/ 
Punk-0.52
/ Punk::Controller
Security Advisories (1)
CVE-2026-104380 (2026-10-06)

Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one. On HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The Origin check runs only when a websocket route matches. On this transport the handler's status is the handshake response, and a 2xx accepts it. A cross-origin page can open a WebSocket to any path and learn from its open or error event whether that path returns 2xx.

NAME

Punk::Controller - base class for Punk controllers

SYNOPSIS

package MyApp::Controller::Web::Book;
use Punk::Controller;

sub list {
    my ($c) = @_;
    my $page = $c->model('Book')->search({}, { limit => 20 });
    return $c->render('book/list', { books => $page->{rows} });
}

1;

DESCRIPTION

Controller methods are plain subs receiving the Punk::Context - no instance, no dispatch overhead; the coderef is resolved once at to_app and called directly per request. The base class marks the package as a controller and is the natural home for shared helper subs an app wants every controller to inherit.

use Punk::Controller makes the caller a controller and turns on strict and warnings, the way use Punk::Model does for a model. The older form still works and is unchanged:

use parent 'Punk::Controller';   # same base class, no pragmas

so existing controllers need no edit; the one-line form is simply what the scaffolder writes now.

Route targets name controllers relative to the application's Controller:: namespace: 'Web::Book#list' in MyApp resolves to MyApp::Controller::Web::Book::list. A fully qualified name (one that already starts with the namespace) passes through unchanged.

AUTHOR

LNATION <email@lnation.org>

LICENSE AND COPYRIGHT

This software is Copyright (c) 2026 by LNATION <email@lnation.org>.

This is free software, licensed under:

The Artistic License 2.0 (GPL Compatible)