/ 
Robots-Validate-v0.3.3-TRIAL
⭐ Starred 0
Security Advisories (1)
CVE-2026-82309 (2026-09-04)

Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries. _check_dns issues one PTR query for the client address, keeps the returned names matching the rule's domain, and issues a forward query for each until one resolves back to that address. Nothing bounds that list, and a client controls the reverse zone for its own address, so it chooses how many names the PTR answer holds. Net::DNS refetches a truncated answer over TCP by default, so the 512-byte UDP payload does not cap it either. Any client whose User-Agent matches a rule with a domain reaches _check_dns. Each forward name is distinct and client-chosen, so every query misses the local cache and is resolved against the authoritative servers for that domain. The queries are synchronous, so the caller is held until all of them answer or time out.

Changes for version v0.3.3 - 2026-08-24 (TRIAL RELEASE)

  • Enhancements
    • Updated robot data.
    • Added devel/rebuild-robots-config utility to rebuild the data.
    • Switched the configuration parser to use TOML::Tiny by default, but TOML::XS if it is available.
  • Documentation
    • Improved documentation.
  • Tests
    • Added a missing prerequsite.
    • Improved tests.

Changes for version v0.3.2 - 2026-08-23 (TRIAL RELEASE)

  • Security
    • Added missing initial dot to the domain suffixes for petalbot and visionheight, which allowed an imposter domain such as fakepetalsearch.com.
  • Bug Fixes
    • Fixed IPv6 DNS validation.
  • Documentation
    • Removed duplicate CONTRIBUTOR.
    • Documented why the initial dot for the domain suffix is important.
    • Improved the SECURITY CONSIDERATIONS section.
    • Updated automation policy to be "human supervised".
    • Added link to TOML specification in SEE ALSO.

Changes for version v0.3.1 - 2026-08-23 (TRIAL RELEASE)

  • Documentation
    • Fixed error in Changes.

Changes for version v0.3.0 - 2026-08-23 (TRIAL RELEASE)

  • Incompatible Changes
    • This is a complete rewrite, and the interface is not compatible.
    • Bumped minimum Perl version to v5.24;
  • Enhancements
    • This uses the Aho-Corasick algorithm to match multiple user-agent strings efficiently.
    • The robot rules are in a configuration file, allowing the user to easily update their own rules.
  • Tests
    • Updated the tests to use Test2.
  • Documentation
    • Updated the author email address.
    • Updated the copyright year.
    • Added a security policy.
  • Toolchain
    • Use SigStore instead of Module::Signature to sign releases.
    • Added Automation Policy and DOAP metadata.

Documentation

README.md
SECURITY.md
rebuild-robots-config

Modules

Robots::Validate
Validate that IP addresses are associated with known robots

Other files