Reading Diffs for Effective Code Review

Reading Diffs for Code Review

Code review is one of the most common uses of diff tools. Being able to read diffs quickly and identify potential issues is a critical developer skill. This guide covers techniques for efficient diff-based code review.

Diff Reading Strategy

1. Start with the summary — how many files changed, lines added/removed
2. Read the file list — understand the scope of the change
3. Prioritize critical files — focus on logic changes, security-sensitive code
4. Read context — understand the surrounding code, not just changed lines
5. Check test coverage — look for corresponding test changes

What to Look For

 function processPayment(amount) {
-  if (amount <= 0) {
+  if (amount < 0) {
     throw new Error("Invalid amount");
   }

This small change removes the check for zero amounts — a potential bug. Without reading the diff carefully, this one-character change could be missed.

Common Review Patterns

Security issues:

-const query = db.prepare("SELECT * FROM users WHERE id = ?");
+const query = db.query("SELECT * FROM users WHERE id = " + userId);

Parameterized query replaced with string concatenation — SQL injection risk.

Performance regression:

 async function getUsers() {
-  return cache.get("users") || await db.query("SELECT * FROM users");
+  return await db.query("SELECT * FROM users");
 }

Cache removed — every call now hits the database.

Error handling removed:

 try {
   await sendEmail(user.email);
-} catch (error) {
-  logger.error("Email failed", error);
-  throw error;
-}
+} catch {}

Silent error swallowing — failures will be invisible.

Review Checklist from Diffs

• Do the changes match the PR description?
• Are there any security implications?
• Is error handling adequate?
• Are there corresponding test changes?
• Do naming conventions match the codebase?
• Are there any hardcoded values that should be configurable?
• Is there any dead code being added?

Diff Navigation Tips

• Collapse unchanged files — focus on what matters
• Use file type filters — review logic files before config files
• Follow the data flow — trace how inputs are processed through the changes