Defensive vs Offensive — Find the Bug¶

12 buggy snippets where the bug is a misjudgment about defense. Either the code defends in the wrong place (so a real bug slips through or hides), or it fails-fast where it should degrade — and degrades where it should fail-fast. Find the wrong call before reading the answer.

The hard part of defensive vs offensive programming is not whether to validate — it's where and how loudly. Validate at the trust boundary and you stay clean. Validate everywhere and you mask the bug's origin. Fail fast on a programmer error and you find it in seconds; "fail safe" on the same error and you ship corruption to production. Each snippet below makes exactly one of these calls wrong.

Table of Contents¶

1. Snippet 1 — Assertion as the only validation (Python) · Medium
2. Snippet 2 — The catch-all that ate the bug (Java) · Easy
3. Snippet 3 — Trust boundary with no validation (Go) · Medium
4. Snippet 4 — Over-defensive null check returns a lie (Java) · Medium
5. Snippet 5 — One bad record crashes the whole batch (Python) · Easy
6. Snippet 6 — Caller and callee both check, and disagree (Go) · Hard
7. Snippet 7 — Internal trust applied to external input (Java) · Medium
8. Snippet 8 — Postel too liberal: lenient parser, broken downstream (Python) · Hard
9. Snippet 9 — Swallowed error leaves a half-written state (Go) · Medium
10. Snippet 10 — Defensive default hides a configuration bug (Java) · Medium
11. Snippet 11 — Negative quantity passes the guard (Go) · Hard
12. Snippet 12 — Clamping input that should have been rejected (Python) · Hard

How to Use¶

For each snippet:

1. Read the code and ask the single diagnostic question: does this code defend in the right place, and does it fail at the right volume? A guard in the wrong layer is worse than no guard — it hides the bug's origin. A try/catch that swallows a NullPointerException turns a five-minute stack trace into a week of corrupted-data forensics.
2. Decide: should this point fail fast (programmer error, broken invariant, corrupt input you can't safely interpret) or degrade gracefully (one bad item in a batch, an optional feature, a recoverable transient fault)?
3. Open the answer. Each gives the bug, the defensive/offensive misjudgment behind it, and the fix.

The mental model:

Snippet 1 — Assertion as the only validation (Python)¶

Difficulty: Medium

def withdraw(account: Account, amount: int) -> None:
    # amount comes from the public /withdraw HTTP endpoint
    assert amount > 0, "amount must be positive"
    assert amount <= account.balance, "insufficient funds"
    account.balance -= amount
    ledger.record(account.id, -amount)


# Deployed with: python -O server.py   (production runs optimized)

Where is the bug?

class WithdrawalError(ValueError):
    pass

def withdraw(account: Account, amount: int) -> None:
    if amount <= 0:
        raise WithdrawalError("amount must be positive")
    if amount > account.balance:
        raise WithdrawalError("insufficient funds")
    account.balance -= amount
    ledger.record(account.id, -amount)

Snippet 2 — The catch-all that ate the bug (Java)¶

Difficulty: Easy

public BigDecimal computeInvoiceTotal(Invoice invoice) {
    try {
        BigDecimal total = BigDecimal.ZERO;
        for (LineItem item : invoice.getLineItems()) {
            total = total.add(item.getUnitPrice()
                .multiply(BigDecimal.valueOf(item.getQuantity())));
        }
        return total.add(computeTax(total, invoice.getRegion()));
    } catch (Exception e) {
        log.warn("Could not compute total, defaulting to zero");
        return BigDecimal.ZERO;
    }
}

Where is the bug?

public BigDecimal computeInvoiceTotal(Invoice invoice) {
    Objects.requireNonNull(invoice, "invoice");
    BigDecimal total = BigDecimal.ZERO;
    for (LineItem item : invoice.getLineItems()) {
        total = total.add(item.getUnitPrice()
            .multiply(BigDecimal.valueOf(item.getQuantity())));
    }
    return total.add(computeTax(total, invoice.getRegion()));
}

