/ 
Dancer-1.3521 UNAUTHORIZED RELEASE
⭐ Starred 738
Security Advisories (1)
CVE-2026-5080 (2026-04-30)

Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely. The session id is generated from summing the character codepoints of the absolute pathname with the process id, the epoch time and calls to the built-in rand() function to return a number between 0 and 999-billion, and concatenating that result three times. The path name might be known or guessed by an attacker, especially for applications known to be written using Dancer with standard installation locations. The epoch time can be guessed by an attacker, and may be leaked in the HTTP header. The process id comes from a small set of numbers, and workers may have sequential process ids. The built-in rand() function is seeded with 32-bits and is considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.

Changes for version 1.3521 - 2023-02-05

  • BUG FIXES
    • Fix test failures in t/14_serializer/04_request_xml.t (GH #1239, cromedome, thanks to gregoa & Debian team)

Documentation

dancer
helper script to create new Dancer applications
Dancer::Cookbook
a quick-start guide to the Dancer web framework
Dancer::Deployment
common ways to put your Dancer app into use
Dancer::Development
guide for developers interested in contributing
Dancer::Development::Integration
guide for Dancer's core-team members
Dancer::Introduction
A gentle introduction to Dancer
Dancer::Plugins
interesting plugins to add to Dancer's capabilities
Dancer::Policy
Dancer core and community policy and standards of conduct
Dancer::Tutorial
An example to get you dancing

Modules

Dancer
lightweight yet powerful web application framework UNAUTHORIZED
Dancer::App
Base application class for Dancer. UNAUTHORIZED
Dancer::Config
how to configure Dancer to suit your needs UNAUTHORIZED
Dancer::Config::Object
Access the config via methods instead of hashrefs UNAUTHORIZED
Dancer::Continuation
Continuation exception (internal exception) for Dancer UNAUTHORIZED
Dancer::Continuation::Halted
Halted internal exception class for Dancer UNAUTHORIZED
Dancer::Continuation::Route
Internal exception class for Route exceptions in Dancer. UNAUTHORIZED
Dancer::Continuation::Route::ErrorSent
Internal Dancer exception class UNAUTHORIZED
Dancer::Continuation::Route::FileSent
Internal Dancer exception class UNAUTHORIZED
Dancer::Continuation::Route::Forwarded
Internal Dancer exception class UNAUTHORIZED
Dancer::Continuation::Route::Passed
Internal Dancer exception class UNAUTHORIZED
Dancer::Continuation::Route::Templated
Internal Dancer exception class UNAUTHORIZED
Dancer::Cookie
class representing cookies UNAUTHORIZED
Dancer::Cookies
a singleton storage for all cookies UNAUTHORIZED
Dancer::Deprecation
handle deprecation messages UNAUTHORIZED
Dancer::Engine
base class for Dancer engines UNAUTHORIZED
Dancer::Error
class for representing fatal errors UNAUTHORIZED
Dancer::Exception
class for throwing and catching exceptions UNAUTHORIZED
Dancer::Exception::Base
the base class of all Dancer exceptions UNAUTHORIZED
Dancer::Factory::Hook
Singleton class to create Dancer hooks UNAUTHORIZED
Dancer::FileUtils
helper providing file utilities UNAUTHORIZED
Dancer::GetOpt
Process command-line options for Dancer scripts UNAUTHORIZED
Dancer::HTTP
helper for rendering HTTP status codes for Dancer UNAUTHORIZED
Dancer::Handler
Dancer request handler UNAUTHORIZED
Dancer::Handler::Debug
a debug handler for easy tracing UNAUTHORIZED
Dancer::Handler::PSGI
a PSGI handler for Dancer applications UNAUTHORIZED
Dancer::Handler::Standalone
Web server wrapper for Dancer UNAUTHORIZED
Dancer::Hook
Class to manipulate hooks with Dancer UNAUTHORIZED
Dancer::Hook::Properties
Properties attached to a hook UNAUTHORIZED
Dancer::Logger
common interface for logging in Dancer UNAUTHORIZED
Dancer::Logger::Abstract
Abstract logging engine for Dancer UNAUTHORIZED
Dancer::Logger::Capture
Capture dancer logs UNAUTHORIZED
Dancer::Logger::Capture::Trap
a place to store captured Dancer logs UNAUTHORIZED
Dancer::Logger::Console
console-based logging engine for Dancer UNAUTHORIZED
Dancer::Logger::Diag
Test::More diag() logging engine for Dancer UNAUTHORIZED
Dancer::Logger::File
file-based logging engine for Dancer UNAUTHORIZED
Dancer::Logger::Note
Test::More note() logging engine for Dancer UNAUTHORIZED
Dancer::Logger::Null
blackhole-like silent logging engine for Dancer UNAUTHORIZED
Dancer::MIME
Singleton object to handle MimeTypes UNAUTHORIZED
Dancer::ModuleLoader
dynamic module loading helpers for Dancer core components UNAUTHORIZED
Dancer::Object
Objects base class for Dancer UNAUTHORIZED
Dancer::Object::Singleton
Singleton base class for Dancer UNAUTHORIZED
Dancer::Plugin
helper for writing Dancer plugins UNAUTHORIZED
Dancer::Plugin::Ajax
a plugin for adding Ajax route handlers UNAUTHORIZED
Dancer::Renderer
Rendering class for Dancer UNAUTHORIZED
Dancer::Request
interface for accessing incoming requests UNAUTHORIZED
Dancer::Request::Upload
class representing file uploads requests UNAUTHORIZED
Dancer::Response
Response object for Dancer UNAUTHORIZED
Dancer::Route
Class to represent a route in Dancer UNAUTHORIZED
Dancer::Route::Cache
route caching mechanism for Dancer UNAUTHORIZED
Dancer::Route::Registry
Route registry for Dancer UNAUTHORIZED
Dancer::Serializer
serializer wrapper for Dancer UNAUTHORIZED
Dancer::Serializer::Abstract
Base serialiser class for Dancer UNAUTHORIZED
Dancer::Serializer::Dumper
Data::Dumper serialisation for Dancer UNAUTHORIZED
Dancer::Serializer::JSON
serializer for handling JSON data UNAUTHORIZED
Dancer::Serializer::JSONP
serializer for handling JSONP data UNAUTHORIZED
Dancer::Serializer::Mutable
Serialize and deserialize content using the appropriate HTTP header UNAUTHORIZED
Dancer::Serializer::XML
serializer for handling XML data UNAUTHORIZED
Dancer::Serializer::YAML
serializer for handling YAML data UNAUTHORIZED
Dancer::Session
session engine for the Dancer framework UNAUTHORIZED
Dancer::Session::Abstract
abstract class for session engine UNAUTHORIZED
Dancer::Session::Simple
in-memory session backend for Dancer UNAUTHORIZED
Dancer::Session::YAML
YAML-file-based session backend for Dancer UNAUTHORIZED
Dancer::SharedData
Shared-data singleton for Dancer UNAUTHORIZED
Dancer::Template
template wrapper for Dancer UNAUTHORIZED
Dancer::Template::Abstract
abstract class for Dancer's template engines UNAUTHORIZED
Dancer::Template::Simple
pure Perl 5 template engine for Dancer UNAUTHORIZED
Dancer::Template::TemplateToolkit
Template Toolkit wrapper for Dancer UNAUTHORIZED
Dancer::Test
Test helpers to test a Dancer application UNAUTHORIZED
Dancer::Timer
a timer for Dancer UNAUTHORIZED
HTTP::Tiny::NoProxy
UNAUTHORIZED

Examples

Other files