{
    "mode": "perldoc",
    "parameter": "Opcode",
    "section": "",
    "url": "https://www.chedong.com/phpMan.php/perldoc/Opcode/json",
    "generated": "2026-06-15T14:45:29Z",
    "synopsis": "use Opcode;",
    "sections": {
        "NAME": {
            "content": "Opcode - Disable named opcodes when compiling perl code\n",
            "subsections": []
        },
        "SYNOPSIS": {
            "content": "use Opcode;\n",
            "subsections": []
        },
        "DESCRIPTION": {
            "content": "Perl code is always compiled into an internal format before execution.\n\nEvaluating perl code (e.g. via \"eval\" or \"do 'file'\") causes the code to be compiled into an\ninternal format and then, provided there was no error in the compilation, executed. The internal\nformat is based on many distinct *opcodes*.\n\nBy default no opmask is in effect and any code can be compiled.\n\nThe Opcode module allow you to define an *operator mask* to be in effect when perl *next*\ncompiles any code. Attempting to compile code which contains a masked opcode will cause the\ncompilation to fail with an error. The code will not be executed.\n",
            "subsections": []
        },
        "NOTE": {
            "content": "The Opcode module is not usually used directly. See the ops pragma and Safe modules for more\ntypical uses.\n",
            "subsections": []
        },
        "WARNING": {
            "content": "The Opcode module does not implement an effective sandbox for evaluating untrusted code with the\nperl interpreter.\n\nBugs in the perl interpreter that could be abused to bypass Opcode restrictions are not treated\nas vulnerabilities. See perlsecpolicy for additional information.\n\nThe authors make no warranty, implied or otherwise, about the suitability of this software for\nsafety or security purposes.\n\nThe authors shall not in any case be liable for special, incidental, consequential, indirect or\nother similar damages arising from the use of this software.\n\nYour mileage will vary. If in any doubt do not use it.\n",
            "subsections": []
        },
        "Operator Names and Operator Lists": {
            "content": "The canonical list of operator names is the contents of the array PLopname defined and\ninitialised in file opcode.h of the Perl source distribution (and installed into the perl\nlibrary).\n\nEach operator has both a terse name (its opname) and a more verbose or recognisable descriptive\nname. The opdesc function can be used to return a list of descriptions for a list of operators.\n\nMany of the functions and methods listed below take a list of operators as parameters. Most\noperator lists can be made up of several types of element. Each element can be one of\n\nan operator name (opname)\nOperator names are typically small lowercase words like enterloop, leaveloop, last,\nnext, redo etc. Sometimes they are rather cryptic like gv2cv, incmp and ftsvtx.\n\nan operator tag name (optag)\nOperator tags can be used to refer to groups (or sets) of operators. Tag names always\nbegin with a colon. The Opcode module defines several optags and the user can define\nothers using the defineoptag function.\n\na negated opname or optag\nAn opname or optag can be prefixed with an exclamation mark, e.g., !mkdir. Negating an\nopname or optag means remove the corresponding ops from the accumulated set of ops at\nthat point.\n\nan operator set (opset)\nAn *opset* as a binary string of approximately 44 bytes which holds a set or zero or\nmore operators.\n\nThe opset and opsettoops functions can be used to convert from a list of operators to\nan opset and *vice versa*.\n\nWherever a list of operators can be given you can use one or more opsets. See also\nManipulating Opsets below.\n",
            "subsections": []
        },
        "Opcode Functions": {
            "content": "The Opcode package contains functions for manipulating operator names tags and sets. All are\navailable for export by the package.\n\nopcodes In a scalar context opcodes returns the number of opcodes in this version of perl\n(around 350 for perl-5.7.0).\n\nIn a list context it returns a list of all the operator names. (Not yet implemented, use\n@names = opsettoops(fullopset).)\n\nopset (OP, ...)\nReturns an opset containing the listed operators.\n\nopsettoops (OPSET)\nReturns a list of operator names corresponding to those operators in the set.\n\nopsettohex (OPSET)\nReturns a string representation of an opset. Can be handy for debugging.\n\nfullopset\nReturns an opset which includes all operators.\n\nemptyopset\nReturns an opset which contains no operators.\n\ninvertopset (OPSET)\nReturns an opset which is the inverse set of the one supplied.\n\nverifyopset (OPSET, ...)\nReturns true if the supplied opset looks like a valid opset (is the right length etc)\notherwise it returns false. If an optional second parameter is true then verifyopset\nwill croak on an invalid opset instead of returning false.\n\nMost of the other Opcode functions call verifyopset automatically and will croak if\ngiven an invalid opset.