Snippet 3 — Trust boundary with no validation (Go)¶

Difficulty: Medium

type CreateOrderRequest struct {
    ProductID string `json:"product_id"`
    Quantity  int    `json:"quantity"`
    Note      string `json:"note"`
}

func handleCreateOrder(w http.ResponseWriter, r *http.Request) {
    var req CreateOrderRequest
    json.NewDecoder(r.Body).Decode(&req)

    // build the SKU lookup and reserve inventory
    sku := fmt.Sprintf("SKU-%s", req.ProductID)
    db.Exec("UPDATE inventory SET reserved = reserved + " +
        strconv.Itoa(req.Quantity) + " WHERE sku = '" + sku + "'")

    saveOrder(req.ProductID, req.Quantity, req.Note)
    w.WriteHeader(http.StatusCreated)
}

Where is the bug?

func handleCreateOrder(w http.ResponseWriter, r *http.Request) {
    var req CreateOrderRequest
    if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
        http.Error(w, "invalid JSON", http.StatusBadRequest)
        return
    }
    if !validProductID(req.ProductID) { // e.g. ^[A-Z0-9-]{1,32}$
        http.Error(w, "invalid product_id", http.StatusBadRequest)
        return
    }
    if req.Quantity <= 0 || req.Quantity > maxOrderQuantity {
        http.Error(w, "quantity out of range", http.StatusBadRequest)
        return
    }

    sku := "SKU-" + req.ProductID
    if _, err := db.Exec(
        "UPDATE inventory SET reserved = reserved + $1 WHERE sku = $2",
        req.Quantity, sku,
    ); err != nil {
        http.Error(w, "internal error", http.StatusInternalServerError)
        return
    }
    saveOrder(req.ProductID, req.Quantity, req.Note)
    w.WriteHeader(http.StatusCreated)
}

Snippet 4 — Over-defensive null check returns a lie (Java)¶

Difficulty: Medium

public Money priceFor(String productId) {
    Product product = catalog.lookup(productId);
    if (product == null) {
        // be defensive — don't NPE
        return Money.ZERO;
    }
    return product.getPrice();
}

// Caller:
Money price = priceFor(cartItem.getProductId());
cart.addCharge(price);   // adds $0.00 if the product wasn't found

Where is the bug?

public Money priceFor(String productId) {
    Product product = catalog.lookup(productId);
    if (product == null) {
        throw new ProductNotFoundException(productId); // loud, traceable
    }
    return product.getPrice();
}

Snippet 5 — One bad record crashes the whole batch (Python)¶

Difficulty: Easy

def import_users(csv_path: str) -> None:
    imported = 0
    with open(csv_path) as f:
        for line in f:
            name, email, age = line.strip().split(",")
            user = User(name=name, email=email, age=int(age))
            db.save(user)
            imported += 1
    log.info("Imported %d users", imported)


# Nightly job: imports a 500,000-row CSV exported from a partner system.

Where is the bug?

def import_users(csv_path: str) -> ImportReport:
    imported, failures = 0, []
    with open(csv_path) as f:
        for lineno, line in enumerate(f, start=1):
            try:
                name, email, age = parse_row(line)   # validates field count + types
                db.save(User(name=name, email=email, age=age))
                imported += 1
            except (ValueError, ValidationError) as e:
                failures.append((lineno, line.strip(), str(e)))
    log.info("Imported %d users, %d failures", imported, len(failures))
    return ImportReport(imported=imported, failures=failures)

Snippet 6 — Caller and callee both check, and disagree (Go)¶

Difficulty: Hard

// Package contract: callers must ensure offset is within [0, len(data)).
func readChunk(data []byte, offset, size int) []byte {
    // defensive: clamp to avoid panics
    if offset < 0 {
        offset = 0
    }
    if offset+size > len(data) {
        size = len(data) - offset
    }
    return data[offset : offset+size]
}

func streamFile(data []byte, ranges []Range) [][]byte {
    var chunks [][]byte
    for _, rg := range ranges {
        // caller validates per its own contract: offset must be > 0 to skip the header
        if rg.Offset <= 0 {
            continue // skip invalid range
        }
        chunks = append(chunks, readChunk(data, rg.Offset, rg.Size))
    }
    return chunks
}

Where is the bug?

