/ 
Punk-0.16
/ Punk::Views
Security Advisories (1)
CVE-2026-75870 (2026-08-22)

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back both default that key to the empty string, so a declaration with no secret option, or with an undefined or empty one, signs and verifies with a zero-length HMAC-SHA256 key. An attacker who knows the cookie format can then mint one offline carrying any contents the session holds, such as a user identifier or a role. Nothing marks the misconfiguration at runtime: cookies are well formed and sessions round-trip as expected.

NAME

Punk::Views - the pluggable view engine registry (XS)

DESCRIPTION

Each views $name => \%opts call in the DSL registers one engine. $name resolves to Punk::View::$name; '+Full::Class' uses the class as written. The engine contract is two methods and nothing more - adding view backends never touches the dispatch path:

my $engine = Engine->new(\%opts);
my $bytes  = $engine->render($template_name, \%data);

The first registered engine is the default; $c->render($tpl, \%data, engine => 'Other') selects per render, type => '...' overrides the content type, status => ... the status. Everything resolves and croaks at to_app, never per request.

Implemented entirely in C (include/punk/punk_views.h): the object is a blessed IV-ref to the engine registry, and render - the hot path - looks the engine up, calls its render, and assembles the PSGI triplet in C, so a rendered page crosses the Perl boundary only for the engine's own render (itself XS in Template::Stencil).

METHODS

new(\@pairs)

Compile the registry from [ [ $name, \%opts ], ... ]. Resolves, loads and instantiates each engine; the first is the default. Duplicate names, a class that will not load, or one missing new/render croak.

engine($name?)

The named (or default) engine instance; unknown names croak listing what is registered.

default

The default engine's name.

render($c, $template, \%data, %overrides)

A finished PSGI triplet around the engine's bytes, folding in any status and headers pending on the context $c (which may be undef). Overrides: status, type, engine.

AUTHOR

LNATION <email@lnation.org>

LICENSE AND COPYRIGHT

This software is Copyright (c) 2026 by LNATION <email@lnation.org>.

This is free software, licensed under:

The Artistic License 2.0 (GPL Compatible)