CodeSOD: A Secure Item
Kirill writes:
I've worked in this small company for a year, and on a daily basis I've come across things that make my eyes sink back into their sockets in fear, but mostly I've been too busy fixing them to post anything. It being my last day however, here's a classic
We'll take this one in parts. First, every element of the UI the user can navigate to is marked with an enum, defined thus:
enum UiItem { SectionA, SectionB, SectionC,...SectionG }These names are not anonymized, so already I hate it. But it's the next enum that starts my skin crawling:
enum SecurityUiItem { SectionA = UiItem.SectionA, SectionB = UiItem.SectionB, ... SectionG = UiItem.SectionG }A SecurityUiItem is a different type, but the values are identical to UiItem.
These enums are used when trying to evaluate role-based permissions for access, and that code looks like this:
if ((currentAccess.ContainsKey(SecurityUiItem.SectionA) && currentAccess[SecurityUiItem.SectionA] != AccessLevel.NoAccess)) return UiItem.SectionA; else if (!currentAccess.ContainsKey(SecurityUiItem.SectionB) || (currentAccess.ContainsKey(SecurityUiItem.SectionB) && currentAccess[SecurityUiItem.SectionB] != AccessLevel.NoAccess)) return UiItem.SectionB; else if (!currentAccess.ContainsKey(SecurityUiItem.SectionC) || (currentAccess.ContainsKey(SecurityUiItem.SectionC) && currentAccess[SecurityUiItem.SectionC] != AccessLevel.NoAccess)) return UiItem.SectionC; ..... else if (!currentAccess.ContainsKey(SecurityUiItem.SectionG) || (currentAccess.ContainsKey(SecurityUiItem.SectionG) && currentAccess[SecurityUiItem.SectionG] != AccessLevel.NoAccess)) return UiItem.SectionG; else return UiItem.Unknown;Honestly, I don't hate the idea of having one data type representing the actual UI objects and a separate data type which represents permissions, and having a function which can map between these two things. But this is a perfect example of a good idea executed poorly.
I also have to wonder about the fall-through pattern. If I have access to SectionA, I only seem to get SectionA out of this function. Are these permissions hierarchical? I have no idea, but I suspect there's a WTF underpinning this whole thing.
Congratulations on Kirill's last day.
[Advertisement] Picking up NuGet is easy. Getting good at it takes time. Download our guide to learn the best practice of NuGet for the Enterprise.Calor delivered 400 litres of gas I didn't want, now it's chasing a £437 payment: CRANE ON THE CASE
Five tips for bidding at auction houses online and bagging bargains: LEE BOYCE
MILLIONS of motorists could be driving unsafe vehicles because they ignore mechanics' recommendations
Simple trick to give your radiators a new lease of life and cut your energy bills
Hey noob, that's so poggers! Teen slang decoded for the rest of us
Kerry Katona brands her former accountant a 'manipulating liar' as he is jailed for conning 1,200 people after posing as a barrister and personal insolvency practitioner
5 pets at RSPCA Essex who are searching for their forever homes
Victims of Braintree 'rogue' handyman say they will 'never trust people again'
Braintree 'rogue handyman' who took £42,000 of deposits sentenced in Cardiff
Burlesque dancer thrilled after Valentines Day show 'went down a storm'
Blur legend Graham Coxon & musician Rose Elinor Dougall on coming to Colchester
5 pets at RSPCA Essex who are searching for their forever homes
Chelmsford mosque shares Ramadan timetable 2025 for prayers and meals
Primark's 'neutral' trench coats and trousers that fans say are 'amazing'
Blackwell Is The Fastest Ramping Compute Engine In Nvidia’s History
With the months-long blip in manufacturing that delayed the “Blackwell” B100 and B200 generations of GPUs in the rear view mirror and nerves more calm about the potential threat that the techniques used in the AI models of Chinese startup DeepSeek better understood, Nvidia’s final quarter of its fiscal 2025 and its projections for continuing sequential growth in fiscal 2026 will bring joy to Wall Street. …
Blackwell Is The Fastest Ramping Compute Engine In Nvidia’s History was written by Timothy Prickett Morgan at The Next Platform.
Tokyo Is Turning To a 4-Day Workweek To Shed 'World's Oldest Population' Title
Read more of this story at Slashdot.