Close Menu
    DevStackTipsDevStackTips
    • Home
    • News & Updates
      1. Tech & Work
      2. View All

      Coded Smorgasbord: High Strung

      September 26, 2025

      Chainguard launches trusted collection of verified JavaScript libraries

      September 26, 2025

      CData launches Connect AI to provide agents access to enterprise data sources

      September 26, 2025

      PostgreSQL 18 adds asynchronous I/O to improve performance

      September 26, 2025

      Distribution Release: Neptune 9.0

      September 25, 2025

      Distribution Release: Kali Linux 2025.3

      September 23, 2025

      Distribution Release: SysLinuxOS 13

      September 23, 2025

      Development Release: MX Linux 25 Beta 1

      September 22, 2025
    • Development
      1. Algorithms & Data Structures
      2. Artificial Intelligence
      3. Back-End Development
      4. Databases
      5. Front-End Development
      6. Libraries & Frameworks
      7. Machine Learning
      8. Security
      9. Software Engineering
      10. Tools & IDEs
      11. Web Design
      12. Web Development
      13. Web Security
      14. Programming Languages
        • PHP
        • JavaScript
      Featured

      PHP 8.5.0 RC 1 available for testing

      September 26, 2025
      Recent

      PHP 8.5.0 RC 1 available for testing

      September 26, 2025

      Terraform Code Generator Using Ollama and CodeGemma

      September 26, 2025

      Beyond Denial: How AI Concierge Services Can Transform Healthcare from Reactive to Proactive

      September 25, 2025
    • Operating Systems
      1. Windows
      2. Linux
      3. macOS
      Featured

      Distribution Release: Neptune 9.0

      September 25, 2025
      Recent

      Distribution Release: Neptune 9.0

      September 25, 2025

      FOSS Weekly #25.39: Kill Switch Phones, LMDE 7, Zorin OS 18 Beta, Polybar, Apt History and More Linux Stuff

      September 25, 2025

      Distribution Release: Kali Linux 2025.3

      September 23, 2025
    • Learning Resources
      • Books
      • Cheatsheets
      • Tutorials & Guides
    Home»Tech & Work»Coded Smorgasbord: High Strung

    Coded Smorgasbord: High Strung

    September 26, 2025

    Most languages these days have some variation of “is string null or empty” as a convenience function. Certainly, C#, the language we’re looking at today does. Let’s look at a few example of how this can go wrong, from different developers.

    We start with an example from Jason, which is useless, but not a true WTF:

    <span class="hljs-comment"><span class="hljs-doctag">///</span> <span class="hljs-doctag"><summary></span></span>
    <span class="hljs-comment"><span class="hljs-doctag">///</span> Does the given string contain any characters?</span>
    <span class="hljs-comment"><span class="hljs-doctag">///</span> <span class="hljs-doctag"></summary></span></span>
    <span class="hljs-comment"><span class="hljs-doctag">///</span> <span class="hljs-doctag"><param name="strToCheck"></span>String to check<span class="hljs-doctag"></param></span></span>
    <span class="hljs-comment"><span class="hljs-doctag">///</span> <span class="hljs-doctag"><returns></span></span>
    <span class="hljs-comment"><span class="hljs-doctag">///</span> true - String contains some characters.</span>
    <span class="hljs-comment"><span class="hljs-doctag">///</span> false - String is null or empty.</span>
    <span class="hljs-comment"><span class="hljs-doctag">///</span> <span class="hljs-doctag"></returns></span></span>
    <span class="hljs-function"><span class="hljs-keyword">public</span> <span class="hljs-keyword">static</span> <span class="hljs-built_in">bool</span> <span class="hljs-title">StringValid</span>(<span class="hljs-params"><span class="hljs-built_in">string</span> strToCheck</span>)</span>
    {
            <span class="hljs-keyword">if</span> ((strToCheck == <span class="hljs-literal">null</span>) ||
                    (strToCheck == <span class="hljs-built_in">string</span>.Empty))
                    <span class="hljs-keyword">return</span> <span class="hljs-literal">false</span>;
    
            <span class="hljs-keyword">return</span> <span class="hljs-literal">true</span>;
    }
    

    Obviously, a better solution here would be to simply return the boolean expression instead of using a conditional, but equally obvious, the even better solution would be to use the built-in. But as implementations go, this doesn’t completely lose the plot. It’s bad, it shouldn’t exist, but it’s barely a WTF. How can we make this worse?

