Do not use deprecated or obsolescent functions when more secure equivalent functions are available.
Here is a list of deprecated functions along with their recommended alternatives if available:
Deprecated |
Preferred |
|---|---|
|
|
|
|
|
|
|
|
die())This noncompliant code example tries to open a file and invokes the obsolete die() method if it fails.
my $file; open(FILE, "<", $file) or die "error opening $file: stopped"; # work with FILE |
The die() method is considered deprecated because it prints the file name and line number in which it was invoked. This might be sensitive information.
croak())This compliant solution uses the croak() function instead of die().
use Carp; my $file; open(FILE, "<", $file) or croak "error opening $file: stopped"; # work with FILE |
Unlike die(), croak() provides the file name and line number of the function that invoked the function that invoked croak(). This is more useful for application code that invokes library code; in this case, croak() and carp() also will reveal the file name and line number of the application code rather than the library code.
EXP30:EX0: The -t function should not be used for determining if input is interactive, but it is perfectly valid to determine if output is interactive. So it may be used on *STDOUT or *STDERR.
EXP30:EX1: The behavior of the croak() and carp() functions when invoked inside a signal handler are not documented. Consequently, die() and warn() should be used instead.
Using deprecated or obsolete classes or methods in program code can lead to erroneous behavior.
Recommendation |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
EXP30-PL |
info |
probable |
low |
P12 |
L1 |
Tool |
Diagnostic |
|---|---|
Perl::Critic |
ErrorHandling::RequireCarping |
|
InputOutput::ProhibitInteractiveTest |
|
Miscellanea::ProhibitFormats |
CERT C Secure Coding Standard: MSC34-C. Do not use deprecated or obsolescent functions
The CERT Oracle Secure Coding Standard for Java: MET02-J. Do not use deprecated or obsolete classes or methods
[CPAN] Elliot Shank, Perl-Critic-1.116 RequireCarping, InteractiveTest, ProhibitFormats
[Conway 2005]
02. Expressions EXP31-PL. Do not use the two-argument form of open()