Security Advisories (1)
CVE-2025-40925 (2025-09-20)

Starch versions 0.14 and earlier generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with a counter, the epoch time, the built-in rand function, the PID, and internal Perl reference addresses. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

Changes for version 0.04 - 2015-07-21

  • Update state's in_store if the store did not find any data. This should provide some minor performance improvements and correct behavior.
  • Moved the hash_seed and generate_id methods into the manager.
  • Renamed invalid key to no_store key, which means its named after what it causes rather than what it is used for (an anti- pattern of sorts, but this key will be used for more general purpose stuff).
  • Added a mark_dirty method to state.
  • Moved stringify_key and key_separator from manager to store.
  • Increase test coverage.

Documentation

Starch recipes for common situations.
How to alter the behavior of Starch.
Implementation independent persistent statefulness.

Modules

Implementation independent persistent statefulness.
Role applicator and class creator.
Entry point for accessing Starch state objects.
Always retrieve state data.
Base role for Starch plugin bundles.
Arguments and methods for dealing with HTTP cookies.
Disable store read and/or write operations.
Base role for Starch plugins.
Base role for Starch::State plugins.
Base role for Starch::Store plugins.
Turn Starch store exceptions into log messages.
Trigger periodic writes to the store.
Throttle misbehaving Starch stores.
Throw an exception if store access surpass a timeout.
Add extra trace logging to your manager, states, and stores.
Logging capabilities used internally by Starch.
General purpose method proxy support used internally by Starch.
The Starch state object.
Base role for Starch stores.
Layer multiple Starch stores.
In-memory Starch store.
Utility functions used internally by Starch.
Test core features of starch.