/ 
Dancer2-2.1.0
⭐ Starred 552 / Dancer2::Serializer::Mutable
Security Advisories (1)
CVE-2026-13577 (2026-07-20)

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.

NAME

Dancer2::Serializer::Mutable - Serialize and deserialize content based on HTTP header

VERSION

version 2.1.0

SYNOPSIS

# in config.yml
serializer: Mutable

engines:
    serializer:
        Mutable:
            mapping:
                'text/x-yaml'        : YAML
                'text/html'          : YAML
                'text/x-data-dumper' : Dumper
                'text/x-json'        : JSON
                'application/json'   : JSON

# in the app
put '/something' => sub {
    # deserialized from request
    my $name = param( 'name' );

    ...

    # will be serialized to the most
    # fitting format
    return { message => "user $name added" };
};

DESCRIPTION

This serializer will try find the best (de)serializer for a given request. For this, it will pick the first valid content type found from the following list and use its related serializer.

  • The content_type from the request headers

  • the accept from the request headers

  • The default is application/json

The content-type/serializer mapping that Dancer2::Serializer::Mutable uses is

serializer                  | content types
----------------------------------------------------------
Dancer2::Serializer::YAML   | text/x-yaml, text/html
Dancer2::Serializer::Dumper | text/x-data-dumper
Dancer2::Serializer::JSON   | text/x-json, application/json

A different mapping can be provided via the config file. For example, the default mapping would be configured as

engines:
    serializer:
        Mutable:
            mapping:
                'text/x-yaml'        : YAML
                'text/html'          : YAML
                'text/x-data-dumper' : Dumper
                'text/x-json'        : JSON
                'application/json'   : JSON

The keys of the mapping are the content-types to serialize, and the values the serializers to use. Serialization for YAML, Dumper and JSON are done using internal Dancer mechanisms. Any other serializer will be taken to be as Dancer2 serialization class (minus the Dancer2::Serializer:: prefix) and an instance of it will be used to serialize/deserialize data. For example, adding Dancer2::Serializer::XML to the mapping would be:

engines:
    serializer:
        Mutable:
            mapping:
                'text/x-yaml'        : YAML
                'text/html'          : YAML
                'text/x-data-dumper' : Dumper
                'text/x-json'        : JSON
                'text/xml'           : XML

INTERNAL METHODS

The following methods are used internally by Dancer2 and are not made accessible via the DSL.

serialize

Serialize a data structure. The format it is serialized to is determined automatically as described above. It can be one of YAML, Dumper, JSON, defaulting to JSON if there's no clear preference from the request.

deserialize

Deserialize the provided serialized data to a data structure. The type of serialization format depends on the request's content-type. For now, it can be one of YAML, Dumper, JSON.

content_type

Returns the content-type that was used during the last serialize / deserialize call. WARNING : you must call serialize / deserialize before calling content_type. Otherwise the return value will be undef.

AUTHOR

Dancer Core Developers

COPYRIGHT AND LICENSE

This software is copyright (c) 2026 by Alexis Sukrieh.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.