Do not use deprecated or obsolescent functions when more secure equivalent functions are available.

Here is a list of deprecated functions, along with their recommended alternatives, if available:

Noncompliant Code Example (die())

This noncompliant code example tries to open a file, and invokes the obsolete die() method if it fails.

my $file;
open(FILE, "<", $file) or die "error opening $file: stopped";
# ...

The die() method is considered deprecated, as it prints the file name and line number in which it was invoked. This might be sensitive information.

Compliant Solution (croak())

This compliant colution uses the croak() function instead of die().

use Carp;

my $file;
open(FILE, "<", $file) or croak "error opening $file: stopped";
# ...

Unlike, die(), croak() provides the filename and line number of the function that invoked the function that invoked croak(). This is more useful for application code that invokes library code; in this case croak() and carp() also will reveal the file name and line number of the application code rather than the library code.

Risk Assessment

Failure to handle error codes or other values returned by functions can lead to incorrect program flow and violations of data integrity.

Automated Detection

Related Guidelines

CERT C Secure Coding Standard: MSC34-C. Do not use deprecated or obsolescent functions

The CERT Oracle Secure Coding Standard for Java: MET02-J. Do not use deprecated or obsolete classes or methods

Bibliography

open()
CPAN Elliot Shank, Perl-Critic-1.116, ProhibitUniversalCan, ProhibitUniversalIsa, RequireCarping, InteractiveTest, ProhibitFormats

EXP11-C. Do not apply operators expecting one type to data of an incompatible type      03. Expressions (EXP)      EXP13-C. Treat relational and equality operators as if they were nonassociative