Skip to content

G-8310: Always validate input parameter size by assigning the parameter to a size limited variable in the declaration section of program unit.

Minor

Maintainability, Reliability, Reusability, Testability

Reason

This technique raises an error (value_error) which may not be handled in the called program unit. This is the right way to do it, as the error is not within this unit but when calling it, so the caller should handle the error.

Example (bad)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
create or replace package body department_api is
   function dept_by_name(in_dept_name in departments.department_name%type)
      return departments%rowtype is
      r_return departments%rowtype;
   begin
      if in_dept_name is null or length(in_dept_name) > 20 then
         raise err.e_param_to_large;
      end if;
      -- get the department by name
      select *
        into r_return
        from departments
       where department_name = in_dept_name;

      return r_return;
   end dept_by_name;
end department_api;
/

Example (good)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
create or replace package body department_api is
   function dept_by_name(in_dept_name in departments.department_name%type)
      return departments%rowtype is
      l_dept_name departments.department_name%type not null := in_dept_name;
      r_return    departments%rowtype;
   begin
      -- get the department by name
      select *
        into r_return
        from departments
       where department_name = l_dept_name;

      return r_return;
   end dept_by_name;
end department_api;
/

The exception should be handled where the function is called, like this:

1
2
3
4
5
6
7
8
9
begin
   pre_processing;
   r_department := department_api.dept_by_name('Far to long name of a department');
   post_processing;
exception
   when value_error then
      handle_error;
end;
/