GitHub
CERT Secure Coding

DCL30-PL. Do not import deprecated modules

Over time, modules in Perl can become obsolete, or superseded by newer modules.  Furthermore, d espite being over 15 years old, Perl 5 continues to grow. Much of this growth comes from Perl's practice of assimilating popular CPAN modules into the core language. Modules that are not part of the core Perl language must be explicitly included to be used by a program, but modules that are part of the core language need not be. When a module has been assimilated into the core language, the original module is still available in CPAN.

Modules that have become obsolete, superseded by newer modules, or integrated into the core language are considered deprecated. Do not import deprecated modules.

If a module becomes deprecated because its features have been integrated into the core language, then their features may be used without importing the deprecated module.

Here is a list of CPAN modules that should be considered deprecated, according to Perl::Critic .

Deprecated
Class::ISA
Pod::Plainer
Shell
Switch
Universal::isa
Universal::can
Universal::VERSION

Noncompliant Code Example ( Universal::can() )

This noncompliant code example tries to see if an object supports a method. The Universal::can() method provides this capability. It was formerly an external CPAN module, but it is now part of Perl itself.

Non-compliant code
use UNIVERSAL qw(can);  # deprecated

# ...

sub doit {
  my ($func) = @_;

  if (can($self, $func)) {
    $self->$func();
  }
  # ...
}

Although this code works correctly now, the use statement will be rejected by the Perl interpreter someday.

Compliant Solution

This compliant solution uses Universal::can() without explicitly importing it.

Compliant code
# use UNIVERSAL qw(can);  # deprecated

# ...

sub doit {
  my ($func) = @_;

  if ($self->can($func)) {
    $self->$func();
  }
  # ...
}

Risk Assessment

Using deprecated or obsolete classes or methods in program code can lead to erroneous behavior.

Rule Severity Likelihood Detectable Repairable Priority Level
DCL30-PL Medium Likely Yes No P12 L1

Automated Detection

Tool

Version

Checker

Description

Perl::Critic

5.0

Modules::ProhibitEvilModules
BuiltinFunctions::ProhibitUniversalCan
BuiltinFunctions::ProhibitUniversalIsa

Implemented

B::Lint

5.0

... is deprecated and will be removed in a future ...


Security Reviewer - Static Reviewer

6.02

PERL_S23

Fully implemented

Bibliography



[ CPAN ]Elliot Shank, Perl-Critic-1.116 Modules::ProhibitEvilModules , ProhibitUniversalCan , ProhibitUniversalIsa
[ CPAN ]Ragwitz, Florian, UNIVERSAL