What is the most EVIL code you have ever seen in a production enterprise environment?

Question 1

What is the most EVIL code you have ever seen in a production enterprise environment?

anti-patterns

Registered User · Jan 12, 2009 · Viewed 59.3k times · Source

Answer

Answer

Warning: Long scary post ahead

I've written about one application I've worked on before here and here. To put it simply, my company inherited 130,000 lines of garbage from India. The application was written in C#; it was a teller app, the same kind of software tellers use behind the counter whenever you go to the bank. The app crashed 40-50 times a day, and it simply couldn't be refactored into working code. My company had to re-write the entire app over the course of 12 months.

Why is this application evil? Because the sight of the source code was enough to drive a sane man mad and a mad man sane. The twisted logic used to write this application could have only been inspired by a Lovecraftian nightmare. Unique features of this application included:

Out of 130,000 lines of code, the entire application contained 5 classes (excluding form files). All of these were public static classes. One class was called Globals.cs, which contained 1000s and 1000s and 1000s of public static variables used to hold the entire state of the application. Those five classes contained 20,000 lines of code total, with the remaining code embedded in the forms.
You have to wonder, how did the programmers manage to write such a big application without any classes? What did they use to represent their data objects? It turns out the programmers managed to re-invent half of the concepts we all learned about OOP simply by combining ArrayLists, HashTables, and DataTables. We saw a lot of this:
- ArrayLists of hashtables
- Hashtables with string keys and DataRow values
- ArrayLists of DataTables
- DataRows containing ArrayLists which contained HashTables
- ArrayLists of DataRows
- ArrayLists of ArrayLists
- HashTables with string keys and HashTable values
- ArrayLists of ArrayLists of HashTables
- Every other combination of ArrayLists, HashTables, DataTables you can think of.
Keep in mind, none of the data structures above are strongly typed, so you have to cast whatever mystery object you get out of the list to the correct type. It's amazing what kind of complex, Rube Goldberg-like data structures you can create using just ArrayLists, HashTables, and DataTables.
To share an example of how to use the object model detailed above, consider Accounts: the original programmer created a seperate HashTable for each concievable property of an account: a HashTable called hstAcctExists, hstAcctNeedsOverride, hstAcctFirstName. The keys for all of those hashtables was a “|” separated string. Conceivable keys included “123456|DDA”, “24100|SVG”, “100|LNS”, etc.
Since the state of the entire application was readily accessible from global variables, the programmers found it unnecessary to pass parameters to methods. I'd say 90% of methods took 0 parameters. Of the few which did, all parameters were passed as strings for convenience, regardless of what the string represented.
Side-effect free functions did not exist. Every method modified 1 or more variables in the Globals class. Not all side-effects made sense; for example, one of the form validation methods had a mysterious side effect of calculating over and short payments on loans for whatever account was stored Globals.lngAcctNum.
Although there were lots of forms, there was one form to rule them all: frmMain.cs, which contained a whopping 20,000 lines of code. What did frmMain do? Everything. It looked up accounts, printed receipts, dispensed cash, it did everything.

Sometimes other forms needed to call methods on frmMain. Rather than factor that code out of the form into a seperate class, why not just invoke the code directly:
```
((frmMain)this.MDIParent).UpdateStatusBar(hstValues);
```
To look up accounts, the programmers did something like this:
```
bool blnAccountExists =
    new frmAccounts().GetAccountInfo().blnAccountExists
```
As bad as it already is creating an invisible form to perform business logic, how do you think the form knew which account to look up? That’s easy: the form could access Globals.lngAcctNum and Globals.strAcctType. (Who doesn't love Hungarian notation?)
Code-reuse was a synonym for ctrl-c, ctrl-v. I found 200-line methods copy/pasted across 20 forms.
The application had a bizarre threading model, something I like to call the thread-and-timer model: each form that spawned a thread had a timer on it. Each thread that was spawned kicked off a timer which had a 200 ms delay; once the timer started, it would check to see if the thread had set some magic boolean, then it would abort the thread. The resulting ThreadAbortException was swallowed.

You'd think you'd only see this pattern once, but I found it in at least 10 different places.
Speaking of threads, the keyword "lock" never appeared in the application. Threads manipulated global state freely without taking a lock.
Every method in the application contained a try/catch block. Every exception was logged and swallowed.
Who needs to switch on enums when switching on strings is just as easy!

