Page History

Wiki Markup Never use assertions to validate parameters arguments of public methods. According to the Java Language Specification \[[JLS 2005|AA. Bibliography#JLS 05]\], §14 The Java Language Specification, §14.10, "The {{assert}} Statement," Statement" [JLS 2015], states that

Along similar lines, assertions should not be used for argument - checking in public methods. Argument - checking is typically part of the contract of a method, and this contract must be upheld whether assertions are enabled or disabled.

Another A secondary problem with using assertions for argument checking is that erroneous arguments should result in an appropriate runtime run-time exception (such as IllegalArgumentException, IndexOutOfBoundsException, or NullPointerException). An assertion failure will not throw an appropriate exception.

Noncompliant Code Example

The method AbsAddgetAbsAdd() computes and returns the sum of the absolute value of parameters x and y. It lacks parameter argument validation, in violation of MET00-J. Validate method arguments. Consequently, it can produce incorrect results either because of integer overflow or when either or both of its arguments are Math.abs(Integer.MIN_VALUE).

public static int AbsAddgetAbsAdd(int x, int y) {
  return Math.abs(x) + Math.abs(y);
}
AbsAddgetAbsAdd(Integer.MIN_VALUE, 1);

Noncompliant Code Example

This noncompliant code example uses assertions to validate arguments of a public method.:

public static int AbsAddgetAbsAdd(int x, int y) {
  assert x != Integer.MIN_VALUE;
  assert y != Integer.MIN_VALUE;
  int absX = Math.abs(x);
  int absY = Math.abs(y);
  assert (absX <= Integer.MAX_VALUE - absY);
  return absX + absY;
}

The conditions checked by the assertions are reasonable. However, the validation code is omitted not executed when executing with assertions turned offare disabled.

Compliant Solution

This compliant solution validates the method arguments by ensuring that values passed to Math.abs() exclude Integer.MIN_VALUE and also by checking for integer overflow. Alternatively, the addition could be performed using type long and the result of the addition stored in a local variable of type long. This alternate implementation would require a check to ensure that the resulting long can be represented in the range of the type int. Failure of this latter check would indicate that an int version of the addition would have overflowed.:

public static int AbsAddgetAbsAdd(int x, int y) {
  if (x == Integer.MIN_VALUE || y == Integer.MIN_VALUE) {
    throw new IllegalArgumentException();
  }
  int absX = Math.abs(x);
  int absY = Math.abs(y);
  if (absX > Integer.MAX_VALUE - absY) {
    throw new IllegalArgumentException();
  }
  return absX + absY;
}

Alternatively, the addition could be performed using type long and the result of the addition stored in a local variable of type long. This alternate implementation would require a check to ensure that the resulting long can be represented in the range of the type int. Failure of this latter check would indicate that an int version of the addition would have overflowed.

Risk Assessment

Failure Using assertions to validate method parameters arguments can result in inconsistent computations, runtime exceptions, and control flow vulnerabilities.

Related Guidelines

Bibliography

Android Implementation Details

The assert statement is supported on the Dalvik VM but is ignored under the default configuration. Assertions may be enabled by setting the system property debug.assert via adb shell setprop debug.assert 1 or by sending the command-line argument --enable-assert to the Dalvik VM.

Bibliography

...

Image Added Image Added Image Removed      05. Methods (MET)