Jason A. Crome

Dancer2 2.3.0 is on its way to CPAN. It adds support for the HTTP QUERY method, fixes a pair of JSON serializer bugs, and closes a small information leak in error responses.

If your app speaks JSON, you want this one.

Why 2.3.0 and not 2.2.3? QUERY support adds a new keyword, and a new keyword can collide with code you already have. Details below.

New: HTTP QUERY support

QUERY is a newer HTTP method that's safe and idempotent like GET, but carries a request body like POST. It's meant for searches and lookups that are too big or too complicated to cram into a query string. (Yes, it's the thing a lot of us have been faking with POST for years.)

query '/search' => sub {
    my $term = body_parameters->get('term');
    return "You searched for $term";
};

What comes with it:

• A new query route keyword
• QUERY request bodies are deserialized, same as POST, PUT, PATCH, and DELETE
• A new request->is_query method
• any routes with no method list now match QUERY requests too

Heads up: query is now a reserved DSL keyword.

• If your app defines its own sub query, you'll get a "Subroutine redefined" warning. Rename yours.
• Old-style plugins that register a query keyword will die at load time.

(GH #1794, Mohammad S Anwar)

Security

• JSON error responses no longer leak file paths. When a client sent malformed JSON (or valid JSON with trailing garbage), the 400 response included the path and line number of Dancer2::Serializer::JSON on your server. It's low severity, but it tells an attacker where your Perl modules live. The error now stops at the part that's actually useful. (PR #1866, Russell Jenkins)

Bug fixes

• JSON numbers are numbers again. Since 2.1.0, the serializer's UTF-8 scan gave numeric values a string form. JSON::XS, and JSON::PP before 2.97, then encoded them as quoted strings, so 42 went out as "42". (GH #1861, David Precious)
• The JSON serializer no longer modifies your data. In 2.2.0 through 2.2.2, serializing a hash with keys that needed UTF-8 decoding deleted those keys from your copy of the data. Arrays had been decoded in place since 2.1.0. If you hold on to a data structure after serializing it, this one may have bitten you. The serializer now builds new containers and leaves yours alone. (GH #1863, David Precious)
• Fixed test failures that only showed up on Windows. (PR #1845, David Precious)
• Fixed a test that used __FILE__() syntax, which needs Perl 5.16. This allows Dancer2 to continue to run on Perl 5.14. (PR #1847, Mikko Koivunalho)

Thank you

Thanks to Mohammad S Anwar, Russell Jenkins, David Precious, and Mikko Koivunalho for the code. Thanks also to Ruth Holloway for suggesting QUERY support, and to Tina Müller for tracking down the JSON number bug from openSUSE's builds.

To upgrade:

cpanm Dancer2

Found a bug? Issues and pull requests are always welcome on GitHub.

Happy Dancing!

Jason/CromeDome, on behalf of the Dancer Core Team

(yes, that's a lot of twos!)

Dancer2 2.2.2 is now headed to CPAN. This is a small bug fix release.

Bug Fixes

• Fixed a crash when using class-method serializers (GH #1837)
• Fixed test failures in gen.t affecting CPAN Testers and Debian builds (GH #1843)

Documentation

• Updated a contributor's name in the documentation (PR #1844)

There are no security fixes, enhancements, or deprecations in this release.

Thanks to David Precious and Nova Patch for their contributions.

As always, bug reports and pull requests are welcome on GitHub.

Jason, on behalf of the Dancer Core Team

Dancer2 2.2.1 is now on CPAN. This is a security release; upgrading is recommended.

Dancer2::Serializer::YAML handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class could therefore instantiate an arbitrary blessed object, and !!perl/code could ask for a string eval. Both are now refused explicitly rather than left to YAML.pm's defaults.

Note that you can be exposed without having configured YAML yourself: Serializer::Mutable maps both text/x-yaml and text/html to this serializer.

Two packaging notes for this release: the minimum YAML version is now 1.30, and Dancer2 now declares the minimum CLI::Osprey it needs (0.09).

Thanks to David Precious for the YAML work.

We have just released Dancer2 2.2.0. It is a maintenance release containing a number of bug fixes, several important security updates, and one breaking change (see below).

First and foremost, please read the following security announcements; if you are running affected versions of Dancer2, you should plan to update immediately:

• GHSA-6xw8-v24c-m783 (Severity: High; Versions affected: <= 2.1.0)
• GHSA-v527-r4px-7vx7 (Severity: Moderate; Versions affected: >= 2.0.0, <= 2.1.0)

A recap of all changes follows.