Some genius figured out that you can hook multiple form controls up to the same event handler. How did the programmer handle this?

private void OperationButton_Click(object sender, EventArgs e)
{
    Button btn = (Button)sender;
    if (blnModeIsAddMc)
    {
        AddMcOperationKeyPress(btn);
    }
    else
    {
        string strToBeAppendedLater = string.Empty;
        if (btn.Name != "btnBS")
        {
            UpdateText();
        }
        if (txtEdit.Text.Trim() != "Error")
        {
            SaveFormState();
        }
        switch (btn.Name)
        {
            case "btnC":
                ResetValues();
                break;
            case "btnCE":
                txtEdit.Text = "0";
                break;
            case "btnBS":
                if (!blnStartedNew)
                {
                    string EditText = txtEdit.Text.Substring(0, txtEdit.Text.Length - 1);
                    DisplayValue((EditText == string.Empty) ? "0" : EditText);
                }
                break;
            case "btnPercent":
                blnAfterOp = true;
                if (GetValueDecimal(txtEdit.Text, out decCurrValue))
                {
                    AddToTape(GetValueString(decCurrValue), (string)btn.Text, true, false);
                    decCurrValue = decResultValue * decCurrValue / intFormatFactor;
                    DisplayValue(GetValueString(decCurrValue));
                    AddToTape(GetValueString(decCurrValue), string.Empty, true, false);
                    strToBeAppendedLater = GetValueString(decResultValue).PadLeft(20)
                                                + strOpPressed.PadRight(3);
                    if (arrLstTapeHist.Count == 0)
                    {
                        arrLstTapeHist.Add(strToBeAppendedLater);
                    }
                    blnEqualOccurred = false;
                    blnStartedNew = true;
                }
                break;
            case "btnAdd":
            case "btnSubtract":
            case "btnMultiply":
            case "btnDivide":
                blnAfterOp = true;
                if (txtEdit.Text.Trim() == "Error")
                {
                    btnC.PerformClick();
                    return;
                }
                if (blnNumPressed || blnEqualOccurred)
                {
                    if (GetValueDecimal(txtEdit.Text, out decCurrValue))
                    {
                        if (Operation())
                        {
                            AddToTape(GetValueString(decCurrValue), (string)btn.Text, true, true);
                            DisplayValue(GetValueString(decResultValue));
                        }
                        else
                        {
                            AddToTape(GetValueString(decCurrValue), (string)btn.Text, true, true);
                            DisplayValue("Error");
                        }
                        strOpPressed = btn.Text;
                        blnEqualOccurred = false;
                        blnNumPressed = false;
                    }
                }
                else
                {
                    strOpPressed = btn.Text;
                    AddToTape(GetValueString(0), (string)btn.Text, false, false);
                }
                if (txtEdit.Text.Trim() == "Error")
                {
                    AddToTape("Error", string.Empty, true, true);
                    btnC.PerformClick();
                    txtEdit.Text = "Error";
                }
                break;
            case "btnEqual":
                blnAfterOp = false;
                if (strOpPressed != string.Empty || strPrevOp != string.Empty)
                {
                    if (GetValueDecimal(txtEdit.Text, out decCurrValue))
                    {
                        if (OperationEqual())
                        {
                            DisplayValue(GetValueString(decResultValue));
                        }
                        else
                        {
                            DisplayValue("Error");
                        }
                        if (!blnEqualOccurred)
                        {
                            strPrevOp = strOpPressed;
                            decHistValue = decCurrValue;
                            blnNumPressed = false;
                            blnEqualOccurred = true;
                        }
                        strOpPressed = string.Empty;
                    }
                }
                break;
            case "btnSign":
                GetValueDecimal(txtEdit.Text, out decCurrValue);
                DisplayValue(GetValueString(-1 * decCurrValue));
                break;
        }
    }
}

The same genius also discovered the glorious ternary operator. Here are some code samples:

frmTranHist.cs [line 812]:

strDrCr = chkCredits.Checked && chkDebits.Checked ? string.Empty
                    : chkDebits.Checked ? "D"
                        : chkCredits.Checked ? "C"
                            : "N";

frmTellTransHist.cs [line 961]:

if (strDefaultVals == strNowVals && (dsTranHist == null ? true : dsTranHist.Tables.Count == 0 ? true : dsTranHist.Tables[0].Rows.Count == 0 ? true : false))

frmMain.TellCash.cs [line 727]:

if (Validations(parPostMode == "ADD" ? true : false))

Here's a code snippet which demonstrates the typical misuse of the StringBuilder. Note how the programmer concats a string in a loop, then appends the resulting string to the StringBuilder:

private string CreateGridString()
{
    string strTemp = string.Empty;
    StringBuilder strBuild = new StringBuilder();
    foreach (DataGridViewRow dgrRow in dgvAcctHist.Rows)
    {
        strTemp = ((DataRowView)dgrRow.DataBoundItem)["Hst_chknum"].ToString().PadLeft(8, ' ');
        strTemp += "  ";
        strTemp += Convert.ToDateTime(((DataRowView)dgrRow.DataBoundItem)["Hst_trandt"]).ToString("MM/dd/yyyy");
        strTemp += "  ";
        strTemp += ((DataRowView)dgrRow.DataBoundItem)["Hst_DrAmount"].ToString().PadLeft(15, ' ');
        strTemp += "  ";
        strTemp += ((DataRowView)dgrRow.DataBoundItem)["Hst_CrAmount"].ToString().PadLeft(15, ' ');
        strTemp += "  ";
        strTemp += ((DataRowView)dgrRow.DataBoundItem)["Hst_trancd"].ToString().PadLeft(4, ' ');
        strTemp += "  ";
        strTemp += GetDescriptionString(((DataRowView)dgrRow.DataBoundItem)["Hst_desc"].ToString(), 30, 62);
        strBuild.AppendLine(strTemp);
    }
    strCreateGridString = strBuild.ToString();
    return strCreateGridString;//strBuild.ToString();
}

No primary keys, indexes, or foreign key constraints existed on tables, nearly all fields were of type varchar(50), and 100% of fields were nullable. Interestingly, bit fields were not used to store boolean data; instead a char(1) field was used, and the characters 'Y' and 'N' used to represent true and false respectively.

