/ 
Punk-0.16
/ Punk::SendFile::Reader
Security Advisories (1)
CVE-2026-75870 (2026-08-22)

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back both default that key to the empty string, so a declaration with no secret option, or with an undefined or empty one, signs and verifies with a zero-length HMAC-SHA256 key. An attacker who knows the cookie format can then mint one offline carrying any contents the session holds, such as a user identifier or a role. Nothing marks the misconfiguration at runtime: cookies are well formed and sessions round-trip as expected.

NAME

Punk::SendFile::Reader - the bounded body of a ranged send_file response

DESCRIPTION

You never construct one of these. When $c->send_file answers a Range request from a file it cannot hand the server a plain filehandle - a PSGI server reads a filehandle body to end of file, and a 206 must stop at the end of the range. This object is the PSGI body protocol over exactly that window: getline returns successive chunks of up to 64KB until the range is spent, then undef; close closes the underlying handle. The handle is also closed when the object is freed.

A server that streams bodies natively never reads it chunkwise at all: fileno exposes the descriptor, and together with the response's Content-Length that is the whole window.

The class lives in the C core (punk_sendfile.h, xs/sendfile.xs); this file is documentation.

METHODS

getline

The next chunk (at most 64KB, never past the range), or undef when the range is spent.

close

Close the underlying filehandle. getline afterwards returns undef.

fileno

The underlying file descriptor, or -1 once closed. A server that streams natively (Hyperman 0.20+) uses fileno plus the response's Content-Length to send the range straight from the file - the fd's current position is the start of the window - and never calls getline at all.

SEE ALSO

"send_file" in Punk::Context

AUTHOR

LNATION <email@lnation.org>

LICENSE AND COPYRIGHT

This software is Copyright (c) 2026 by LNATION.

This is free software, licensed under:

The Artistic License 2.0 (GPL Compatible)