/ 
Plack-Middleware-Security-Simple-v0.5.0
⭐ Starred 2
Security Advisories (1)
CVE-2026-9658 (2026-05-28)

Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example, GET /path\r\nHTTP/1.1\r\nHost: secret.example.com Note that it is unclear whether request paths with CRLF followed by additional headers would be blocked by reverse proxies, or how they would be processed by Plack-based servers.

Changes for version v0.5.0 - 2021-10-19

  • Enhancements
    • Add .yml files to the misc_extensions rule.
    • Add .mv and .mvc to the script_extensions rule.
    • Add ip_address_referer rule.
  • Documentation
    • Gave an example of adding an exception to a rule, GH#3.
  • Tests
    • Add text cases.

Documentation

README.md

Modules

Plack::Middleware::Security::Common
A simple security filter for with common rules.
Plack::Middleware::Security::Simple
A simple security filter for Plack

Other files