// readChunk validates its full contract and returns an error.
// It is the single source of truth for what a valid (offset, size) is.
func readChunk(data []byte, offset, size int) ([]byte, error) {
    if offset < 0 || size < 0 || offset+size > len(data) {
        return nil, fmt.Errorf("range out of bounds: offset=%d size=%d len=%d",
            offset, size, len(data))
    }
    return data[offset : offset+size], nil
}

func streamFile(data []byte, ranges []Range) ([][]byte, error) {
    var chunks [][]byte
    for _, rg := range ranges {
        chunk, err := readChunk(data, rg.Offset, rg.Size)
        if err != nil {
            return nil, fmt.Errorf("range %+v: %w", rg, err) // fail fast, named cause
        }
        chunks = append(chunks, chunk)
    }
    return chunks, nil
}

Snippet 7 — Internal trust applied to external input (Java)¶

Difficulty: Medium

public class ReportController {

    // Internal admin tool, trusted callers only. Path is safe.
    public byte[] downloadReport(String filename) throws IOException {
        Path path = Paths.get("/var/reports/").resolve(filename);
        return Files.readAllBytes(path);
    }
}

// Six months later, a public endpoint is wired to the same method:
@GetMapping("/api/reports/{filename}")
public ResponseEntity<byte[]> getReport(@PathVariable String filename) throws IOException {
    return ResponseEntity.ok(reportController.downloadReport(filename));
}

Where is the bug?

public byte[] downloadReport(String filename) throws IOException {
    Path base = Paths.get("/var/reports/").toAbsolutePath().normalize();
    Path resolved = base.resolve(filename).normalize();
    if (!resolved.startsWith(base)) {
        throw new IllegalArgumentException("invalid report path: " + filename);
    }
    return Files.readAllBytes(resolved);
}

Snippet 8 — Postel too liberal: lenient parser, broken downstream (Python)¶

Difficulty: Hard

def parse_amount(raw: str) -> float:
    """Parse a monetary amount from a partner feed. Be liberal in what you accept."""
    cleaned = raw.strip().replace("$", "").replace(",", "").replace(" ", "")
    if cleaned == "":
        return 0.0
    try:
        return float(cleaned)
    except ValueError:
        # liberal: pull out whatever digits we can find
        digits = "".join(c for c in cleaned if c.isdigit() or c == ".")
        return float(digits) if digits else 0.0


# Downstream: settlement system sums parsed amounts and wires money to partners.
total = sum(parse_amount(row["amount"]) for row in feed)

Where is the bug?

from decimal import Decimal, InvalidOperation

class AmountParseError(ValueError):
    pass

_AMOUNT_RE = re.compile(r"^-?\d{1,12}(\.\d{1,2})?$")

def parse_amount(raw: str) -> Decimal:
    cleaned = raw.strip().replace(",", "")
    if not _AMOUNT_RE.match(cleaned):
        raise AmountParseError(f"unrecognized amount: {raw!r}")
    try:
        return Decimal(cleaned)
    except InvalidOperation:
        raise AmountParseError(f"unrecognized amount: {raw!r}")

Snippet 9 — Swallowed error leaves a half-written state (Go)¶

Difficulty: Medium

func (s *AccountService) Transfer(from, to string, amount int64) {
    s.debit(from, amount)

    if err := s.credit(to, amount); err != nil {
        // be resilient — log and move on so the request doesn't fail
        log.Printf("credit failed for %s: %v", to, err)
    }
}

Where is the bug?

func (s *AccountService) Transfer(from, to string, amount int64) error {
    return s.db.WithTx(func(tx *Tx) error {
        if err := s.debit(tx, from, amount); err != nil {
            return fmt.Errorf("debit %s: %w", from, err)
        }
        if err := s.credit(tx, to, amount); err != nil {
            return fmt.Errorf("credit %s: %w", to, err) // tx rolls back the debit
        }
        return nil
    })
}

Snippet 10 — Defensive default hides a configuration bug (Java)¶

Difficulty: Medium

public class FeatureConfig {

    public int maxConcurrentJobs() {
        String raw = System.getenv("MAX_CONCURRENT_JOBS");
        try {
            return Integer.parseInt(raw);
        } catch (NumberFormatException | NullPointerException e) {
            // defensive: fall back to a safe default
            return 4;
        }
    }
}

