/ 
Starch-0.14
River stage two • 10 direct dependents • 10 total dependents
⭐ Starred 3 GitHub stars
/ Starch::Plugin::DisableStore
Security Advisories (1)
CVE-2025-40925 (2025-09-20)

Starch versions 0.14 and earlier generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with a counter, the epoch time, the built-in rand function, the PID, and internal Perl reference addresses. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

NAME

Starch::Plugin::DisableStore - Disable store read and/or write operations.

SYNOPSIS

my $starch = Starch->new(
    plugins => ['::DisableStore'],
    store => {
        class => ...,
        disable_set => 1,
    },
);

DESCRIPTION

This plugin provides the ability to make stores silently fail read and write operations. This can be useful for migrating from one store to another where it doesn't make sense to write to the old store, only read.

OPTIONAL STORE ARGUMENTS

These arguments are added to classes which consume the Starch::Store role.

disable_set

Setting this to true makes the set method silently fail.

disable_get

Setting this to true makes the get method silently fail and return undef.

disable_remove

Setting this to true makes the remove method silently fail.

SUPPORT

See "SUPPORT" in Starch.

AUTHORS

See "AUTHORS" in Starch.

COPYRIGHT AND LICENSE

See "COPYRIGHT AND LICENSE" in Starch.