remy porter remy escaped the enterprise world and now works as a consultant. editor-in-chief for tdwtf. 




florian <u+2019>s office has a <u+201c>rule of ten<u+201d>. well, they don<u+2019>t , but one of florian<u+2019>s co-workers seems to think so. this co-worker has lots of thoughts . for example, they wrote this block, which is supposed to replace certain characters with some other characters. sbyte sbcount = 0; // set value of new field content to old value snewfieldcontent = sfieldcontent; while (rfieldidentifierregex.match(snewfieldcontent).success) { // for security reasons if (++sbcount > 10) break; // get identifier and name string sactfieldsymbol = rfieldidentifierregex.match(snewfieldcontent).groups[1].value; string sactfieldname = rfieldidentifierregex.match(snewfieldcontent).groups[2].value; string sactfieldidentifier = sactfieldsymbol + sactfieldname; // default value for unknown fields is an empty string string svalue = ""; [... calculate actual replacement value ...] // replace value for placeholder in new field content snewfieldcontent = snewfieldcontent.replace(sactfieldidentifier, svalue); } 




as florian puts it: 




having more matches than 10 inside one line is obviously a security risk (it isn<u+2019>t) and must be prohibited (it mustn<u+2019>t) because that would cause erroneous behavior in the application (it doesn<u+2019>t). [advertisement] infrastructure as code built from the start with first-class windows functionality and an intuitive, visual user interface. download otter today!
codesod: the rule of ten
remy porter