Perl Script Validation
Comprehensive validation of Perl scripts for syntax, security, and best practices.
Validation Checklist
- Syntax check (
perl -c)
- Essential pragmas verification
- Security pattern review
- Best practice compliance
- Documentation check
Syntax Validation
Basic Compile Check
# Check syntax
perl -c script.pl
# With warnings
perl -wc script.pl
# Check module
perl -c -I lib lib/MyApp/Module.pm
Expected Output
Success:
script.pl syntax OK
Failure:
syntax error at script.pl line 15, near "my $"
script.pl had compilation errors.
Essential Pragmas Check
Every production script MUST have:
#!/usr/bin/env perl
use strict;
use warnings;
use autodie; # For scripts with file operations
Validation Pattern
# Check for strict
grep -l 'use strict' script.pl || echo "MISSING: use strict"
# Check for warnings
grep -l 'use warnings' script.pl || echo "MISSING: use warnings"
# Check shebang
head -1 script.pl | grep -q '^#!' || echo "MISSING: shebang line"
Security Validation
Critical Checks
| Issue | Pattern to Find | Fix |
|---|
| Two-arg open | open\s+\w+,\s*[^<>] | Use 3-arg open |
| Backticks with variables | `.*\$` | Use IPC::System::Simple |
| eval with string | eval\s+" | Use eval block |
| No taint mode | #!/.*perl\s*$ | Add -T flag |
Security Check Commands
# Find two-argument open
grep -n 'open\s\+[A-Z]\+\s*,' script.pl
# Find unsafe backticks
grep -n '`.*\$' script.pl
# Find string eval
grep -n 'eval\s*"' script.pl
# Check for system with string
grep -n 'system\s*"' script.pl
Best Practices Validation
Variable Declarations
# Find undeclared variables (after perl -c passes)
# These would be caught by strict, but double-check:
grep -n '\$[a-z_][a-z0-9_]*\s*=' script.pl | head -20
Function Definitions
Check for proper function structure:
# Good pattern
sub function_name {
my ($arg1, $arg2) = @_;
# ...
}
# Check for named parameters
grep -n 'sub.*{' script.pl
Error Handling
# Find eval blocks without error check
grep -n 'eval\s*{' script.pl
# These should be followed by or do { } patterns
Documentation Validation
POD Check
# Validate POD syntax
podchecker script.pl
# Check for POD presence
perl -MPod::Usage -e 'pod2usage(-input => shift)' script.pl >/dev/null 2>&1 || echo "No POD documentation"
Required POD Sections
# Check for NAME section
grep -l '^=head1 NAME' script.pl || echo "MISSING: =head1 NAME"
# Check for SYNOPSIS
grep -l '^=head1 SYNOPSIS' script.pl || echo "MISSING: =head1 SYNOPSIS"
Comprehensive Validation Script
Run complete validation:
Code examples
Quick Validation Commands
Syntax only:
perl -wc script.pl
Pragmas check:
head -10 script.pl | grep -E 'use (strict|warnings|autodie)'
Security scan:
perlcritic --severity 5 script.pl
Full validation:
perl -wc script.pl && \
grep -q 'use strict' script.pl && \
grep -q 'use warnings' script.pl && \
echo "Basic validation passed"
Fixing Common Issues
Missing strict/warnings
Add to top of script:
use strict;
use warnings;
Two-argument open
# Wrong
open FILE, $filename;
# Correct
open my $fh, '<', $filename;
Unsafe system calls
# Wrong
system("rm $file");
`ls $dir`;
# Correct
use IPC::System::Simple qw(system capture);
system('rm', $file);
my $output = capture('ls', $dir);
Missing error handling
# Wrong
open my $fh, '<', $file;
# Correct (with autodie)
use autodie;
open my $fh, '<', $file;
# Or explicit
open my $fh, '<', $file
or die "Cannot open $file: $!";