The perlfunc manpage says, with regard to the builtin built-in eval forms:,
If there is a syntax error or runtime error, or a "die" statement is executed, "eval" returns an undefined value in scalar context or an empty list in list context, and $@ is set to the error message. If there was no error, $@ is guaranteed to be the empty string. Beware that using "eval" neither silences Perl from printing warnings to STDERR, nor does it stuff the text of warning messages into $@.
...
It is also Perl's exception trapping mechanism, where the die operator is used to raise exceptions.
...
Programmers may often suppress exceptions. This can be , which is easily accomplished by not examining the $@ variable (also known as $EVAL_ERROR). Because eval makes ignoring exceptions the default, it is critically important that programmers inspect $@ after using eval.
Exceptions are intended to disrupt the expected control flow of the application. Many exceptions are supprssed suppressed out of not knowing how to handle the exception , or not even knowing that one may have been thrown. Consequently, exceptions must never be suppressed. If a call to eval fails, the calling code must at least inspect $@. If the developer does not know how to handle the exception, they he can always propagate it up the stack by issuing their his own fatal error.
Noncompliant Code Example
This noncompliant code example uses the eval builtin built-in form to divide two numbers. Without using eval the , the code would abort if $b happened to be 0, but thanks to eval, code processing can resume normally, with $answer being uninitialized. This It produces a warning when the unitialized uninitialized value is embedded in the string passed to print(). So eval can be used to completely ignore an important error that may occur.
...
This compliant solution checks to see if eval failed , and, if so, emits a warning message and initializes $answer.
| Code Block | ||||
|---|---|---|---|---|
| ||||
my ($a, $b) = # initialize my $answer; if (! eval { $answer = $a / $b }; if ($@) { carp($@) if $@; $answer = 0; } print "The quotient is $answer\n"; |
Exceptions
EXP31-PL-EX0: Exceptions that occur during the freeing of a resource may be suppressed in those cases where failure to free the resource cannot affect future program behavior. Examples of freeing resources include closing files or network sockets. When closed, normally or abnormally, the exception cannot influence future program behavior through any avenue other than resource exhaustion. When resource exhaustion is adequately handled, it is sufficient to sanitize and log the exception for future improvement; additional error handling is unnecessary in this case.
...
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
EXP31-PL | lowLow | probableProbable | mediumMedium | P14P4 | L3 |
Related Guidelines
...
...
Bibliography
...
...