/ 
Dancer2-0.161000_01
⭐ Starred 552 / Dancer2::Core::Time
Security Advisories (4)
CPANSA-Dancer2-2018-01 (2018-01-30)

There is a potential RCE with regards to Storable. We have added session ID validation to the session engine so that session backends based on Storable can reject malformed session IDs that may lead to exploitation of the RCE.

CVE-2026-13577 (2026-07-20)

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.

CVE-2026-93711 (2026-09-22)

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to the wire, so the bytes after the CRLF arrive as their own header line. The application has to derive the header name from request data, not just the value. An attacker who controls that data adds their own headers and splits the response.

CVE-2026-93709 (2026-09-22)

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or a different capitalisation on a case-insensitive filesystem therefore misses the guard. The handler is off by default, enabled with auto_page. The layout wrapping every page is already public, so this discloses one of the application's other layouts.

NAME

Dancer2::Core::Time - class to handle common helpers for time manipulations

VERSION

version 0.161000_01

SYNOPSIS

my $time = Dancer2::Core::Time->new( expression => "1h" );
$time->seconds; # return 3600

DESCRIPTION

For consistency, whenever something needs to work with time, it needs to be expressed in seconds, with a timestamp. Although it's very convenient for the machine and calculations, it's not very handy for a human-being, for instance in a configuration file.

This class provides everything needed to translate any human-understandable expression into a number of seconds.

ATTRIBUTES

seconds

Number of seconds represented by the object. Defaults to 0.

epoch

The current epoch to handle. Defaults to seconds + time.

gmt_string

Convert the current value in epoch as a GMT string.

expression

Required. A human readable expression representing the number of seconds to provide.

The format supported is a number followed by an expression. It currently understands:

s second seconds sec secs
m minute minutes min mins
h hr hour hours
d day days
w week weeks
M month months
y year years

Months and years are currently fixed at 30 and 365 days. This may change. Anything else is used verbatim as the expression of a number of seconds.

Example:

2 hours, 3 days, 3d, 1 week, 3600, etc...

AUTHOR

Dancer Core Developers

COPYRIGHT AND LICENSE

This software is copyright (c) 2015 by Alexis Sukrieh.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.