Security fixes

• Path traversal in static file serving. Dancer2::Handler::File could serve files from outside public_dir. (GHSA-6xw8-v24c-m783)
• Hook exception handling. If an on_hook_exception handler halted, the route that the hook refused could still run. (GHSA-v527-r4px-7vx7)
• Header injection. CR and LF are now stripped from response header names, as they already were from header values.
• AutoPage no longer serves a layout as a page on case-insensitive filesystems.
• Session IDs are now always generated with Crypt::URandom, and validate_id rejects invalid session IDs more strictly.

Breaking changes

• The Data::Dumper serializer has been removed from core, along with the from_dumper and to_dumper keywords. If your app uses them, make sure to download Dancer2::Serializer::Dumper from CPAN.

Bug fixes

• send_file now sends the correct error codes.
• The path() and dirname() DSL keywords no longer drop their first argument.
• Serializer::JSON handles UTF-8 correctly for readonly values and no longer recurses endlessly into blessed objects.
• Serializer::Mutable ignores content type parameters such as charset when choosing a format.
• Each response content assignment is now encoded, not just the first.
• uri_for_route accepts a route parameter of 0 and gives a clearer error for an empty one.
• Hooks are compiled only once, however many times to_app is called.
• A NUL byte in a static file request no longer produces a warning on every request.
• App root directory detection has been fixed.
• Several dancer2 gen fixes:
  • -g and -r no longer die after writing the app.
  • The app directory is named after the dashed distribution name.
  • The pattern added to MANIFEST.SKIP is relative and matches correctly.

Documentation

• The header precedence documented for Serializer::Mutable now matches what it actually does.
• %D has been removed from the documented log_format characters, since it was never implemented.

Thanks

Thanks to everyone who contributed to this release, especially:

• Anton Lundin, for fixing the error codes in send_file
• Mike Weisenborn, for the path()/dirname() fix
• Curtis "Ovid" Poe, for surfacing many of these issues with PAAD
• David Precious (bigpresh) and Russell Jenkins (veryrusty) for running with these items and seeing them through to completion

Cheers,

Jason/CromeDome

We're thrilled to announce the release of Dancer2 2.1.0! This release represents a major investment in the health and quality of the project. We've gone deep into the issue tracker and PR backlog, closing out some of our oldest open issues — some dating back years — and significantly grooming both the issue and pull request queues. A big thank you to everyone who contributed.

Bug Fixes

This release addresses a number of long-standing issues:

• UTF-8 handling improvements: to_json no longer double-encodes UTF-8 (#686), the charset config option is now properly respected (#1124), and UTF-8 in URLs is handled correctly (#1143). To the best of our knowledge, this release fixes all known UTF-8 issues. The default charset for Dancer2 apps is now UTF-8 rather than undefined. You can set an empty charset for your app if needed.
• Case-insensitive system confusion has been resolved (#863).
• Plugin DSL keywords are now app-specific (#1449, #1630), preventing cross-application bleed in multi-app setups.
• Test suite fixes: Resolved content_type errors in t/dsl/send_file.t (#1772), JSON warnings in t/dsl/send_as.t (#1773), and void warnings in t/hooks.t (#1774).
• Windows compatibility: File uploads are now properly unlinked on Windows (#1777).

Enhancements

• Strict config mode (#763): Dancer2 can now warn on unknown config keys, with an opt-out available. New apps scaffolded with dancer2 gen will have strict config enabled by default.
• Path::Tiny migration (#1264): Internal path handling has moved to Path::Tiny for cleaner, more reliable file operations.
• Unicode::UTF8 support (#1594): When Unicode::UTF8 is available, Dancer2 will use it for faster encoding/decoding.
• Batch session cookie access (#1073): Retrieve multiple session cookie values at once with the clear method.
• Fully qualified engine namespaces (#1323): All engines now accept fully qualified package names.
• Double server header fix (#1664): Dancer2 no longer sends duplicate Server headers.
• Improved send_as (#1709): send_as now uses the full serializer pipeline, including hooks.
• Dispatching improvements (PR #1757): Removed the deprecated api_version and improved the dispatching loop.
• MIME ownership (PR #1758): MIME type handling has been moved to the app level.
• Package name in logger output (PR #1780): Logger output can now include the calling package name, making multi-module debugging easier.

Documentation

• Better documentation for the views setting behavior (#1431).
• Fixed broken links in the manual and tutorial (PR #1749, #1750).
• Improved config documentation structure (PR #1753).
• Removed the stale logger keyword from the DSL docs (PR #1762).

Security

• The "Powered by..." text has been removed from the default error page (PR #1776). Security researchers flagged this as an information disclosure concern — advertising the framework and version in error responses gives potential attackers a head start. The default error page is now clean of framework identifiers.

Thank You

Thanks to all who contributed to this release: Sawyer X, Russell Jenkins, Mikko Koivunalho, Gil Magno, and Sorin Pop.

You can install or upgrade via CPAN:

cpanm Dancer2

Happy Dancing!

Jason/CromeDome