Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

The perlfunc manpage says, with regard to the builtin eval() function:built-in eval forms,

If there is a syntax error or runtime error, or a "die" statement is executed, "eval" returns an undefined value in scalar context or an empty list in list context, and $@ is set to the error message. If there was no error, $@ is guaranteed to be the empty string. Beware that using "eval" neither silences Perl from printing warnings to STDERR, nor does it stuff the text of warning messages into $@.
...
It is also Perl's exception trapping mechanism, where the die operator is used to raise exceptions.

Note that EXP30-PL. Do not use deprecated or obsolete functions or modules recommends using croak() rather than die().

Programmers may often suppress exceptions. This can be , which is easily accomplished by not examining the $@ variable (also known as $EVAL_ERROR). Because eva() makes eval makes ignoring exceptions the default, it is critically important that programmers inspect $@ after using eval().

Exceptions are intended to disrupt the expected control flow of the application. Many exceptions are supprssed suppressed out of not knowing how to handle the exception , or not even knowing that one may have been thrown. Consequently, exceptions must never be suppressed. If a call to eval() fails fails, the calling code must at least inspect $@. If the developer does not know how to handle the exception, they he can always propagate it up the stack by issuing their his own fatal error.

Noncompliant Code Example

This noncompliant code example uses the eval() builtin function  built-in form to divide two numbers. Wihtout using eval() Without using eval, the code would abort if $b happened to be 0, but thanks to eval(), code processing can resume normally, with $answer being uninitialized. This It produces a warning when the unitialized uninitialized value is embedded in the string passed to print(). So eval() can  can be used to completely ignore an important error that may occur.

Code Block
bgColor#ffcccc
langperl
my ($a, $b) = # initialize
my $answer;
eval qq{ \$answer = $a / $b };
print "The quotient is $answer\n";

...

This compliant solution checks to see if eval() failed,  failed and, if so, emits a warning message and initializes $answer.

Code Block
bgColor#ccccff
langperl
my ($a, $b) = # initialize
my $answer;
if (! eval qq{ \$answer = $a / $b };
if ($@) {
  carp($@) if $@;
  $answer = 0;
}
print "The quotient is $answer\n";

Exceptions

EXP31-PL-EX0: Exceptions that occur during the freeing of a resource may be suppressed in those cases where failure to free the resource cannot affect future program behavior. Examples of freeing resources include closing files or network sockets. When closed, normally or abnormally, the exception cannot influence future program behavior through any avenue other than resource exhaustion. When resource exhaustion is adequately handled, it is sufficient to sanitize and log the exception for future improvement; additional error handling is unnecessary in this case.

...

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

EXP31-PL

lowLow

probableProbable

mediumMedium

P14P4

L3

Related Guidelines

...

...

Bibliography

...

 


 

...

Image Removed      03. Expressions      EXP30-PL. Do not use deprecated or obsolete functionsImage Added Image Added Image Added