/ 
Dancer2-1.1.2
⭐ Starred 552 / Dancer2::Template::Tiny
Security Advisories (1)
CVE-2026-13577 (2026-07-20)

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id when both Math::Random::ISAAC::XS and Crypt::URandom are unavailable. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.

NAME

Dancer2::Template::Tiny - Template::Tiny engine for Dancer2

VERSION

version 1.1.2

SYNOPSIS

This template engine allows you to use Template::Tiny in Dancer2.

Template::Tiny is an implementation of a subset of Template::Toolkit (the major parts) which takes much less memory and is faster. If you're only using the main functions of Template::Toolkit, you could use Template::Tiny. You can also seamlessly move back to Template::Toolkit whenever you want.

However, Dancer2 uses a modified version of Template::Tiny, which is Dancer2::Template::Implementation::ForkedTiny. It adds 2 features :

  • opening and closing tag are now configurable

  • CodeRefs are evaluated and their results is inserted in the result.

You can read more on Dancer2::Template::Implementation::ForkedTiny.

To use this engine, all you need to configure in your Dancer2's config.yaml:

template: "tiny"

Of course, you can also set this while working using set:

# code code code
set template => 'tiny';

Since Dancer2 has internal support for a wrapper-like option with the layout configuration option, you can have a Template::Toolkit-like WRAPPER even though Template::Tiny doesn't really support it.

METHODS

render($template, \%tokens)

Renders the template. The first arg is a filename for the template file or a reference to a string that contains the template. The second arg is a hashref for the tokens that you wish to pass to Template::Toolkit for rendering.

SEE ALSO

Dancer2, Dancer2::Core::Role::Template, Template::Tiny, Dancer2::Template::Implementation::ForkedTiny.

AUTHOR

Dancer Core Developers

COPYRIGHT AND LICENSE

This software is copyright (c) 2024 by Alexis Sukrieh.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.