Defensive Programming

In today’s software-driven world, quality code is essential. One practice that significantly enhances software robustness is Defensive Programming. It’s a methodology that anticipates problems and designs systems to handle unexpected situations gracefully.

Below, we’ll explain defensive programming principles, techniques, and examples—all in TypeScript, plus a diagram to visualize the workflow. Defensive programming is a software development approach where developers anticipate errors, misuse, or unexpected inputs, and code systems to prevent failures or mitigate their impact.

It focuses on:

Predicting failures: Thinking ahead about all ways your code could fail.

Validating inputs: Ensuring that data your program receives is valid.

Minimizing assumptions: Never assuming callers or environments behave correctly.

Handling errors gracefully: Designing systems that fail safely.

Principles of Defensive Programming

1. Validate All Inputs

Never trust external input. Validate inputs thoroughly.

TypeScript Example:


function divide(a: number, b: number): number {
    if (typeof a !== 'number' || typeof b !== 'number') {
        throw new Error("Both arguments must be numbers");
    }
    if (b === 0) {
        throw new Error("Cannot divide by zero");
    }
    return a / b;
}

2. Fail Early and Clearly

Failing early helps prevent deeper bugs.


function setAge(age: number): void {
    if (age < 0 || age > 150) {
        throw new Error("Age must be between 0 and 150");
    }
    console.log(`Age set to ${age}`);
}

3. Minimize Assumptions

Don’t assume anything about other systems or users.


function processUser(user?: { name: string; email: string }) {
    if (!user || !user.name || !user.email) {
        throw new Error("Invalid user object");
    }
    console.log(`Processing ${user.name}`);
}

4. Handle Errors Gracefully

Even when errors occur, keep the system predictable.


try {
    const data = JSON.parse('invalid JSON string');
} catch (error: any) {
    console.error("Invalid JSON input:", error.message);
    alert("Please enter valid data");
}

5. Use Assertions (Development Only)

TypeScript lets you use asserts to narrow types during development.


function assertIsNumber(value: any): asserts value is number {
    if (typeof value !== 'number') {
        throw new Error("Value is not a number");
    }
}

function multiply(a: any, b: any) {
    assertIsNumber(a);
    assertIsNumber(b);
    return a * b;
}

6. Defensive Resource Management

Ensure resources are managed safely.


import * as fs from 'fs';

function readFile(filePath: string): string | null {
    try {
        const data = fs.readFileSync(filePath, 'utf-8');
        return data;
    } catch (err) {
        console.error("Failed to read file:", (err as Error).message);
        return null;
    }
}

Techniques and Practices

Input Sanitization – Remove dangerous characters or invalid inputs.

Range Checking – Ensure numeric or date values are within bounds.

Null Checks – Always verify values before usage.

Boundary Condition Handling – Handle empty arrays or off-by-one errors.

Immutable Objects – Use readonly or const where possible.

Logging and Monitoring – Keep track of unexpected situations.

Unit Testing – Test edge cases and invalid inputs.

Fail-Safe Defaults – Configure defaults that maintain safety.

Defensive Programming Workflow Diagram

Here’s a visual representation of how defensive programming works:

Benefits

Reduces bugs and crashes

Improves reliability and security

Facilitates maintenance

Provides predictable behavior

Builds user trust

Conclusion

Defensive programming is about being proactive, not paranoid. By anticipating failures, validating inputs, handling errors gracefully, and minimizing assumptions, developers can create software that is robust, secure, and maintainable.

Remember: assume things can go wrong, and write your code as if they will.