/ 
Dancer2-0.140900_01
⭐ Starred 552 / Dancer2::Core::Context
Security Advisories (4)
CPANSA-Dancer2-2018-01 (2018-01-30)

There is a potential RCE with regards to Storable. We have added session ID validation to the session engine so that session backends based on Storable can reject malformed session IDs that may lead to exploitation of the RCE.

CVE-2026-13577 (2026-07-20)

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.

CVE-2026-93711 (2026-09-22)

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to the wire, so the bytes after the CRLF arrive as their own header line. The application has to derive the header name from request data, not just the value. An attacker who controls that data adds their own headers and splits the response.

CVE-2026-93709 (2026-09-22)

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or a different capitalisation on a case-insensitive filesystem therefore misses the guard. The handler is off by default, enabled with auto_page. The layout wrapping every page is already public, so this discloses one of the application's other layouts.

NAME

Dancer2::Core::Context - handles everything proper to a request's context.

VERSION

version 0.140900_01

ATTRIBUTES

app

Reference to the Dancer2::Core::App object for the current application.

env

Read-only accessor to a PSGI environment hash.

request

A Dancer2::Core::Request object, built from the PSGI environment variable for this request.

response

A Dancer2::Core::Response object, used to set content, headers and HTTP status codes.

session

Handle for the current session object, if any

destroyed_session

We cache a destroyed session here; once this is set we must not attempt to retrieve the session from the cookie in the request. If no new session is created, this is set (with expiration) as a cookie to force the browser to expire the cookie.

with_return

Used to cache the coderef from Return::MultiLevel within the dispatcher.

METHODS

vars

Returns a hashref of all per-request variables stored in this object.

var

By-name interface to variables stored in this context object.

my $stored = $context->var('some_variable');

returns the value of 'some_variable', while

$context->var('some_variable' => 'value');

will set it.

cookies

Shortcut that dispatches to Dancer2::Core::Request's cookies method.

Get a cookie from the request object, or set one in the response object.

redirect($destination, $status)

Sets a redirect in the response object. If $destination is not an absolute URI, then it will be made into an absolute URI, relative to the URI in the request.

halt

Flag the response object as 'halted'.

If called during request dispatch, immediatly returns the response to the dispatcher and after hooks will not be run.

pass

Flag the response object as 'passed'.

If called during request dispatch, immediatly returns the response to the dispatcher.

has_session

Returns true if session engine has been defined and if either a session object has been instantiated in the context or if a session cookie was found and not subsequently invalidated.

destroy_session

Destroys the current session and ensures any subsequent session is created from scratch and not from the request session cookie

AUTHOR

Dancer Core Developers

COPYRIGHT AND LICENSE

This software is copyright (c) 2014 by Alexis Sukrieh.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.