(checker: &Checker, string: StringLike) {
                 }
             }
         }
+        // These are not actually strings
         StringLike::Bytes(_) => (),
+        // TODO(dylan) - verify that we should skip these
+        StringLike::TString(_) => (),
     }
 }
 

crates/ruff_linter/src/rules/flake8_bandit/rules/suspicious_function_call.rs

@@ -1006,9 +1006,9 @@ fn suspicious_function(
             // Ex) f"foo"
             Expr::FString(ast::ExprFString { value, .. }) => {
                 value.elements().next().and_then(|element| {
-                    if let ast::FStringElement::Literal(ast::FStringLiteralElement {
-                        value, ..
-                    }) = element
+                    if let ast::InterpolatedStringElement::Literal(
+                        ast::InterpolatedStringLiteralElement { value, .. },
+                    ) = element
                     {
                         Some(Either::Right(value.chars()))
                     } else {

crates/ruff_linter/src/rules/flake8_bandit/snapshots/ruff_linter__rules__flake8_bandit__tests__S104_S104.py.snap

@@ -1,6 +1,5 @@
 ---
 source: crates/ruff_linter/src/rules/flake8_bandit/mod.rs
-snapshot_kind: text
 ---
 S104.py:9:1: S104 Possible binding to all interfaces
    |
@@ -48,18 +47,24 @@ S104.py:24:1: S104 Possible binding to all interfaces
 23 | # Implicit string concatenation
 24 | "0.0.0.0" f"0.0.0.0{expr}0.0.0.0"
    | ^^^^^^^^^ S104
+25 |
+26 | # t-strings - all ok
    |
 
 S104.py:24:13: S104 Possible binding to all interfaces
    |
 23 | # Implicit string concatenation
 24 | "0.0.0.0" f"0.0.0.0{expr}0.0.0.0"
    |             ^^^^^^^ S104
+25 |
+26 | # t-strings - all ok
    |
 
 S104.py:24:26: S104 Possible binding to all interfaces
    |
 23 | # Implicit string concatenation
 24 | "0.0.0.0" f"0.0.0.0{expr}0.0.0.0"
    |                          ^^^^^^^ S104
+25 |
+26 | # t-strings - all ok
    |

crates/ruff_linter/src/rules/flake8_bandit/snapshots/ruff_linter__rules__flake8_bandit__tests__S608_S608.py.snap

@@ -604,3 +604,12 @@ S608.py:164:11: S608 Possible SQL injection vector through string-based query co
 169 |
 170 |   # https://github.com/astral-sh/ruff/issues/17967
     |
+
+S608.py:180:11: S608 Possible SQL injection vector through string-based query construction
+    |
+178 |     FROM ({user_input}) raw
+179 | """
+180 | query64 = f"update {t"{table}"} set var = {t"{var}"}"
+    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ S608
+181 | query65 = t"update {f"{table}"} set var = {f"{var}"}"
+    |

crates/ruff_linter/src/rules/flake8_pyi/rules/string_or_bytes_too_long.rs

@@ -67,6 +67,11 @@ pub(crate) fn string_or_bytes_too_long(checker: &Checker, string: StringLike) {
         StringLike::String(ast::ExprStringLiteral { value, .. }) => value.chars().count(),
         StringLike::Bytes(ast::ExprBytesLiteral { value, .. }) => value.len(),
         StringLike::FString(node) => count_f_string_chars(node),
+        // TODO(dylan): decide how to count chars, especially
+        // if interpolations are of different type than `str`
+        StringLike::TString(_) => {
+            return;
+        }
     };
     if length <= 50 {
         return;
@@ -91,8 +96,10 @@ fn count_f_string_chars(f_string: &ast::ExprFString) -> usize {
                 .elements
                 .iter()
                 .map(|element| match element {
-                    ast::FStringElement::Literal(string) => string.chars().count(),
-                    ast::FStringElement::Expression(expr) => expr.range().len().to_usize(),
+                    ast::InterpolatedStringElement::Literal(string) => string.chars().count(),
+                    ast::InterpolatedStringElement::Interpolation(expr) => {
+                        expr.range().len().to_usize()
+                    }
                 })
                 .sum(),
         })

crates/ruff_linter/src/rules/flake8_pytest_style/rules/helpers.rs

@@ -106,19 +106,23 @@ pub(super) fn is_empty_or_null_string(expr: &Expr) -> bool {
                 ast::FStringPart::FString(f_string) => f_string
                     .elements
                     .iter()
-                    .all(is_empty_or_null_fstring_element),
+                    .all(is_empty_or_null_interpolated_string_element),
             })
         }
         _ => false,
     }
 }
 
-fn is_empty_or_null_fstring_element(element: &ast::FStringElement) -> bool {
+fn is_empty_or_null_interpolated_string_element(element: &ast::InterpolatedStringElement) -> bool {
     match element {
-        ast::FStringElement::Literal(ast::FStringLiteralElement { value, .. }) => value.is_empty(),
-        ast::FStringElement::Expression(ast::FStringExpressionElement { expression, .. }) => {
-            is_empty_or_null_string(expression)
-        }
+        ast::InterpolatedStringElement::Literal(ast::InterpolatedStringLiteralElement {
+            value,
+            ..
+        }) => value.is_empty(),
+        ast::InterpolatedStringElement::Interpolation(ast::InterpolatedElement {
+            expression,
+            ..
+        }) => is_empty_or_null_string(expression),
     }
 }