Why doesn’t .NET add the parameter value to the exception message, for example. in int.Parse

Question

Very often, .NET methods generate common errors, for example, for example.

int.Parse("test") 

throws an exception with this message:

The input string was not in the correct format.

Now this will save a lot of trouble for many people, if just the value of the parameter helped easier debug things:

The input string "test" was not in the correct format.

It seems natural and easy, but .NET does not do it in many places, for example, for example. parsing. Is there any reason or conceptual problem with this, or is it just a “missing feature”?

Answer 1

I suspect the reason is mainly due to security concerns. Some problems with displaying / displaying text to be analyzed in the returned message are (but not limited to)

• The text to be analyzed can be very long. This will be problematic in terms of memory usage and mapping, not to mention the habits of the log developers of exception messages (not unreasonably).
• The text may contain characters that fight with formatting (for example, tab, LF, CR, etc.).
• The text may contain sensitive data. At the moment, it costs nothing that most developers, at least beginners, usually log or display error messages at the default exception level. Not including the text here means that there is no inadvertent data leak to catch the careless.
• It can be assumed (albeit unlikely) that an exploit can be found that could result in a distorted text fragment having an unpleasant unforeseen side effect.

In addition, the processed value is provided by the caller, which leaves them with the opportunity to decide whether it is better to register the content or not - this is not int.Parse() to return the value in the exception message.

In general, displaying a short message without the initially set value is a reasonable decision of the MS part in order to save us from ourselves, as well as to follow security recommendations.