Changes for version 0.03 - 2026-08-18
- SECURITY: fix an open redirect in same_origin_path (CVE-2026-75628) reported by cpansec. The guard rejected a leading "//" and any CR/LF, but a browser removes TAB/CR/LF from a URL before it parses it and treats "\" as "/" under a special scheme, so "/\evil.example" and "/<TAB>/evil.example" both survived the check and then resolved to another host. A ?return= destination that a user controls could therefore redirect off-site after a successful login.
- same_origin_path now rejects every C0 control byte and DEL, and rejects a backslash anywhere in the path, rather than trying to enumerate the bytes a URL parser might drop. Paths that need a backslash must percent-encode it as %5C.
Modules
OAuth2 and OpenID Connect for Punk applications
resource server bearer token checkers
a cached JWKS key set
provider presets for Punk::OAuth2
one configured OAuth2/OIDC provider
an OAuth2/OIDC authorization server
DBI storage for the authorization server
a token-endpoint response
shared helpers for Punk::OAuth2
social login for Punk applications