the hazards of coding for webservers vs. shell scripts

[kareila]

When I was doing some code cleanup a few months ago, I saw some lines that looked like this:

my $foo;
$foo = $bar unless $baz;

I decided that looked redundant and changed it to:

my $foo = $bar unless $baz;

Take my advice: don't combine "my" statements and postfix conditionals. Ever.

I've updated the programming guidelines to warn people away from this as well.

The manifestation of this particular bug was to cause the $foo variable to be referenced in global scope if the conditional was false. In that situation, the assigned value would persist across execution threads, such that if two people in a row had a true $baz, the second user would see the first user's value of $foo. Even with use warnings and use strict in effect, Perl apparently thinks this is perfectly fine.

ETA: exor674 says this command will find it (but not in BML files):

perlcritic --single-policy ProhibitConditionalDeclarations

Comments

[alierak]

For the sake of completeness: take either of those examples and follow it with "# stuff that uses $foo" and you'll see why the "my" is silently ignored in the first one. If $foo were localized to the conditional, it would go out of scope before you ever got to use it.

The sort of pathological case we need to prevent looks like this:

my $foo = $bar unless $baz;
# stuff that uses $foo without checking $baz