Dancer2 2.2.1 is now on CPAN. This is a security release; upgrading is recommended.

Dancer2::Serializer::YAML handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class could therefore instantiate an arbitrary blessed object, and !!perl/code could ask for a string eval. Both are now refused explicitly rather than left to YAML.pm's defaults.

Note that you can be exposed without having configured YAML yourself: Serializer::Mutable maps both text/x-yaml and text/html to this serializer.

Two packaging notes for this release: the minimum YAML version is now 1.30, and Dancer2 now declares the minimum CLI::Osprey it needs (0.09).

Thanks to David Precious for the YAML work.

We have just released Dancer2 2.2.0. It is a maintenance release containing a number of bug fixes, several important security updates, and one breaking change (see below).

First and foremost, please read the following security announcements; if you are running affected versions of Dancer2, you should plan to update immediately:

• GHSA-6xw8-v24c-m783 (Severity: High; Versions affected: <= 2.1.0)
• GHSA-v527-r4px-7vx7 (Severity: Moderate; Versions affected: >= 2.0.0, <= 2.1.0)

A recap of all changes follows.

Security fixes

• Path traversal in static file serving. Dancer2::Handler::File could serve files from outside public_dir. (GHSA-6xw8-v24c-m783)
• Hook exception handling. If an on_hook_exception handler halted, the route that the hook refused could still run. (GHSA-v527-r4px-7vx7)
• Header injection. CR and LF are now stripped from response header names, as they already were from header values.
• AutoPage no longer serves a layout as a page on case-insensitive filesystems.
• Session IDs are now always generated with Crypt::URandom, and validate_id rejects invalid session IDs more strictly.

Breaking changes

• The Data::Dumper serializer has been removed from core, along with the from_dumper and to_dumper keywords. If your app uses them, make sure to download Dancer2::Serializer::Dumper from CPAN.

Bug fixes

• send_file now sends the correct error codes.
• The path() and dirname() DSL keywords no longer drop their first argument.
• Serializer::JSON handles UTF-8 correctly for readonly values and no longer recurses endlessly into blessed objects.
• Serializer::Mutable ignores content type parameters such as charset when choosing a format.
• Each response content assignment is now encoded, not just the first.
• uri_for_route accepts a route parameter of 0 and gives a clearer error for an empty one.
• Hooks are compiled only once, however many times to_app is called.
• A NUL byte in a static file request no longer produces a warning on every request.
• App root directory detection has been fixed.
• Several dancer2 gen fixes:
  • -g and -r no longer die after writing the app.
  • The app directory is named after the dashed distribution name.
  • The pattern added to MANIFEST.SKIP is relative and matches correctly.

Documentation

• The header precedence documented for Serializer::Mutable now matches what it actually does.
• %D has been removed from the documented log_format characters, since it was never implemented.

Thanks

Thanks to everyone who contributed to this release, especially:

• Anton Lundin, for fixing the error codes in send_file
• Mike Weisenborn, for the path()/dirname() fix
• Curtis "Ovid" Poe, for surfacing many of these issues with PAAD
• David Precious (bigpresh) and Russell Jenkins (veryrusty) for running with these items and seeing them through to completion

Cheers,

Jason/CromeDome