Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Many functions return useful values whether or not the function has side effects. In most cases, this value is used to signify signifies whether the function successfully completed its task or if some error occurred. Other times, the value is the result of some computation and is an integral part of the function's API.

...

Code Block
bgColor#ffcccc
langperl

my $source;
open(SOURCEmy $SOURCE, "<", $source);
@lines = (<SOURCE><$SOURCE>);
close(SOURCE$SOURCE);

It makes sure the variable containing the file name is properly defined, but it does nothing else to catch errors. Consequently, any error, such as the file not existing, being unreadable, or containing too much data to read into memory, will cause the program to abort.

...

Code Block
bgColor#ccccff
langperl

my $source;
open(SOURCEmy $SOURCE, "<", $source) or croak "error opening $source: $!";
@lines = (<SOURCE><$SOURCE>);
close(SOURCE$SOURCE) or croak "error closing $source: $!";

...

Code Block
bgColor#ccccff
langperl

use autodie;

my $source;
open(SOURCEmy $SOURCE, "<", $source);
@lines = (<SOURCE><$SOURCE>);
close(SOURCE$SOURCE);

EXP32:EX2: Functions that send data to standard output or standard error need not have their return values checked. This includes print and printf, but only if their filehandle file handle argument is not supplied , or is explicitly set to *STDOUT or *STDERR. If they send their output to any other filehandlefile handle, their return value must be checked.

EXP32:EX3: When inside error-handling code, function calls that are used to release resources, such as close(), need not have their return values checked. Any code that falls under this exception should be explicitly documented as such.

...

Failure to handle error codes or other values returned by functions can lead to incorrect program flow and violations of data integrity.

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

EXP32-PL

info

Medium

probable

Probable

low

Low

P12

L1

Automated Detection

Tool

Diagnostic
Version 

Checker

Description 

Perl::Critic

5.0 

InputOutput::RequireCheckedClose

 


InputOutput::RequireCheckedOpen

 

InputOutput::RequireCheckedSyscalls

Implemented 

Security Reviewer - Static Reviewer

Include Page
Security Reviewer - Static Reviewer
Security Reviewer - Static Reviewer

PERL_D89

Fully implemented

Related Guidelines

...

...

...

...

...

...

...

...

...

Bibliography

[Conway 2005]"Error Checking," p. 208
[CPAN]autodie
[Open Group 2008]open()


FIO30-PL. Do not use the two-argument form of open()      02. Expressions      Image Added Image Added Image Modified