3 ms·
The other day I had a senior developer tell me that he uses assert to perform critical security checks (eg input validation logic, size of input less than size
by Rygian 2y ago
The other day I had a senior developer tell me that he uses assert to perform critical security checks (eg input validation logic, size of input less than size of buffer, ...) and therefore his code is secure.
I asked if the compiler preserved the asserts when not compiling in debug mode.
- snovv_crash 2y agoEven if it did, DoS is still a valid security issue that can be exploited.
- tomsmeding 2y ago> I asked if the compiler preserved the asserts when not compiling in debug mode. What was the answer?
- jbverschoor 2y agoDepends on language/platform
- rurban 2y agoGuy really had no idea about -DNDEBUG?
- 4hg4ufxhy 2y agoI wonder which option OP is implying is an issue. Either functionality is perfectly valid software engineering. I for one prefer to keep asserts in production code to fail fast. Depending on the language and domain of the program you may or may not catch them with logging to keep the program running.
- Rygian 2y agoUsing assertions to validate malicious input is not a valid software engineering choice, unless one can guarantee that the assertions will always be active in the production code.
- wojciii 2y agoI spent a few hours debugging once because my code was built without asserts and I asserted that a function call in C returned true. So this is something that one needs to be careful about and perhaps run integration/system tests with release builds.