/ 
Dancer2-0.204003
⭐ Starred 552 / Dancer2::Serializer::Mutable
Security Advisories (2)
CPANSA-Dancer2-2018-01 (2018-01-30)

There is a potential RCE with regards to Storable. We have added session ID validation to the session engine so that session backends based on Storable can reject malformed session IDs that may lead to exploitation of the RCE.

CVE-2026-13577 (2026-07-20)

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id when both Math::Random::ISAAC::XS and Crypt::URandom are unavailable. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.

NAME

Dancer2::Serializer::Mutable - Serialize and deserialize content based on HTTP header

VERSION

version 0.204003

SYNOPSIS

# in config.yml
serializer: Mutable

# in the app
put '/something' => sub {
    # deserialized from request
    my $name = param( 'name' );

    ...

    # will be serialized to the most
    # fitting format
    return { message => "user $name added" };
};

DESCRIPTION

This serializer will try find the best (de)serializer for a given request. For this, it will pick the first valid content type found from the following list and use its related serializer.

  • The content_type from the request headers

  • the accept from the request headers

  • The default is application/json

The content-type/serializer mapping that Dancer2::Serializer::Mutable uses is

serializer                  | content types
----------------------------------------------------------
Dancer2::Serializer::YAML   | text/x-yaml, text/html
Dancer2::Serializer::Dumper | text/x-data-dumper
Dancer2::Serializer::JSON   | text/x-json, application/json

INTERNAL METHODS

The following methods are used internally by Dancer2 and are not made accessible via the DSL.

serialize

Serialize a data structure. The format it is serialized to is determined automatically as described above. It can be one of YAML, Dumper, JSON, defaulting to JSON if there's no clear preference from the request.

deserialize

Deserialize the provided serialized data to a data structure. The type of serialization format depends on the request's content-type. For now, it can be one of YAML, Dumper, JSON.

content_type

Returns the content-type that was used during the last serialize / deserialize call. WARNING : you must call serialize / deserialize before calling content_type. Otherwise the return value will be undef.

NAME

Dancer2::Serializer::Mutable - Serialize and deserialize content using the appropriate HTTP header (ported from Dancer)

AUTHOR

Dancer Core Developers

COPYRIGHT AND LICENSE

This software is copyright (c) 2016 by Alexis Sukrieh.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.