A10:2025 - 异常条件处理不当

# ❌ 生产环境显示详细错误
Error: SQL syntax error near 'SELECT * FROM users WHERE password='abc'
Database: mysql://root:password@localhost/prod

# ✅ 应显示通用错误
An error occurred. Please try again later.

# ❌ 未捕获异常导致系统崩溃
def process_payment(amount):
    result = db.charge(amount)  # 可能抛出异常
    return result
# 未处理异常，应用崩溃

# ✅ 正确：捕获并处理异常
def process_payment(amount):
    try:
        result = db.charge(amount)
        return result
    except PaymentError as e:
        log_error(e)
        return {"error": "Payment failed"}

# ❌ 未检查边界条件
def transfer(from_account, to_account, amount):
    from_account.balance -= amount  # 可能为负数
    to_account.balance += amount

# ✅ 正确：验证边界条件
def transfer(from_account, to_account, amount):
    if amount <= 0 or from_account.balance < amount:
        raise ValueError("Invalid transfer")
    ...

# 生产环境显示通用错误
@app.errorhandler(Exception)
def handle_error(error):
    log_error(error)  # 记录详细错误
    return render_template('error.html'), 500  # 显示通用页面

# 捕获并处理所有异常
try:
    process_data()
except SpecificError as e:
    handle_specific(e)
except Exception as e:
    log_error(e)
    show_user_friendly_message()

# 验证所有输入和边界条件
def process_request(data):
    if not data or not isinstance(data, dict):
        raise ValueError("Invalid input")
    if data.get('amount', 0) <= 0:
        raise ValueError("Amount must be positive")
    ...

# 发送异常输入触发错误
curl -X POST /api/data -d '{"invalid": null}'
curl -X POST /api/data -d '{"amount": -999999}'

# 测试边界值
test_cases = [0, -1, 999999999, None, "", "a"*10000]

# 测试资源限制
# 发送大量请求
# 上传大文件