    Well, Derek sends us an example line, which is scattered through the codebase.

    <span class="hljs-keyword">if</span> (Port==<span class="hljs-literal">null</span> || <span class="hljs-string">""</span>.Equals(Port)) { <span class="hljs-comment">/* do stuff */</span>}
    

    Yes, it’s frequently done as a one-liner, like this, with the do stuff jammed all together. And yes, the variable is frequently different- it’s likely the developer responsible saved this bit of code as a snippet so they could easily drop it in anywhere. And they dropped it in everywhere. Any place a string got touched in the code, this pattern reared its head.

    I especially like the "".Equals call, which is certainly valid, but inverted from how most people would think about doing the check. It echos Python’s string join function, which is invoked on the join character (and not the string being joined), which makes me wonder if that’s where this developer started out?

    I’ll never know.

    Finally, let’s poke at one from Malfist. We jump over to Java for this one. Malfist saw a function called checkNull and foolishly assumed that it returned a boolean if a string was null.

    <span class="hljs-function"><span class="hljs-keyword">public</span> <span class="hljs-keyword">static</span> final String <span class="hljs-title">checkNull</span>(<span class="hljs-params">String str, String defaultStr</span>)</span>
    {
        <span class="hljs-keyword">if</span> (str == <span class="hljs-literal">null</span>)
            <span class="hljs-keyword">return</span> defaultStr ;
        <span class="hljs-keyword">else</span>
            <span class="hljs-keyword">return</span> str.trim() ;
    }
    

    No, it’s not actually a check. It’s a coalesce function. Okay, misleading names aside, what is wrong with it? Well, for my money, the fact that the non-null input string gets trimmed, but the default string does not. With the bonus points that this does nothing to verify that the default string isn’t null, which means this could easily still propagate null reference exceptions in unexpected places.

    I’ve said it before, and I’ll say it again: strings were a mistake. We should just abolish them. No more text, everybody, we’re done.

    [Advertisement]
    Keep the plebs out of prod. Restrict NuGet feed privileges with ProGet. Learn more.

    Source: Read More 

    news
    Facebook Twitter Reddit Email Copy Link
    Previous ArticleChainguard launches trusted collection of verified JavaScript libraries
    Next Article Terraform Code Generator Using Ollama and CodeGemma

    Related Posts

    Tech & Work

    Chainguard launches trusted collection of verified JavaScript libraries

    September 26, 2025
    Tech & Work

    CData launches Connect AI to provide agents access to enterprise data sources

    September 26, 2025
    Leave A Reply Cancel Reply

    For security, use of Google's reCAPTCHA service is required which is subject to the Google Privacy Policy and Terms of Use.

    Continue Reading

    Make Every Day Count (May 2025 Wallpapers Edition)

    Tech & Work

    CVE-2025-7921 – Askey Modem Stack-Based Buffer Overflow

    Common Vulnerabilities and Exposures (CVEs)

    Supercharge your AI workflows by connecting to SageMaker Studio from Visual Studio Code

    Machine Learning

    These stackable toolkits have a compact design that looks great in my workshop

    News & Updates

    Highlights

    CVE-2025-40598 – HPE SMA100 Series Reflected Cross-Site Scripting (XSS)

    July 23, 2025

    CVE ID : CVE-2025-40598

    Published : July 23, 2025, 3:15 p.m. | 7 hours, 50 minutes ago

    Description : A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code.

    Severity: 6.1 | MEDIUM

    Visit the link for more details, such as CVSS details, affected products, timeline, and more…

    VS meldt actief misbruik van kritiek lek in Erlang Erlang/OTP SSH Server

    June 10, 2025

    How to Break Free from Tutorial Hell: A Practical Guide

    August 28, 2025

    CVE-2025-48073 – OpenEXR NULL Pointer Dereference Vulnerability

    July 31, 2025
    © DevStackTips 2025. All rights reserved.
    • Contact
    • Privacy Policy

    Type above and press Enter to search. Press Esc to cancel.