\n\ndefineoptag (OPTAG, OPSET)\nDefine OPTAG as a symbolic name for OPSET. Optag names always start with a colon \":\".\n\nThe optag name used must not be defined already (defineoptag will croak if it is\nalready defined). Optag names are global to the perl process and optag definitions\ncannot be altered or deleted once defined.\n\nIt is strongly recommended that applications using Opcode should use a leading capital\nletter on their tag names since lowercase names are reserved for use by the Opcode\nmodule. If using Opcode within a module you should prefix your tags names with the name\nof your module to ensure uniqueness and thus avoid clashes with other modules.\n\nopmaskadd (OPSET)\nAdds the supplied opset to the current opmask. Note that there is currently *no*\nmechanism for unmasking ops once they have been masked. This is intentional.\n\nopmask  Returns an opset corresponding to the current opmask.\n\nopdesc (OP, ...)\nThis takes a list of operator names and returns the corresponding list of operator\ndescriptions.\n\nopdump (PAT)\nDumps to STDOUT a two column list of op names and op descriptions. If an optional\npattern is given then only lines which match the (case insensitive) pattern will be\noutput.\n\nIt's designed to be used as a handy command line utility:\n\nperl -MOpcode=opdump -e opdump\nperl -MOpcode=opdump -e 'opdump Eval'\n",
            "subsections": []
        },
        "Manipulating Opsets": {
            "content": "Opsets may be manipulated using the perl bit vector operators & (and), | (or), ^ (xor) and ~\n(negate/invert).\n\nHowever you should never rely on the numerical position of any opcode within the opset. In other\nwords both sides of a bit vector operator should be opsets returned from Opcode functions.\n\nAlso, since the number of opcodes in your current version of perl might not be an exact multiple\nof eight, there may be unused bits in the last byte of an upset. This should not cause any\nproblems (Opcode functions ignore those extra bits) but it does mean that using the ~ operator\nwill typically not produce the same 'physical' opset 'string' as the invertopset function.\n\nTO DO (maybe)\n$bool = opseteq($opset1, $opset2)  true if opsets are logically\nequivalent\n$yes = opsetcan($opset, @ops)      true if $opset has all @ops set\n\n@diff = opsetdiff($opset1, $opset2) => ('foo', '!bar', ...)\n",
            "subsections": []
        },
        "Predefined Opcode Tags": {
            "content": ":basecore\nnull stub scalar pushmark wantarray const defined undef\n\nrv2sv sassign\n\nrv2av aassign aelem aelemfast aelemfastlex aslice kvaslice\nav2arylen\n\nrv2hv helem hslice kvhslice each values keys exists delete\naeach akeys avalues multideref argelem argdefelem argcheck\n\npreinc ipreinc predec ipredec postinc ipostinc\npostdec ipostdec int hex oct abs pow multiply imultiply\ndivide idivide modulo imodulo add iadd subtract isubtract\n\nleftshift rightshift bitand bitxor bitor nbitand\nnbitxor nbitor sbitand sbitxor sbitor negate inegate not\ncomplement ncomplement scomplement\n\nlt ilt gt igt le ile ge ige eq ieq ne ine ncmp incmp\nslt sgt sle sge seq sne scmp\nisa\n\nsubstr vec stringify study pos length index rindex ord chr\n\nucfirst lcfirst uc lc fc quotemeta trans transr chop schop\nchomp schomp\n\nmatch split qr\n\nlist lslice splice push pop shift unshift reverse\n\ncondexpr flip flop andassign orassign dorassign and or dor xor\n\nwarn die lineseq nextstate scope enter leave\n\nrv2cv anoncode prototype coreargs avhvswitch anonconst\n\nentersub leavesub leavesublv return method methodnamed\nmethodsuper methodredir methodredirsuper\n-- XXX loops via recursion?\n\ncmpchainand cmpchaindup\n\nleaveeval -- needed for Safe to operate, is safe\nwithout entereval\n\n:basemem\nThese memory related ops are not included in :basecore because they can easily be used to\nimplement a resource attack (e.g., consume all available memory).\n\nconcat multiconcat repeat join range\n\nanonlist anonhash\n\nNote that despite the existence of this optag a memory resource attack may still be\npossible using only :basecore ops.\n\nDisabling these ops is a *very* heavy handed way to attempt to prevent a memory resource\nattack. It's probable that a specific memory limit mechanism will be added to perl in the\nnear future.\n\n:baseloop\nThese loop ops are not included in :basecore because they can easily be used to implement\na resource attack (e.g., consume all available CPU time).\n\ngrepstart grepwhile\nmapstart mapwhile\nenteriter iter\nenterloop leaveloop unstack\nlast next redo\ngoto\n\n:baseio\nThese ops enable *filehandle* (rather than filename) based input and output. These are safe\non the assumption that only pre-existing filehandles are available for use. Usually, to\ncreate new filehandles other ops such as open would need to be enabled, if you don't take\ninto account the magical open of ARGV.