Page History

...

When defensive copying is necessary, make the defensive copies before parameter validation; validate the copies rather than the original parameters. See guideline SER07-J. Make defensive copies of private mutable components for additional information.

Noncompliant Code Example

The method AbsAdd() computes and returns the sum of the absolute value of parameters x and y. It lacks parameter validation. Consequently, it can produce incorrect results either because of integer overflow or when either or both of its arguments are Math.abs(Integer.MIN_VALUE).

public static int AbsAdd(int x, int y) {
  return Math.abs(x) + Math.abs(y);
}
AbsAdd(Integer.MIN_VALUE, 1);

Noncompliant Code Example

This noncompliant code example uses assertions to validate arguments of a public method.

...

The conditions checked by the assertions are reasonable. However, the validation code is omitted when executing with assertions turned off.

Compliant Solution

This compliant solution validates the method arguments by ensuring that values passed to Math.abs() exclude Integer.MIN_VALUE and also by checking for integer overflow. Alternatively, the addition could be performed using type long and the result of the addition stored in a local variable of type long. This alternate implementation would require a check to ensure that the resulting long can be represented in the range of the type int. Failure of this latter check would indicate that an int version of the addition would have overflowed.

public static int AbsAdd(int x, int y) {
  if((x == Integer.MIN_VALUE || y == Integer.MIN_VALUE) ||
    (x>0 && y>0 && (x > Integer.MAX_VALUE - y)) || 
    (x<0 && y<0 && (x < Integer.MIN_VALUE - y)))
      throw new IllegalArgumentException();

  return Math.abs(x) + Math.abs(y);
}

Risk Assessment

Failure to validate method parameters can result in inconsistent computations, runtime exceptions, and control flow vulnerabilities.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Bibliography

\[[Daconta 2003|AA. Bibliography#Daconta 03]\] Item 7: My Assertions Are Not Gratuitous
\[[ESA 2005|AA. Bibliography#ESA 05]\] Rule 68: Explicitly check method parameters for validity, and throw an adequate exception in case they are not valid. Do not use the assert statement for this purpose
\[[JLS 2005|AA. Bibliography#JLS 05]\] 14.10 The assert Statement

...