/ 
Dancer2-0.10
⭐ Starred 552 / Dancer2::Core::Role::Serializer
Security Advisories (2)
CPANSA-Dancer2-2018-01 (2018-01-30)

There is a potential RCE with regards to Storable. We have added session ID validation to the session engine so that session backends based on Storable can reject malformed session IDs that may lead to exploitation of the RCE.

CVE-2026-13577 (2026-07-20)

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.

NAME

Dancer2::Core::Role::Serializer - Role for Serializer engines

VERSION

version 0.10

DESCRIPTION

Any class that consumes this role will be able to be used as a serializer under Dancer2.

In order to implement this role, the consumer must implement the methods serialize, <deserialize> and loaded, and should define the content_type attribute value.

ATTRIBUTES

error

The error string in case the serializer is in error state.

content_type

The content type of the object after being serialized. For example, a JSON serializer would have a application/json content type defined.

METHODS

has_error

A predicate to check whether the serializer is in error state.

serialize($content, [\%options])

The serialize method need to be implemented by the consumer. It receives the serializer class object and a reference to the object to be serialized. Should return the object after being serialized, in the content type defined by the content_type attribute.

A third optional argument is a hash reference of options to the serializer.

deserialize($content, [\%options])

The inverse method of serialize. Receives the serializer class object and a string that should be deserialized. The method should return a reference to the deserialized Perl data structure.

A third optional argument is a hash reference of options to the serializer.

loaded

This method should return a boolean true value if the serializer is able to work. This method might verify the existence of some Perl module or some other detail. If everything needed for the serializer to work is present the method returns a true value. If not, returns a false value.

METHODS

AUTHOR

Dancer Core Developers

COPYRIGHT AND LICENSE

This software is copyright (c) 2013 by Alexis Sukrieh.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.