Where is the bug?

public int maxConcurrentJobs() {
    String raw = System.getenv("MAX_CONCURRENT_JOBS");
    if (raw == null || raw.isBlank()) {
        return 4; // genuinely unset: default is correct
    }
    try {
        int value = Integer.parseInt(raw.trim());
        if (value < 1) {
            throw new IllegalStateException(
                "MAX_CONCURRENT_JOBS must be >= 1, got: " + value);
        }
        return value;
    } catch (NumberFormatException e) {
        throw new IllegalStateException(
            "MAX_CONCURRENT_JOBS is not a valid integer: '" + raw + "'", e);
    }
}

Snippet 11 — Negative quantity passes the guard (Go)¶

Difficulty: Hard

type CartItem struct {
    SKU      string
    Quantity int
    Price    int64 // cents
}

func validateCart(items []CartItem) error {
    for _, item := range items {
        if item.Quantity == 0 {
            return fmt.Errorf("zero quantity for %s", item.SKU)
        }
        if item.SKU == "" {
            return fmt.Errorf("missing SKU")
        }
    }
    return nil
}

func cartTotal(items []CartItem) int64 {
    var total int64
    for _, item := range items {
        total += item.Price * int64(item.Quantity)
    }
    return total
}

Where is the bug?

const maxLineQuantity = 1000

func validateCart(items []CartItem) error {
    if len(items) == 0 {
        return errors.New("empty cart")
    }
    for _, item := range items {
        if item.SKU == "" {
            return errors.New("missing SKU")
        }
        if item.Quantity < 1 || item.Quantity > maxLineQuantity {
            return fmt.Errorf("quantity out of range for %s: %d", item.SKU, item.Quantity)
        }
        if item.Price < 0 {
            return fmt.Errorf("negative price for %s", item.SKU)
        }
    }
    return nil
}

Snippet 12 — Clamping input that should have been rejected (Python)¶

Difficulty: Hard

def schedule_retry(attempt: int, base_delay: float = 2.0) -> float:
    """Exponential backoff. Clamp to a sane window so callers never get bad delays."""
    delay = base_delay * (2 ** attempt)
    # defensive: keep the delay in a reasonable range
    return max(1.0, min(delay, 300.0))


# Caller, in the retry loop:
attempt = compute_attempt_number(job)   # returns -1 when the job record is corrupt
time.sleep(schedule_retry(attempt))

Where is the bug?

def schedule_retry(attempt: int, base_delay: float = 2.0) -> float:
    if attempt < 0:
        raise ValueError(f"attempt must be >= 0, got {attempt}")
    delay = base_delay * (2 ** attempt)
    return min(delay, 300.0)   # cap the legit upper bound; no spurious lower clamp

# Caller handles the corrupt-record signal at its own boundary:
attempt = compute_attempt_number(job)
if attempt < 0:
    move_to_dead_letter(job, reason="corrupt attempt number")
else:
    time.sleep(schedule_retry(attempt))

Scorecard¶

Track which defensive/offensive misjudgment each bug represented. The recurring lesson: the bug is rarely "no check" — it's a check in the wrong place or at the wrong volume.

Scoring (spotted the bug and named the misjudgment):

• 10–12: You have the boundary map internalized — you can feel where defense belongs and where it merely hides.
• 7–9: Strong. Re-read the two you found hardest; the pattern (wrong place / wrong volume) is the same each time.
• 4–6: You're finding the symptom (wrong output) but not yet the cause (defensive misjudgment). Revisit junior.md.
• 0–3: Start with junior.md and the chapter README, then come back.

Related Topics¶

• junior.md — the foundational definitions: trust boundary, fail-fast, graceful degradation.
• tasks.md — hands-on exercises to convert wrong-place defenses into boundary validation.
• Chapter README — the positive rules for defensive vs offensive programming.
• Anti-Patterns — many of these bugs are recognized anti-patterns (catch-all, silent default).
• Refactoring — techniques for moving validation to the boundary and extracting guard clauses.