/ 
Punk-0.17

Changes for version 0.17 - 2026-08-17

  • Fixed t/14-futures.t failing on every perl whose Future is older than the one it was developed against - reported by CPAN Testers against 0.16 on 5.20.0, 5.22.2 and 5.24.0 with "Expected __ANON__(Future.pm line 1140) to return a Future".
  • A route may now be declared as one hashref, with the handler under `cb`:
    • post "/upload" => { cb => "Web::File#create", max_body => 50_000_000 };
    • instead of the positional form, which is unchanged and stays the one `punk new` generates:
      • post "/upload" => "Web::File#create", { max_body => 50_000_000 };
  • New route option { compress => 0 }, which opts a route out of the server response compression Hyperman 0.25 adds. Punk does not compress - that belongs to the write path - so the option is spelled as a plain response header, Content-Encoding: identity, which the server honours and strips.
  • New `max_body` keyword and per-route { max_body => N }: refuse a request whose CONTENT_LENGTH is over a ceiling, with the same 413 an oversize API operation gets.
  • Punk::Upload documents what an upload actually costs: it arrives whole in memory before a handler sees it, ->save is a write and not a stream, and `max_body` does not reduce the memory.
  • SECURITY: the `markdown` mount reflected the request path into the Location header of its canonical 301 (the redirect that strips a trailing slash or a .md suffix). PATH_INFO reaches a PSGI app percent-DECODED, so that echoed bytes the client chose: a decoded CR/LF split the response at any mount point, and at a root mount "//evil.example/" came back as a protocol-relative 301 off the site. Found while fixing the same class of bug in Punk::OAuth2 (CVE-2026-75628). The redirect now only names a path that IS a page - the stripped target is looked up in the page table first - so the only thing it can echo is one of the mount's own keys. Anything else falls through to the 404 it was always going to get. pmd_redirect also stops at the first control byte, in case a mount prefix ever carries one.

Documentation

punk
the Punk command line

Modules

Punk
a MVC web framework
Punk::App
the per-application registry and boot compiler
Punk::Auth
the authentication battery
Punk::Auth::Password
password hashing
Punk::CORS
cross-origin resource sharing
Punk::CSRF
single-use CSRF tokens
Punk::Command
the punk command line: registry, dispatcher and commands
Punk::Config
YAML configuration with secrets kept out of the file
Punk::Context
the per-request object
Punk::Controller
base class for Punk controllers
Punk::DevError
the development error page
Punk::Future
an async result that runs on the loop, or blocks
Punk::Generate
scaffold a new Punk application
Punk::Headers
security response headers
Punk::Logger
a level-based logger
Punk::Model
the storage-agnostic model tier
Punk::Model::DBI
the default DBI backend for Punk models
Punk::Model::DBIx::Loop
a non-blocking backend for Punk models
Punk::Mount::Markdown
a directory of markdown as a documentation site
Punk::Mount::OpenAPI
the api mount: spec-first operations
Punk::Plugin
base class for Punk plugins
Punk::RateLimit
rate limiting and IP blocking over Hyperman's shared arena
Punk::Request
a lazy wrapper over the PSGI environment
Punk::Response
a response builder
Punk::Router
the compiled-at-boot route tables (XS)
Punk::Router::Scope
the handle an under returns
Punk::SSE
a Server-Sent Events stream
Punk::SendFile::Reader
the bounded body of a ranged send_file response
Punk::Session
signed cookie sessions
Punk::Static
serving files from a directory
Punk::Test
an in-process test client for Punk applications
Punk::Test::WS
a pure-Perl RFC 6455 codec for testing WebSocket servers
Punk::Test::WS::Conn
the client side of one WebSocket connection
Punk::UA
the outbound HTTP agent on the context
Punk::Upload
an uploaded file from a multipart form
Punk::Validate
collecting request validation
Punk::View::Stencil
the Template::Stencil view engine
Punk::Views
the pluggable view engine registry (XS)
Punk::WebSocket
a WebSocket connection
Punk::WebSocket::Room
pub/sub groups of WebSocket connections

Provides

BenchCat
in bench/apps/cat-lib/BenchCat.pm
BenchCat::Controller::Root
in bench/apps/cat-lib/BenchCat/Controller/Root.pm

Examples

Other files