How defensive should we be?

Question

We've been running Pex over some code, and it has been showing some good things (well bad things, but showing them before it gets to production!).

However, one of the nice things about Pex is that it doesn't necessarily stop trying to find issues.

One area we found is that when passing in a string, we were not checking for empty strings.

So we changed:

if (inputString == null)

to

if (string.IsNullOrEmpty(inputString)) // ***

That fixed the initial issues. But then, when we ran Pex again, it decided that:

inputString = "\0";

was causing problems. And then

inputString = "\u0001";

What we've decided is that defaults can be used if we encounter // *** and that we are happy seeing the exception caused by any other odd input (and dealing with it).

Is that enough?