/ 
Punk-0.19

Changes for version 0.19 - 2026-08-18

  • SECURITY: a session had no server-side lifetime. `expires` set only the cookie's Max-Age, which is a request to a client that is free to ignore it - the signature carried no time at all, so a cookie captured once (a shared machine, a log, a backup, a proxy) stayed valid for as long as the secret did, and session_expire only asked the browser to forget a value that still authenticated. The expiry is now stamped inside the signed payload
  • New $c->safe_path($path, $fallback?): returns the path when it is same-origin and relative, otherwise the fallback. Punk had no such guard while auth_guard hands every application a ?to= to redirect to, which made the obvious login form an open redirect. Same rules as Punk::OAuth2's same_origin_path, for the same reasons (CVE-2026-75628)
  • The static traversal guard splits segments on a backslash as well as a slash. On POSIX "..\.." is one ordinary filename and traverses nothing, but Windows reads it as a separator, so a guard that split on "/" alone saw one harmless segment where the OS would see two levels up.
  • New hook phase `before_request`, which runs BEFORE routing:
    • hook before_request => sub { my ($c) = @_; $c->stash->{t0} = Time::HiRes::time(); return; };
    • The earliest phase until now was before_dispatch, which runs only after the router has matched - so nothing could observe a request from its start, and nothing ran at all for a 404, a 405, or anything answered by a PSGI or static mount. before_request runs for all of those.
  • The logger takes a record: a lone unblessed hashref is a set of fields, and its `message` key is the message.
    • $c->log->info({ message => 'listing books', books => 12, user => $id });

Documentation

punk
the Punk command line

Modules

Punk
a MVC web framework
Punk::App
the per-application registry and boot compiler
Punk::Auth
the authentication battery
Punk::Auth::Password
password hashing
Punk::CORS
cross-origin resource sharing
Punk::CSRF
single-use CSRF tokens
Punk::Command
the punk command line: registry, dispatcher and commands
Punk::Config
YAML configuration with secrets kept out of the file
Punk::Context
the per-request object
Punk::Controller
base class for Punk controllers
Punk::DevError
the development error page
Punk::Future
an async result that runs on the loop, or blocks
Punk::Generate
scaffold a new Punk application
Punk::Headers
security response headers
Punk::Logger
a level-based logger
Punk::Model
the storage-agnostic model tier
Punk::Model::DBI
the default DBI backend for Punk models
Punk::Model::DBIx::Loop
a non-blocking backend for Punk models
Punk::Mount::Markdown
a directory of markdown as a documentation site
Punk::Mount::OpenAPI
the api mount: spec-first operations
Punk::Plugin
base class for Punk plugins
Punk::RateLimit
rate limiting and IP blocking over Hyperman's shared arena
Punk::Request
a lazy wrapper over the PSGI environment
Punk::Response
a response builder
Punk::Router
the compiled-at-boot route tables (XS)
Punk::Router::Scope
the handle an under returns
Punk::SSE
a Server-Sent Events stream
Punk::SendFile::Reader
the bounded body of a ranged send_file response
Punk::Session
signed cookie sessions
Punk::Static
serving files from a directory
Punk::Test
an in-process test client for Punk applications
Punk::Test::WS
a pure-Perl RFC 6455 codec for testing WebSocket servers
Punk::Test::WS::Conn
the client side of one WebSocket connection
Punk::UA
the outbound HTTP agent on the context
Punk::Upload
an uploaded file from a multipart form
Punk::Validate
collecting request validation
Punk::View::Stencil
the Template::Stencil view engine
Punk::Views
the pluggable view engine registry (XS)
Punk::WebSocket
a WebSocket connection
Punk::WebSocket::Room
pub/sub groups of WebSocket connections

Provides

BenchCat
in bench/apps/cat-lib/BenchCat.pm
BenchCat::Controller::Root
in bench/apps/cat-lib/BenchCat/Controller/Root.pm

Examples

Other files