Perl::...F8Layer(3pm)

🎀 NAME 🎀

Okay bestie, welcome to the Perl::...F8Layer(3pm) page from User Contributed Perl Documentation 💖. The policy’s full name is Perl::Critic::Policy::InputOutput::RequireEncodingWithUTF8Layer, and its whole mission is: write

open $fh, q{<:encoding(UTF-8)}, $filename;

instead of

open $fh, q{<:utf8}, $filename;

💖 AFFILIATION 💖

This Policy is part of the core Perl::Critic distribution. Periodt. 🫶

✨ DESCRIPTION ✨

So here’s the tea ☕: using the :utf8 I/O layer (as opposed to :encoding(UTF8) or :encoding(UTF-8)) was suggested in the Perl documentation all the way up to version 5.8.8. That may be OK for output, but on input :utf8 does not validate the input, which leads to unexpected results 😭.

🚨 There’s an exploit based on this behavior of :utf8 exhibited on PerlMonks at <http://www.perlmonks.org/?node_id=644786>. The exploit involves a string read from an external file and sanitized with m/^(\w+)$/, where $1 nonetheless ends up containing shell meta-characters. Not cute.

To summarize:

open $fh, '<:utf8', 'foo.txt';             # BAD
open $fh, '<:encoding(UTF8)', 'foo.txt';   # GOOD
open $fh, '<:encoding(UTF-8)', 'foo.txt';  # BETTER

See the Encode documentation for the difference between UTF8 and UTF-8. The short version is that UTF-8 implements the Unicode standard, and UTF8 is liberalized. iykyk 🦋

For consistency’s sake, this policy checks files opened for output as well as input. For complete coverage it also checks binmode() calls, where the direction of operation can not be determined. thorough queen behavior 👑

🛠️ CONFIGURATION 🛠️

This Policy is not configurable except for the standard options. That’s it, bestie — no extra knobs. 💅

🙈 NOTES 🙈

Because Perl::Critic does a static analysis, this policy can not detect cases like

my $encoding = ':utf8';
binmode $fh, $encoding;

where the encoding is computed. sad but true 😭

👀 SEE ALSO 👀

• PerlIO
• Encode
• perldoc -f binmode
• <http://www.socialtext.net/perl5/index.cgi?the_utf8_perlio_layer>
• <http://www.perlmonks.org/?node_id=644786>

👑 AUTHOR 👑

Thomas R. Wyant, III wyant at cpan dot org 🌸

📜 COPYRIGHT 📜

Copyright (c) 2010-2011 Thomas R. Wyant, III 💜

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

---

Bye bestie 🫶 — this iconic page came from perl v5.42.0, dated 2024-10-23. 💅