/ 
Punk-0.03
/ Punk::Plugin
Security Advisories (1)
CVE-2026-75870 (2026-08-22)

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back both default that key to the empty string, so a declaration with no secret option, or with an undefined or empty one, signs and verifies with a zero-length HMAC-SHA256 key. An attacker who knows the cookie format can then mint one offline carrying any contents the session holds, such as a user identifier or a role. Nothing marks the misconfiguration at runtime: cookies are well formed and sessions round-trip as expected.

NAME

Punk::Plugin - base class for Punk plugins

SYNOPSIS

package Punk::Plugin::RequestId;
use parent 'Punk::Plugin';

my $rid = 0;

sub register {
    my ($self, $app, $opts) = @_;
    $app->helper(rid => sub { my ($c) = @_; $c->stash->{rid} });
    $app->hook(before_dispatch => sub {
        my ($c) = @_;
        $c->stash->{rid} = ++$rid;
        return;
    });
}

1;

# in the app:
plugin 'RequestId';

DESCRIPTION

A plugin's register($plugin, $app, \%opts) runs at registration time and receives the same registrar surface the DSL keywords use - the Punk::App - so a plugin can do anything the app class can: add routes and under scopes, register view engines and model backends, hooks, middleware, on_error, and helpers.

Helpers registered with $app->helper(name => sub) become real methods on the application's context subclass, installed once at to_app - no AUTOLOAD, no per-request cost. A helper name that collides with a core Punk::Context method or another helper croaks at boot, naming both owners.

plugin 'Name' resolves to Punk::Plugin::Name; '+Full::Class' uses the class as written.

METHODS

new

Plain constructor; override freely.

register($app, \%opts)

Override this. Called once, at plugin time.

AUTHOR

LNATION <email@lnation.org>

LICENSE AND COPYRIGHT

This software is Copyright (c) 2026 by LNATION <email@lnation.org>.

This is free software, licensed under:

The Artistic License 2.0 (GPL Compatible)