Page History

Diagnostic tests can be incorporated into programs by using the assert statement. Assertions are primarily intended for use during debugging and are usually often turned off before code is deployed by using the -disableassertions (or -da) java runtime option. Consequently, assertions should be used to protect against incorrect programmer assumptions and not for runtime error checking.

...

Code that protects against an input/output error, for example, cannot be implemented as an assertion because it must be present in the deployed executable.

In particular, assertions are generally unsuitable for server programs or embedded systems in deployment. A failed assertion can lead to a denial-of-service (DoS) attack if triggered by a malicious user. In such situations, a soft failure mode, such as writing to a log file and rejecting the request, is more appropriate.

Noncompliant Code Example

This noncompliant code example uses the assert statement to verify that input was available. 

...

Because input availability depends on the user and can be exhausted at any point during program execution, a robust program must be prepared to gracefully handle and recover from the unavailability of input. However, using the assert statement to verify that some significant input was available is inappropriate because it might lead to an abrupt termination of the process, exposing a DoS vulnerability.

Compliant Solution

This compliant solution demonstrates the recommended way to detect and handle unavailability of input.

BufferedReader br;

// Set up the BufferedReader br

String line;

// ...

line = br.readLine();

if (line == null) {
  // handle error
}

Applicability

Assertions are a valuable diagnostic tool for finding and eliminating software defects that may result in vulnerabilities. The absence of assertions, however, does not mean that code is incorrect.

In general, the misuse of the assert statement for runtime checking rather than checking for logical errors cannot be detected automatically.

Bibliography

...