Enterprise Library Test Guide - Willy .Net

Testing for Security Best Practices 149
Table 36: Exception Management Checklist
Check
Yes
Yes
Yes
Yes
Description
Use exception handling. Catch only the exceptions that you have anticipated in your
design. Exceptions to this rule are exceptions that are not Common Language Specification
(CLS)-compliant. (These are exceptions that do not derive from the .NET Framework
System.Exception namespace.) These exceptions can occur if the application block
uses a customer-supplied extension of if there is a call to unmanaged code. The application
block should include a generic catch handler for these situations. (In C#, this
takes the form of catch{ ... }). The inability to handle non-CLS-compliant exceptions may
leave the application block vulnerable to denial of service attacks.
An example of this situation is when the Data Access Application Block attempts to
use a custom database class that is included in the configuration source. The following
code example shows how to handle any non-CLS-compliant exceptions that may occur.
private static void TryLogConfigurationError(ConfigurationErrorsException
configurationException, string instanceName)
{
try
{
DefaultDataEventLogger eventLogger = EnterpriseLibraryFactory.BuildUp();
if (eventLogger != null)
{
eventLogger.LogConfigurationError(configurationExcepti
on, instanceName);
}
}
catch { }
}
Log the details of the exceptions to assist in diagnosing problems.
All code paths that can result in an exception should provide a way to first check for a
successful outcome before throwing an exception. In the following code example, the
code first checks to see that the configuration file exists and is valid before it throws an
exception.
Public FileConfigurationSource(string configurationFilepath)
{
if (string.IsNullOrEmpty(configurationFilepath)) throw new
ArgumentException(Resources.ExceptionStringNullOrEmpty,
"configurationFilepath");
this.configurationFilepath =
RootConfigurationFilePath(configurationFilepath);
if (!File.Exists(this.configurationFilepath)) throw new
FileNotFoundException(string.Format(Resources.Culture,
Resources.ExceptionConfigurationLoadFileNotFound,
this.configurationFilepath));
EnsureImplementation(this.configurationFilepath);
}
If there is a problem, an exception should occur as early as possible to avoid needlessly
using any more resources.