Public const constructors can silently bypass Dart factory validation logic
A Dart developer discovered that public const constructors in concrete schema classes created an unguarded back door around factory method validation in the instructor_dart package. While factory methods like Schema.string() and Schema.enumeration() enforced rules such as regex validity and non-empty lists, calling the raw constructor directly skipped all those checks entirely. The flaw meant a broken regex pattern would only surface later during matching rather than at the point of authoring, making bugs harder to trace. The root cause is that Dart's const constructors are restricted to field assignments and assert statements, preventing them from throwing proper exceptions. The issue was resolved in version 0.4.0 by replacing public const constructors with private named constructors, forcing all instantiation through the validated factory methods.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in