Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Many functions return useful values whether or not the function has side effects. In most cases, this value is used to signify signifies whether the function successfully completed its task or if some error occurred. Other times, the value is the result of some computation and is an integral part of the function's API.

...

Code Block
bgColor#ffcccc
langperl
my $source;
open(SOURCEmy $SOURCE, "<", $source);
@lines = (<SOURCE><$SOURCE>);
close(SOURCE$SOURCE);

It makes sure the variable containing the file name is properly defined, but it does nothing else to catch errors. Consequently, any error, such as the file not existing, being unreadable, or containing too much data to read into memory, will cause the program to abort.

...

Code Block
bgColor#ccccff
langperl
my $source;
open(SOURCEmy $SOURCE, "<", $source) or croak "error opening $source: $!";
@lines = (<SOURCE><$SOURCE>);
close(SOURCE$SOURCE) or croak "error closing $source: $!";

...

Code Block
bgColor#ccccff
langperl
use autodie;

my $source;
open(SOURCEmy $SOURCE, "<", $source);
@lines = (<SOURCE><$SOURCE>);
close(SOURCE$SOURCE);

EXP32:EX2: Functions that send data to standard output or standard error need not have their return values checked. This includes print and printf, but only if their filehandle file handle argument is not supplied or is explicitly set to *STDOUT or *STDERR. If they send their output to any other filehandlefile handle, their return value must be checked.

...

Failure to handle error codes or other values returned by functions can lead to incorrect program flow and violations of data integrity.

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

EXP32-PL

info

Medium

probable

Probable

low

Low

P12

L1

Automated Detection

Tool

Version 
Diagnostic

Checker

Description 

Perl::Critic

5.0 

InputOutput::RequireCheckedClose

 

InputOutput::RequireCheckedOpen

 


InputOutput::RequireCheckedSyscalls

Implemented 

Security Reviewer - Static Reviewer

Include Page
Security Reviewer - Static Reviewer
Security Reviewer - Static Reviewer

PERL_D89

Fully implemented

Related Guidelines

...

...

...

...

...

...

...

...

...

Bibliography

[Conway 2005]"Error Checking," p. 208
[CPAN]autodie
[Open Group 2008]open()


FIO30-PL. Do not use the two-argument form of open()      02. Expressions      Image Added Image Added Image Modified