Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Perl provides several mechanisms for warning the user about potential problems with the program. The use warnings pragma turns on a default set of warnings for the Perl runtime to produce should it detect questionable code. The -w command-line argument serves the same purpose. It is considered so useful that the perl(1) manpage [Wall 2011] dryly notes the first bug in Perl is that :

...

"the -w switch is not mandatory" [Wall 2011] .

The use warnings pragma must be used in all Perl code.

...

Code Block
bgColor#ffcccc
langperl
use warnings;
use strict;

my %days = ("Sunday"    => 'pray',
            "Monday"    => 'work',
            "Tuesday"   => 'work',
            "Wednesday" => 'work',
            "Thursday"  => 'work',
            "Friday"    => 'work',
            "Saturday"  => 'rest');

sub what_to_do {
  my $day = shift;
  if ($days{$day} eq 'work') {
    return 'work hard';
  }
  if (exists $days{$day}) {
    return $days{$day};
  } else {
    return "do nothing";
  }
}


my $task = what_to_do('tomorrow');
print "Prepare to $task\n";

This code produces the following output:

Code Block
Use of uninitialized value within %days in string eq at ./example.pl line 16.
Prepare to do nothing

...

Code Block
bgColor#ffcccc
langperl
use warnings;
use strict;

no strict 'refs';

our $sunday    = 'pray';
# ...

This code produces the following output:

Code Block
Prepare to do nothing

...

This compliant solution suppresses the strictness checking to as minimal a scope as possible. Because the strict strictness checking is suppressed only inside the what_to_do subroutine, other regions of the code can still be checked for strict compliance.

...

Suppressing warnings can mask problems that would otherwise be quickly recognized and fixed.

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

MSC02-PL

low

Low

unlikely

Unlikely

medium

Medium

P2

L2

Related Guidelines

CERT C Secure Coding Standard: MSC00-C. Compile cleanly at high warning levels

CERT C++ Secure Coding Standard: MSC00-CPP. Compile cleanly at high warning levels

L3

Automated Detection

Tool

Diagnostic

Perl::Critic

TestingAndDebugging::ProhibitNoStrict

Perl::Critic

TestingAndDebugging:;ProhibitNoWarnings

Perl::Critic

TestingAndDebugging::ProhibitProlongedStrictureOverride

Perl::Critic

TestingAndDebugging::RequireUseStrict

Security Reviewer - Static Reviewer

PERL_D108
PERL_D109

Related Guidelines

Bibliography

...

2005]"Overriding Strictures," p

...


...

Image Modified Image Modified Image Modified