Perl has a large number of punctuation variables. They control the behavior of various operations in the Perl interpreter. While they are initially set to reasonable default values, any Perl code has the ability to change their values for its own internal purposes. If a program modifies one of these variables, it is obligated to reset the variable back to its default value, lest it alter the behavior of subsequent unrelated code. The easiest way for a program to 'clean up after itself' is to declare such variables local
when modifying them.
Noncompliant Code Example
This noncompliant code example shows a subroutine that counts the number of virtual users on this platform. This is deduced by the number of users in the /etc/passwd
file that use the program /usr/bin/false
as their shell.
sub count_virtual_users { my $result = 0; $/ = ":"; open( PASSWD, "<", "/etc/passwd"); while (<PASSWD>) { @items = split "\n"; foreach (@items) { if ($_ eq "/usr/bin/false") { $result++; } } } $result; }
This program produces the correct result, however it leaves the $/
variable set to an unusual value (:
). Subsequent reads of any file will use this character as the end-of-line delimiter, rather than the typical newline, which is the default value.
Compliant Solution
This compliant solution again produces the same result, but localizes the punctuation variable. Consequently, when the subroutine returns, the $/
variable is restored to its original value, and subsequent file reads behave as expected.
sub count_virtual_users { my $result = 0; local $/ = ":"; open( PASSWD, "<", "/etc/passwd"); while (<PASSWD>) { @items = split "\n"; foreach (@items) { if ($_ eq "/usr/bin/false") { $result++; } } } $result; }
Exceptions
DCL02-EX0: This rule does not apply to object methods. Object methods are easy for the parser to distinguish from builtin functions or keywords due to their distinct syntax.
Related Guidelines
CERT C++ Secure Coding Standard: DCL32-CPP. Do not declare or define a reserved identifier
CERT C Secure Coding Standard: DCL37-C. Do not declare or define a reserved identifier
Exceptions
Risk Assessment
Modifying punctuation variables without declaring them local can corrupt data and create unexpected program behavior.
Recommendation |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
---|---|---|---|---|---|
DCL02-PL |
low |
probable |
medium |
P2 |
L3 |
Automated Detection
Tool |
Diagnostic |
---|---|
Perl::Critic |
Variables::RequireLocalizedPunctuationVars |
Bibliography
[CPAN] Elliot Shank, Perl-Critic-1.116 Variables::RequireLocalizedPunctuationVars
[Wall 2011] perlfunc, perlvar
01. Declarations and Initialization DCL32-PL. Every module must return a true value