/ 
Dancer2-0.400000
⭐ Starred 552 / Dancer2::Core::Role::Serializer
Security Advisories (1)
CVE-2026-13577 (2026-07-20)

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id when both Math::Random::ISAAC::XS and Crypt::URandom are unavailable. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.

NAME

Dancer2::Core::Role::Serializer - Role for Serializer engines

VERSION

version 0.400000

DESCRIPTION

Any class that consumes this role will be able to be used as a serializer under Dancer2.

In order to implement this role, the consumer must implement the methods serialize and deserialize, and should define the content_type attribute value.

ATTRIBUTES

content_type

The content type of the object after being serialized. For example, a JSON serializer would have a application/json content type defined.

METHODS

serialize($content, [\%options])

The serialize method need to be implemented by the consumer. It receives the serializer class object and a reference to the object to be serialized. Should return the object after being serialized, in the content type defined by the content_type attribute.

A third optional argument is a hash reference of options to the serializer.

The serialize method must return bytes and therefore has to handle any encoding.

deserialize($content, [\%options])

The inverse method of serialize. Receives the serializer class object and a string that should be deserialized. The method should return a reference to the deserialized Perl data structure.

A third optional argument is a hash reference of options to the serializer.

The deserialize method receives encoded bytes and must therefore handle any decoding required.

CONFIGURATION

The serializer configuration variable tells Dancer2 which engine to use.

You can change it either in your config.yml file:

#Set JSON engine
serializer: "JSON"

# Prettify JSON output
engines:
  serializer:
    JSON:
      pretty: 1

To know which engines are availables please see "Serializers" in Dancer2::Manual

AUTHOR

Dancer Core Developers

COPYRIGHT AND LICENSE

This software is copyright (c) 2022 by Alexis Sukrieh.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.