Security: Use of assert statements for input validation in production code

[tomaioo]

Summary

Security: Use of assert statements for input validation in production code

Problem

Severity: Medium | File: dask_image/ndfourier/_utils.py:L18

The file dask_image/ndfourier/_utils.py uses Python assert statements for input validation (e.g., lines checking issubclass(dtype, numbers.Real)). Assert statements can be disabled globally when Python is run with the -O (optimize) flag, which would bypass these checks entirely. This could allow invalid inputs to propagate through the code, potentially causing crashes, incorrect results, or undefined behavior in production environments where optimized Python execution is used.

Solution

Replace assert statements with proper if conditions that raise appropriate exceptions (e.g., ValueError, TypeError). For example, instead of assert (issubclass(dtype, numbers.Real) and not issubclass(dtype, numbers.Integral)), use if not (issubclass(dtype, numbers.Real) and not issubclass(dtype, numbers.Integral)): raise TypeError("dtype must be a non-integral real number").

Changes

• dask_image/ndfourier/_utils.py (modified)

[Copilot]

Pull request overview

This PR hardens dask_image.ndfourier utilities by replacing assert-based input validation (which can be disabled with python -O) with explicit runtime checks that raise appropriate exceptions.

Changes:

• Replace assert len(shape) == len(chunks) with an explicit ValueError in _get_freq_grid.
• Replace assert-based dtype validation with explicit TypeError checks in _get_freq_grid and _get_ang_freq_grid.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[m-albert]

Thanks for this PR @tomaioo. I wasn't aware of this consequence of using asserts!

LGTM, mering.