/ 
Starch-0.14
River stage two • 10 direct dependents • 10 total dependents
⭐ Starred 3 GitHub stars
/ Starch::Store::Memory
Security Advisories (1)
CVE-2025-40925 (2025-09-20)

Starch versions 0.14 and earlier generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with a counter, the epoch time, the built-in rand function, the PID, and internal Perl reference addresses. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

NAME

Starch::Store::Memory - In-memory Starch store.

DESCRIPTION

This store provides an in-memory store using a hash ref to store the data. This store is mostly here as a proof of concept and for writing tests against.

OPTIONAL ARGUMENTS

global

Set this to a true value to use a shared memory store for all instances of this class that enable this argument.

memory

This is the hash ref which is used for storing states. Defaults to a global hash ref if "global" is set, or a new hash ref if not.

METHODS

set

Set "set" in Starch::Store.

get

Set "get" in Starch::Store.

remove

Set "remove" in Starch::Store.

SUPPORT

See "SUPPORT" in Starch.

AUTHORS

See "AUTHORS" in Starch.

COPYRIGHT AND LICENSE

See "COPYRIGHT AND LICENSE" in Starch.