/ 
Punk-0.10
Security Advisories (1)
CVE-2026-75870 (2026-08-22)

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back both default that key to the empty string, so a declaration with no secret option, or with an undefined or empty one, signs and verifies with a zero-length HMAC-SHA256 key. An attacker who knows the cookie format can then mint one offline carrying any contents the session holds, such as a user identifier or a role. Nothing marks the misconfiguration at runtime: cookies are well formed and sessions round-trip as expected.

Changes for version 0.10 - 2026-08-15

  • Development error pages (Punk::DevError): in development a die renders an HTML debug page
  • The environment now defaults to production; development is an opt-in: punk dev sets PUNK_ENV=development for its server, or set it yourself in the Env.
  • Punk::Validate: request validation, all in C on the JSON::Schema::Fast C ABI. $c->validate($schema) collects into a Result - errors in the Open::API shape plus name, valid() hands back typed filtered params - and a bare $c->validate reads the Result a route-level check stashed. Routes take an options hashref: get '/x' => $target, { validate => \%schema } (or { schema, source, on_invalid }), compiled once at to_app and run as a C guard after any auth guards; failures answer the OpenAPI-mount-shaped 400 or the on_invalid target.
  • New on_not_found keyword: the on_error contract for a 404 so you can return a custom response
  • The getentropy probe now links instead of only compiling. FreeBSD before 12 has no getentropy and its old compilers take the implicit declaration as a warning, so 0.09's compile-only probe false-positived and the .so failed to load with "Undefined symbol getentropy".

Modules

Punk
a MVC web framework
Punk::App
the per-application registry and boot compiler
Punk::CORS
cross-origin resource sharing
Punk::CSRF
single-use CSRF tokens
Punk::Command
the subcommands behind the punk tool
Punk::Config
YAML configuration with secrets kept out of the file
Punk::Context
the per-request object
Punk::Controller
base class for Punk controllers
Punk::DevError
the development error page
Punk::Future
an async result that runs on the loop, or blocks
Punk::Generate
scaffold a new Punk application
Punk::Logger
a level-based logger
Punk::Model
the storage-agnostic model tier
Punk::Model::DBI
the default DBI backend for Punk models
Punk::Model::DBIx::Loop
a non-blocking backend for Punk models
Punk::Mount::Markdown
a directory of markdown as a documentation site
Punk::Mount::OpenAPI
the api mount: spec-first operations
Punk::Plugin
base class for Punk plugins
Punk::RateLimit
rate limiting and IP blocking over Hyperman's shared arena
Punk::Request
a lazy wrapper over the PSGI environment
Punk::Response
a response builder
Punk::Router
the compiled-at-boot route tables (XS)
Punk::Router::Scope
the handle an under returns
Punk::SSE
a Server-Sent Events stream
Punk::Session
signed cookie sessions
Punk::Static
serving files from a directory
Punk::Test
an in-process test client for Punk applications
Punk::Test::WS
a pure-Perl RFC 6455 codec for testing WebSocket servers
Punk::Test::WS::Conn
the client side of one WebSocket connection
Punk::UA
the outbound HTTP agent on the context
Punk::Upload
an uploaded file from a multipart form
Punk::Validate
collecting request validation
Punk::View::Stencil
the Template::Stencil view engine
Punk::Views
the pluggable view engine registry (XS)
Punk::WebSocket
a WebSocket connection
Punk::WebSocket::Room
pub/sub groups of WebSocket connections

Provides

BenchCat
in bench/apps/cat-lib/BenchCat.pm
BenchCat::Controller::Root
in bench/apps/cat-lib/BenchCat/Controller/Root.pm
Punk::Test::_Writer
in lib/Punk/Test.pm

Examples

Other files