Lesson 9 / الدرس 9

Boundaries, where the bugs are / الحدود، حيث تكمن الأخطاء

If you only learn one technique from this course, learn this one. Almost every rule in software is a comparison, every comparison has an edge, and the edge is where somebody wrote < when they meant <=.

إن لم تتعلّم من هذه الدورة إلا أسلوبًا واحدًا فتعلّم هذا. فكل قاعدة في البرمجيات تقريبًا مقارنة، ولكل مقارنة حافة، والحافة هي حيث كتب أحدهم < وهو يقصد <=.

A rule like "you must be 18 or over" becomes one line of code with a comparison in it. Testing with 25 tells you nothing — 25 is nowhere near the decision. Testing with 40 tells you the same nothing. The only ages that carry information are 17, 18 and 19, because they are the only ones that sit either side of the line somebody had to draw.

The six values of any range

Rule	Test these	What a failure means
18 or over	17, 18, 19	A 17-year-old gets in, or an 18-year-old is refused
8 to 64 characters	7, 8, 9 … 63, 64, 65	A valid password is rejected on length
Up to 20 per page	19, 20, 21	Page 2 repeats or skips a row
File under 5 MB	5 MB exactly, 1 byte over	The limit is off by one byte, or unenforced

Below the edge, on the edge, above the edge — at each end of the range. Six values replaces the fifty you might otherwise have picked at random, and finds strictly more.

Boundaries are not only numbers

Dates. The last day of a month, the 29th of February, midnight, and the moment a clock changes for daylight saving. Every one of these has broken a real booking system.
Counts. Zero items and one item. A list built for "some" almost always says "1 results" and shows nothing at all when empty.
Money. Zero, the smallest unit, and the value that rounds badly — 0.005 in a system that keeps two decimal places.
Permissions. The user with exactly enough rights, and the one with exactly one right less. That pair is where access-control bugs live.

<form>
  <label>Quantity (1 to 20)
    <input type="number" min="1" max="20" value="1">
  </label>
  <button>Add</button>
</form>

<p>Six values carry information here: 0, 1, 2, 19, 20, 21.
Try each. Then try typing 21 instead of using the arrows.</p>

Run it and use the arrows first: they will stop you at the edges, and it will look safe. Then type the number in by hand. The browser's own limits are not the server's, and a rule enforced only in the page is not enforced.

Try it live / جرّب بنفسك

<h1>Boundaries on <em>(form name)</em></h1>

<h2>Rule 1: </h2>
<table>
  <tr><th>Value</th><th>Expected</th><th>Actual</th></tr>
  <tr><td></td><td></td><td></td></tr>
</table>

<p><em>Typed vs control:</em> </p>

Preview / المعاينة

Check yourself / اختبر نفسك

1. A rule says "you must be 18 or over". Which values are worth testing?

2. Why is a browser number box with max="20" not proof that 21 is rejected?

3. Which of these is a boundary worth testing on a booking system?

Your task / مهمتك

Find a real form with at least two rules in it — a length, a range, a maximum, anything with a number in it. Test the six boundary values of each rule and report what happened, including whether the rule held when you typed the value instead of using a control.

ابحث عن نموذج حقيقي فيه قاعدتان على الأقل — طول أو مدى أو حد أقصى، أي شيء فيه رقم. اختبر قيم الحدود الست لكل قاعدة وبلّغ بما حدث، بما في ذلك: أصمدت القاعدة حين كتبت القيمة بدل استخدام عنصر التحكم؟

Two rules, each with its six boundary values tested and recorded قاعدتان، لكل منهما قيم الحدود الست مختبَرة ومسجَّلة
Each row says what you expected as well as what happened كل صف يذكر ما توقعته وما حدث
A note saying whether typing the value behaved differently from using the control ملاحظة تقول هل اختلف سلوك كتابة القيمة عن استخدام عنصر التحكم