/ 
Punk-0.52
/ Punk::Test::WS::Conn
Security Advisories (1)
CVE-2026-104380 (2026-10-06)

Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one. On HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The Origin check runs only when a websocket route matches. On this transport the handler's status is the handshake response, and a 2xx accepts it. A cross-origin page can open a WebSocket to any path and learn from its open or error event whether that path returns 2xx.

NAME

Punk::Test::WS::Conn - the client side of one WebSocket connection

SYNOPSIS

my $conn = Punk::Test::WS::Conn->new(sock => $s, timeout => 5);
my $hdr  = $conn->read_headers;   # the raw HTTP header block
$conn->send_frame(opcode => 1, payload => 'hi');
my $f = $conn->read_frame;        # one decoded frame
$conn->close;

DESCRIPTION

A connected socket wrapped with a read buffer and a timeout, speaking the Punk::Test::WS codec from the client's side. Punk::Test builds one over either of its transports - an in-process socketpair or a live TCP connection - and the assertion methods drive it. Every read carries the timeout, so a server that goes quiet fails the test instead of hanging it.

METHODS

new(%args)

sock (the connected socket), timeout (seconds per read, default 5), pid (a child process to reap when the connection closes, for transports that forked one).

sock

The underlying socket.

read_headers

Read until a full HTTP header block (\r\n\r\n) has arrived; returns it raw - empty on EOF or timeout.

send_frame(%args)

Encode one client frame (masked, as a client must - the arguments are "encode_client" in Punk::Test::WS's) and write it. Returns what syswrite returned.

read_frame

One decoded frame off the wire, buffering as needed; undef on timeout or EOF. A protocol violation in the stream dies with the codec's error name.

close

Close the socket and reap the child, if this connection owns one. Called on destruction.

SEE ALSO

Punk::Test, Punk::Test::WS.

AUTHOR

LNATION <email@lnation.org>

LICENSE AND COPYRIGHT

This software is Copyright (c) 2026 by LNATION <email@lnation.org>.

This is free software, licensed under:

The Artistic License 2.0 (GPL Compatible)