/ 
Starch-0.01
⭐ Starred 3 / Starch::State
Security Advisories (1)
CVE-2025-40925 (2025-09-20)

Starch versions 0.14 and earlier generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with a counter, the epoch time, the built-in rand function, the PID, and internal Perl reference addresses. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

NAME

Starch::State - The Starch state object.

SYNOPSIS

my $state = $starch->state();
$state->data->{foo} = 'bar';
$state->save();
$state = $starch->state( $state->id() );
print $state->data->{foo}; # bar

DESCRIPTION

This is the state class used by "state" in Starch::Manager.

REQUIRED ARGUMENTS

manager

The Starch::Manager object that glues everything together. The state object needs this to get at configuration information and the stores. This argument is automatically set by "state" in Starch::Manager.

OPTIONAL ARGUMENTS

id

The state ID. If one is not specified then one will be built and the state will be considered new.

ATTRIBUTES

original_data

The state data at the point it was when the state object was first instantiated.

data

The state data which is meant to be modified.

expires

This defaults to "expires" in Starch::Manager and is stored in the "data" under the "expires_state_key" in Starch::Manager key.

modified

Whenever the state is "save"d this will be updated and stored in "data" under the "modified_state_key" in Starch::Manager.

created

When the state is created this is set and stored in "data" under the "created_state_key" in Starch::Manager.

in_store

Returns true if the state is expected to exist in the store (AKA, if the "id" argument was specified or "save" was called).

is_deleted

Returns true if "delete" has been called on this state.

is_dirty

Returns true if the state data has changed (if "original_data" and "data" are different).

is_loaded

This returns true if the "original_data" has been loaded up from the store. Note that "original_data" will be automatically loaded if "original_data", "data", or any methods that call them, are called.

is_saved

Returns true if the state was saved and is not dirty.

METHODS

save

If this state "is_dirty" this will save the "data" to the "store" in Starch::Manager.

force_save

Like "save", but saves even if "is_dirty" is not set.

reload

Clears "original_data" and "data" so that the next call to these will reload the state data from the store. If the state "is_dirty" then an exception will be thrown.

force_reload

Just like "reload", but reloads even if the state "is_dirty".

mark_clean

Marks the state as not "is_dirty" by setting "original_data" to "data".

rollback

Sets "data" to "original_data".

delete

Deletes the state from the "store" in Starch::Manager and marks it as "is_deleted". Throws an exception if not in_store.

force_delete

Just like "delete", but remove the state from the store even if the state is not "in_store".

set_expires

# Extend this state's expires duration by two hours.
$state->set_expires( $state->expires() + (2 * 60 * 60) );

Use this to set the state's expires to a duration different than the global expires set by "expires" in Starch::Manager. This is useful for, for example, to support a "Remember Me" checkbox that many login forms provide where the difference between the user checking it or not is just a matter of what the state's expires duration is set to.

Remember that the "expires" duration is a measurement, in seconds, of how long the state will live in the store since the last modification, and how long the cookie (if you are using cookies) will live since the last request.

The expires duration can be more than or less than the global expires, there is no artificial constraint.

hash_seed

Returns a fairly unique string used for seeding "id".

generate_id

Generates and returns a new state ID which is a SHA-1 hex digest of calling "hash_seed".

reset_id

This re-generates a new "id" and marks the "data" as dirty. Often this is used to avoid session fixation as part of authentication and de-authentication (login/logout).

AUTHORS AND LICENSE

See "AUTHOR" in Starch, "CONTRIBUTORS" in Starch, and "LICENSE" in Starch.