/ 
Dancer2-2.1.0
⭐ Starred 552 / Dancer2::ConfigReader::Config::Any
Security Advisories (1)
CVE-2026-13577 (2026-07-20)

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.

NAME

Dancer2::ConfigReader::Config::Any - Config reader for files

VERSION

version 2.1.0

DESCRIPTION

This class is an implementation of Dancer2::Core::Role::ConfigReader. It reads the configuration files of Dancer2.

Please see Dancer2::Config for more information.

If you need to add additional functionality to the reading mechanism, you can extend this class. An example of this is providing the possibility to replace random parts of the file config with environmental variables:

package Dancer2::ConfigReader::File::Extended;

use Moo;
use Dancer2::Core::Types;

use Carp 'croak';

extends 'Dancer2::ConfigReader::Config::Any';

has name => (
    is      => 'ro',
    isa     => Str,
    lazy    => 0,
    default => sub {'File::Extended'},
);

around read_config => sub {
    my ($orig, $self) = @_;
    my $config = $orig->($self, @_);
    $self->_replace_env_vars($config);
    return $config;
};

# Attn. We are traversing along the original data structure all the time,
# using references, and changing values on the spot, not returning anything.
sub _replace_env_vars {
    my ( $self, $entry ) = @_;
    if( ref $entry ne 'HASH' && ref $entry ne 'ARRAY' ) {
        croak 'Param entry is not HASH or ARRAY';
    }
    if( ref $entry eq 'HASH' ) {
        foreach my $value (values %{ $entry }) {
            if( (ref $value) =~ m/(HASH|ARRAY)/msx ) {
                    $self->_replace_env_vars( $value );
                } elsif( (ref $value) =~ m/(CODE|REF|GLOB)/msx ) {
                    # Pretty much anything else except SCALAR. Do nothing
                    1;
                } else {
                    if( $value ) {
                        while( my ($k, $v) = each %ENV) {
                            $value =~ s/ \$ [{] ENV:$k [}] /$v/gmsx;
                        }
                    }
                }
            }
        } else {
            # ref $entry is 'ARRAY'
            foreach my $value (@{ $entry }) {
                if( (ref $value) =~ m/(HASH|ARRAY)/msx ) {
                        $self->_replace_env_vars( $value );
                } elsif( (ref $value) =~ m/(CODE|REF|GLOB)/msx ) {
                    # Pretty much anything else except SCALAR. Do nothing
                    1;
                } else {
                    if( $value ) {
                        while( my ($k, $v) = each %ENV) {
                            $value =~ s/ \$ [{] ENV:$k [}] /$v/gmsx;
                        }
                    }
                }
            }
        }
    return;
}

1;

ATTRIBUTES

name

The name of the Config Reader class: Config::Any.

location

Absolute path to the directory where the server started.

config_location

Gets the location from the configuration. Same as $object->location.

environments_location

Gets the directory where the environment files are stored.

environment

Returns the name of the environment.

config_files

List of all the configuration files.

METHODS

read_config

Load the configuration files.

AUTHOR

Dancer Core Developers

COPYRIGHT AND LICENSE

This software is copyright (c) 2026 by Alexis Sukrieh.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.