GitHub
CERT Secure Coding

EXP33-PL. Do not invoke a function in a context for which it is not defined

Perl functions can be invoked in two contexts: list and scalar. These contexts indicate what is to be done with the return value. Functions can return different values in list context than in scalar context. For instance, the grep() function takes a list and a block or expression and filters out elements of the list for which the block or expression evaluates to false. The grep() function returns the filtered list when called in list context, but when called in scalar context, it merely returns the size of this list. That is, it returns the number of elements for which the block or expression evaluates to true.

Some functions do not define what they return in list or scalar context. For instance, according to the perlfunc manpage, the sort() function "sorts the LIST and returns the sorted list value. In scalar context, the behavior of ' sort() ' is undefined."

Noncompliant Code Example ( sort() )

This noncompliant code example inadvertently assigns a scalar to the result of the sort() function.

Non-compliant code
sub ret {
  my $list = shift;
  my @list = @{$list};
  # ...
  return sort @list;
}

my @list = ( "foo", "bar", "baz");
my $result = ret @list;

The contents of $result are undefined because the sort() function's return value is not defined in a scalar context.

Compliant Solution ( sort() )

This compliant solution guarantees that the ret() function is called only in list context.

Compliant code
sub ret {
  my $list = shift;
  my @list = @{$list};
  # ...
  return sort @list;
}

my @list = ( "foo", "bar", "baz");
my @result = ret @list;

In this case, the @result array will contain the list { "bar", "baz", "foo" }.

Risk Assessment

Using an unspecified value can lead to erratic program behavior.

Rule Severity Likelihood Detectable Repairable Priority Level
EXP33-PL Medium Unlikely Yes No P4 L3

Automated Detection

ToolDiagnostic
Perl::CriticSubroutines::ProhibitReturnSort

Bibliography

[ Conway 2005 ]
[ Manpages ]perlfunc