\n\nreadline rcatline getc read\n\nformline enterwrite leavewrite\n\nprint say sysread syswrite send recv\n\neof tell seek sysseek\n\nreaddir telldir seekdir rewinddir\n\n:baseorig\nThese are a hotchpotch of opcodes still waiting to be considered\n\ngvsv gv gelem\n\npadsv padav padhv padcv padany padrange introcv clonecv\n\nonce\n\nrv2gv refgen srefgen ref refassign lvref lvrefslice lvavref\n\nbless -- could be used to change ownership of objects\n(reblessing)\n\nregcmaybe regcreset regcomp subst substcont\n\nsprintf prtf -- can core dump\n\ncrypt\n\ntie untie\n\ndbmopen dbmclose\nsselect select\npipeop sockpair\n\ngetppid getpgrp setpgrp getpriority setpriority\nlocaltime gmtime\n\nentertry leavetry -- can be used to 'hide' fatal errors\nentertrycatch poptry catch leavetrycatch -- similar\n\nentergiven leavegiven\nenterwhen leavewhen\nbreak continue\nsmartmatch\n\ncustom -- where should this go\n\n:basemath\nThese ops are not included in :basecore because of the risk of them being used to generate\nfloating point exceptions (which would have to be caught using a $SIG{FPE} handler).\n\natan2 sin cos exp log sqrt\n\nThese ops are not included in :basecore because they have an effect beyond the scope of\nthe compartment.\n\nrand srand\n\n:basethread\nThese ops are related to multi-threading.\n\nlock\n\n:default\nA handy tag name for a *reasonable* default set of ops. (The current ops allowed are\nunstable while development continues. It will change.)\n\n:basecore :basemem :baseloop :baseorig :basethread\n\nThis list used to contain :baseio prior to Opcode 1.07.\n\nIf safety matters to you (and why else would you be using the Opcode module?) then you\nshould not rely on the definition of this, or indeed any other, optag!\n\n:filesysread\nstat lstat readlink\n\nftatime ftblk ftchr ftctime ftdir fteexec fteowned\nfteread ftewrite ftfile ftis ftlink ftmtime ftpipe\nftrexec ftrowned ftrread ftsgid ftsize ftsock ftsuid\nfttty ftzero ftrwrite ftsvtx\n\nfttext ftbinary\n\nfileno\n\n:sysdb\nghbyname ghbyaddr ghostent shostent ehostent      -- hosts\ngnbyname gnbyaddr gnetent snetent enetent         -- networks\ngpbyname gpbynumber gprotoent sprotoent eprotoent -- protocols\ngsbyname gsbyport gservent sservent eservent      -- services\n\ngpwnam gpwuid gpwent spwent epwent getlogin       -- users\nggrnam ggrgid ggrent sgrent egrent                -- groups\n\n:browse\nA handy tag name for a *reasonable* default set of ops beyond the :default optag. Like\n:default (and indeed all the other optags) its current definition is unstable while\ndevelopment continues. It will change.\n\nThe :browse tag represents the next step beyond :default. It is a superset of the :default\nops and adds :filesysread the :sysdb. The intent being that scripts can access more\n(possibly sensitive) information about your system but not be able to change it.\n\n:default :filesysread :sysdb\n\n:filesysopen\nsysopen open close\numask binmode\n\nopendir closedir -- other dir ops are in :baseio\n\n:filesyswrite\nlink unlink rename symlink truncate\n\nmkdir rmdir\n\nutime chmod chown\n\nfcntl -- not strictly filesys related, but possibly as\ndangerous?\n\n:subprocess\nbacktick system\n\nfork\n\nwait waitpid\n\nglob -- access to Cshell via <`rm *`>\n\n:ownprocess\nexec exit kill\n\ntime tms -- could be used for timing attacks (paranoid?)\n\n:others\nThis tag holds groups of assorted specialist opcodes that don't warrant having optags\ndefined for them.\n\nSystemV Interprocess Communications:\n\nmsgctl msgget msgrcv msgsnd\n\nsemctl semget semop\n\nshmctl shmget shmread shmwrite\n\n:load\nThis tag holds opcodes related to loading modules and getting information about calling\nenvironment and args.\n\nrequire dofile\ncaller runcv\n\n:stilltobedecided\nchdir\nflock ioctl\n\nsocket getpeername ssockopt\nbind connect listen accept shutdown gsockopt getsockname\n\nsleep alarm -- changes global timer state and signal handling\nsort -- assorted problems including core dumps\ntied -- can be used to access object implementing a tie\npack unpack -- can be used to create/use memory pointers\n\nhintseval -- constant op holding eval hints\n\nentereval -- can be used to hide code from initial compile\n\nreset\n\ndbstate -- perl -d version of nextstate(ment) opcode\n\n:dangerous\nThis tag is simply a bucket for opcodes that are unlikely to be used via a tag name but\nneed to be tagged for completeness and documentation.\n\nsyscall dump chroot\n",
            "subsections": []
        },
        "SEE ALSO": {
            "content": "ops -- perl pragma interface to Opcode module.\n\nSafe -- Opcode and namespace limited execution compartments\n",
            "subsections": []
        },
        "AUTHORS": {
            "content": "Originally designed and implemented by Malcolm Beattie, mbeattie@sable.ox.ac.uk as part of Safe\nversion 1.\n\nSplit out from Safe module version 1, named opcode tags and other changes added by Tim Bunce.\n",
            "subsections": []
        }
    },
    "summary": "Opcode - Disable named opcodes when compiling perl code",
    "flags": [],
    "examples": [],
    "see_also": []
}