Speaking of the database, here's a representative example of a stored procedure:

ALTER PROCEDURE [dbo].[Get_TransHist]
 ( 
      @TellerID   int = null,
      @CashDrawer int = null,
      @AcctNum    bigint = null,
      @StartDate  datetime = null,
      @EndDate    datetime = null,
      @StartTranAmt     decimal(18,2) = null,
      @EndTranAmt decimal(18,2) = null,
      @TranCode   int = null,
      @TranType   int = null
 )
AS 
      declare @WhereCond Varchar(1000)
      declare @strQuery Varchar(2000)
      Set @WhereCond = ' '
      Set @strQuery = ' '
      If not @TellerID is null
            Set @WhereCond = @WhereCond + ' AND TT.TellerID = ' + Cast(@TellerID as varchar)
      If not @CashDrawer is null
            Set @WhereCond = @WhereCond + ' AND TT.CDId = ' + Cast(@CashDrawer as varchar)
      If not @AcctNum is null
            Set @WhereCond = @WhereCond + ' AND TT.AcctNbr = ' + Cast(@AcctNum as varchar)
      If not @StartDate is null
            Set @WhereCond = @WhereCond + ' AND Convert(varchar,TT.PostDate,121) >= ''' + Convert(varchar,@StartDate,121) + ''''
      If not @EndDate is null
            Set @WhereCond = @WhereCond + ' AND Convert(varchar,TT.PostDate,121) <= ''' + Convert(varchar,@EndDate,121) + ''''
      If not @TranCode is null
            Set @WhereCond = @WhereCond + ' AND TT.TranCode = ' + Cast(@TranCode as varchar)
      If not @EndTranAmt is null
            Set @WhereCond = @WhereCond + ' AND TT.TranAmt <= ' + Cast(@EndTranAmt as varchar)
      If not @StartTranAmt is null
            Set @WhereCond = @WhereCond + ' AND TT.TranAmt >= ' + Cast(@StartTranAmt  as varchar)
      If not (@TranType is null or @TranType = -1)
            Set @WhereCond = @WhereCond + ' AND TT.DocType = ' + Cast(@TranType as varchar)
      --Get the Teller Transaction Records according to the filters
      Set @strQuery = 'SELECT 
            TT.TranAmt as [Transaction Amount], 
            TT.TranCode as [Transaction Code],
            RTrim(LTrim(TT.TranDesc)) as [Transaction Description],
            TT.AcctNbr as [Account Number],
            TT.TranID as [Transaction Number],
            Convert(varchar,TT.ActivityDateTime,101) as [Activity Date],
            Convert(varchar,TT.EffDate,101) as [Effective Date],
            Convert(varchar,TT.PostDate,101) as [Post Date],
            Convert(varchar,TT.ActivityDateTime,108) as [Time],
            TT.BatchID,
            TT.ItemID,
            isnull(TT.DocumentID, 0) as DocumentID,
            TT.TellerName,
            TT.CDId,
            TT.ChkNbr,
            RTrim(LTrim(DT.DocTypeDescr)) as DocTypeDescr,
            (CASE WHEN TT.TranMode = ''F'' THEN ''Offline'' ELSE ''Online'' END) TranMode,
            DispensedYN
      FROM TellerTrans TT WITH (NOLOCK)
      LEFT OUTER JOIN DocumentTypes DT WITH (NOLOCK) on DocType = DocumentType
      WHERE IsNull(TT.DeletedYN, 0) = 0 ' + @WhereCond + ' Order By BatchId, TranID, ItemID'    
      Exec (@strQuery)

With all that said, the single biggest problem with this 130,000 line application this: no unit tests.

Yes, I have sent this story to TheDailyWTF, and then I quit my job.

Question 2

What is the most evil or dangerous code fragment you have ever seen in a production environment at a company? I've never encountered production code that I would consider to be deliberately malicious and evil, so I'm quite curious to see what others have found.

The most dangerous code I have ever seen was a stored procedure two linked-servers away from our core production database server. The stored procedure accepted any NVARCHAR(8000) parameter and executed the parameter on the target production server via an double-jump sp_executeSQL command. That is to say, the sp_executeSQL command executed another sp_executeSQL command in order to jump two linked servers. Oh, and the linked server account had sysadmin rights on the target production server.

What is the most EVIL code you have ever seen in a production enterprise environment?

Answer

Related questions