/ 
Plack-1.0055
⭐ Starred 488 / Plack::Middleware::Conditional
Security Advisories (1)
CVE-2026-115825 (2026-10-25)

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.

NAME

Plack::Middleware::Conditional - Conditional wrapper for Plack middleware

SYNOPSIS

use Plack::Builder;

builder {
    enable_if { $_[0]->{REMOTE_ADDR} eq '127.0.0.1' } 'StackTrace', force => 1;
    $app;
};

# or using the OO interface:
$app = Plack::Middleware::Conditional->wrap(
    $app,
    condition  => sub { $_[0]->{REMOTE_ADDR} eq '127.0.0.1' },
    builder => sub { Plack::Middleware::StackTrace->wrap($_[0], force => 1) },
);

DESCRIPTION

Plack::Middleware::Conditional is a piece of meta-middleware, to run a specific middleware component under runtime conditions. The goal of this middleware is to avoid baking runtime configuration options in individual middleware components, and rather share them as another middleware component.

EXAMPLES

Note that some of the middleware component names are just made up for the explanation and might not exist.

# Minify JavaScript if the browser is Firefox
enable_if { $_[0]->{HTTP_USER_AGENT} =~ /Firefox/ } 'JavaScriptMinifier';

# Enable Stacktrace when being accessed from the local network
enable_if { $_[0]->{REMOTE_ADDR} =~ /^10\.0\.1\.*/ } 'StackTrace';

# Work with other conditional setter middleware:
# Transcode Jpeg on the fly for mobile clients
builder {
    enable 'MobileDetector';
    enable_if { $_[0]->{'plack.mobile_detected'} }
      'TranscodeJpeg', max_size => 30_000;
    $app;
};

Note that in the last example MobileDetector should come first because the conditional check runs in pre-run conditions, which is from outer to inner: that is, from the top to the bottom in the Builder DSL code.

AUTHOR

Tatsuhiko Miyagawa

Steve Cook

SEE ALSO

Plack::Builder