Security Advisories (1)
CPANSA-Dancer2-2018-01 (2018-01-30)

There is a potential RCE with regards to Storable. We have added session ID validation to the session engine so that session backends based on Storable can reject malformed session IDs that may lead to exploitation of the RCE.

Changes for version 0.200003 - 2016-07-05

  • BUG FIXES
    • PR #1198: Session::YAML should not accept bad session cookie value from client (Peter Mottram)
    • Require minimum version of YAML of 0.86 (to satisfy GH #899) and a maximum version of YAML 1.15. YAML 1.16 causes test failures as reported by CPAN Testers.
  • ENHANCEMENTS
    • Require minimum version of ExtUtils::MakeMaker of 7.1101 to support a range of prereq version numbers (rjbs, Jason Crome, Sawyer X)
  • DOCUMENTATION
    • GH #1193: Spelling correction (Gregor Herrmann)

Documentation

Configure Dancer2 to suit your needs
Example-driven quick-start to the Dancer2 web framework
A gentle introduction to Dancer2
common ways to put your Dancer app into use
Migrating from Dancer to Dancer2
Writing tests for Dancer2
Recommended Dancer2 plugins
Dancer core and community policy and standards of conduct
An example to get you dancing
Dancer2 command line interface

Modules

Lightweight yet powerful web application framework UNAUTHORIZED
Dancer2 cli application
create new Dancer2 application
Core libraries for Dancer2 2.0 UNAUTHORIZED
encapsulation of Dancer2 packages UNAUTHORIZED
A cookie representing class UNAUTHORIZED
Dancer2's Domain Specific Language (DSL) UNAUTHORIZED
Class for dispatching request to the appropriate route handler UNAUTHORIZED
Class representing fatal errors UNAUTHORIZED
Instantiate components by type and name UNAUTHORIZED
helper for rendering HTTP status codes for Dancer2 UNAUTHORIZED
Manipulate hooks with Dancer2 UNAUTHORIZED
Class to ease manipulation of MIME types UNAUTHORIZED
Interface for accessing incoming requests UNAUTHORIZED
Class representing file upload requests UNAUTHORIZED
Response object for Dancer2 UNAUTHORIZED
Config role for Dancer2 core objects
Role for DSL UNAUTHORIZED
Role for engines UNAUTHORIZED
Role for Handlers UNAUTHORIZED
Role for application location "guessing"
Role for hookable objects UNAUTHORIZED
Role for logger engines UNAUTHORIZED
Role for Serializer engines UNAUTHORIZED
Role for session factories UNAUTHORIZED
Role for file-based session factories UNAUTHORIZED
Role to provide commonly used responses UNAUTHORIZED
Role for template engines UNAUTHORIZED
Dancer2's route handler UNAUTHORIZED
Top-layer class to start a dancer app UNAUTHORIZED
class to represent any session object UNAUTHORIZED
class to handle common helpers for time manipulations UNAUTHORIZED
Type::Tiny types for Dancer2 core. UNAUTHORIZED
File utility helpers UNAUTHORIZED
Class for handling the AutoPage feature UNAUTHORIZED
class for handling file content rendering UNAUTHORIZED
Capture dancer logs UNAUTHORIZED
a place to store captured Dancer2 logs UNAUTHORIZED
Console logger UNAUTHORIZED
Test::More diag() logging engine for Dancer2 UNAUTHORIZED
file-based logging engine for Dancer2 UNAUTHORIZED
Test::More note() logging engine for Dancer2 UNAUTHORIZED
Blackhole-like silent logging engine for Dancer2 UNAUTHORIZED
base class for Dancer2 plugins UNAUTHORIZED
Serializer for handling Dumper data UNAUTHORIZED
Serializer for handling JSON data UNAUTHORIZED
Serialize and deserialize content based on HTTP header
Serializer for handling YAML data UNAUTHORIZED
in-memory session backend for Dancer2 UNAUTHORIZED
YAML-file-based session backend for Dancer2 UNAUTHORIZED
Dancer2 own implementation of Template::Tiny UNAUTHORIZED
Pure Perl 5 template engine for Dancer2 UNAUTHORIZED
Template toolkit engine for Dancer2 UNAUTHORIZED
Template::Tiny engine for Dancer2 UNAUTHORIZED
Useful routines for testing Dancer2 apps UNAUTHORIZED