/ 
Robots-Validate-v0.3.5-TRIAL
⭐ Starred 0
Security Advisories (1)
CVE-2026-82309 (2026-09-04)

Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries. _check_dns issues one PTR query for the client address, keeps the returned names matching the rule's domain, and issues a forward query for each until one resolves back to that address. Nothing bounds that list, and a client controls the reverse zone for its own address, so it chooses how many names the PTR answer holds. Net::DNS refetches a truncated answer over TCP by default, so the 512-byte UDP payload does not cap it either. Any client whose User-Agent matches a rule with a domain reaches _check_dns. Each forward name is distinct and client-chosen, so every query misses the local cache and is resolved against the authoritative servers for that domain. The queries are synchronous, so the caller is held until all of them answer or time out.

Changes for version v0.3.5 - 2026-08-25 (TRIAL RELEASE)

  • Enhancements
    • This uses the pure-Perl Algorithm::AhoCorasick module, but will use Algorithm::AhoCorasick::XS if it is available.
    • Added bad_robot convenience method.
    • cache_failure can be set in the cache_options as a global default.
  • Bug Fixes
    • Fixed regression: cache_failure overwrote the default expires_in setting.
  • Documentation
    • Added recommended modules to the REQUIREMENTS section of the README.
    • Fixed POD errors.
    • Updated SUPPORT section errors.
  • Tests
    • Add tests for pure-Perl modules only.

Changes for version v0.3.4 - 2026-08-25 (TRIAL RELEASE)

  • Enhancements
    • Added the cache_failure option to invalidate.
    • This changes the behaviour of caching before v0.3.0.
    • Added more bots: Cotoyogi, MJ12Bot and SofyaBot.
  • Documentation
    • Added missing items to Changes for v0.3.0.
    • Updated KNOWN ISSUES.

Changes for version v0.3.3 - 2026-08-24 (TRIAL RELEASE)

  • Enhancements
    • Updated robot rules.
    • Added devel/rebuild-robots-config utility to rebuild the robot rules.
    • Switched the configuration parser to use TOML::Tiny by default, but TOML::XS if it is available.
  • Documentation
    • Improved documentation.
  • Tests
    • Added a missing prerequsite.
    • Improved tests.

Changes for version v0.3.2 - 2026-08-23 (TRIAL RELEASE)

  • Security
    • Added missing initial dot to the domain suffixes for petalbot and visionheight, which allowed an imposter domain such as fakepetalsearch.com.
  • Bug Fixes
    • Fixed IPv6 DNS validation.
  • Documentation
    • Removed duplicate CONTRIBUTOR.
    • Documented why the initial dot for the domain suffix is important.
    • Improved the SECURITY CONSIDERATIONS section.
    • Updated automation policy to be "human supervised".
    • Added link to TOML specification in SEE ALSO.

Changes for version v0.3.1 - 2026-08-23 (TRIAL RELEASE)

  • Documentation
    • Fixed error in Changes.

Changes for version v0.3.0 - 2026-08-23 (TRIAL RELEASE)

  • Incompatible Changes
    • This is a complete rewrite, and the interface is not compatible.
    • Bumped minimum Perl version to v5.24;
  • Enhancements
    • This uses the Aho-Corasick algorithm to match multiple user-agent strings efficiently.
    • The robot rules are in a configuration file, allowing the user to easily update their own rules.
    • The robot rules have been expanded and updated.
    • Support for caching the results has been added, GH#3.
  • Tests
    • Updated the tests to use Test2.
  • Documentation
    • Updated the author email address.
    • Updated the copyright year.
    • Added a security policy.
  • Toolchain
    • Use SigStore instead of Module::Signature to sign releases.
    • Added Automation Policy and DOAP metadata.

Documentation

README.md
SECURITY.md
rebuild-robots-config

Modules

Robots::Validate
Validate that IP addresses are associated with known robots

Other files