/ 
DBIx-Class-Async-v1.0.8

Changes for version v1.0.8 - 2026-09-08

  • SECURITY
    • An authorisation bypass was corrected using a cache key controlled by the user (CWE-639). This instance was detected by CPANsec. There were two different defects that together allowed one user's query to be fulfilled by other user's (or another database's) stored results.
      • The first of these issues is _generate_cache_key (ResultSet.pm) which reduced the cache key to primary key fields every time primary key was present in search condition ignoring all other conditions. Because of this, a search like search({ id => $id, owner => $user }) was saved as { id => $id }, so that in the future query with the same id regardless of who the owner is, could return the result from this cache. Actually the condition was applied correctly to the database but the cache key merged different queries in the cache. The cache key is generated now using the full search condition.
      • The CHI cache was created using global => 1 by _build_default_cache (Async.pm). As a result, all the instances of CHI::Driver::Memory in the given process are present in the same store. Because the cache key does not include connection identity, two Schemas that are connected to different databases have the possibility to read/write the entries of the cache of each other. The cache is isolated per connection now: global => 0, but, because each connection owns its own cache object, there is no need to add any connection identity to the key.
      • Because of this, it is impossible to guarantee that the cache key for Row::update's invalidation-by-primary-key would match the (now condition-aware) cache entry that has to be invalidated.
    • Added regression tests to t/148-caching.t reproducing both the predicate-collapse and the cross-connection cache leakage, and confirming the fix.

Documentation

SECURITY.md

Modules

DBIx::Class::Async
Non-blocking, multi-worker asynchronous wrapper for DBIx::Class
DBIx::Class::Async::Exception
Base class for DBIx::Class::Async exceptions
DBIx::Class::Async::Exception::AmbiguousColumn
Exception for column names that are ambiguous across joined tables
DBIx::Class::Async::Exception::Factory
Translate raw DBIx::Class errors into typed exception objects
DBIx::Class::Async::Exception::MissingColumn
Exception for absent required columns on insert
DBIx::Class::Async::Exception::NoSuchRelationship
Exception for undeclared relationship names used in queries
DBIx::Class::Async::Exception::NotInStorage
Exception for operations on un-inserted row objects
DBIx::Class::Async::Exception::RelationshipAsColumn
Exception for relationship name passed where a column was expected
DBIx::Class::Async::ResultSet
Non-blocking resultset proxy with Future-based execution
DBIx::Class::Async::ResultSet::Pager
Asynchronous pagination handling for Async ResultSets
DBIx::Class::Async::ResultSetColumn
Asynchronous operations on a single ResultSource column
DBIx::Class::Async::Row
Asynchronous Row object representing a single database record.
DBIx::Class::Async::Schema
Non-blocking, worker-pool based Proxy for DBIx::Class::Schema
DBIx::Class::Async::SelectNormaliser
Normalise -ident clauses in ResultSet select attributes
DBIx::Class::Async::Storage
Storage Layer for DBIx::Class::Async
DBIx::Class::Async::Storage::DBI
DBI-based async storage backend for DBIx::Class::Async
DBIx::Class::Async::Storage::DBI::Cursor
Asynchronous cursor for DBIx::Class ResultSets using Futures

Other files