Jason A. Crome

Dancer2 2.3.0 is on its way to CPAN. It adds support for the HTTP QUERY method, fixes a pair of JSON serializer bugs, and closes a small information leak in error responses.

If your app speaks JSON, you want this one.

Why 2.3.0 and not 2.2.3? QUERY support adds a new keyword, and a new keyword can collide with code you already have. Details below.

New: HTTP QUERY support

QUERY is a newer HTTP method that's safe and idempotent like GET, but carries a request body like POST. It's meant for searches and lookups that are too big or too complicated to cram into a query string. (Yes, it's the thing a lot of us have been faking with POST for years.)

query '/search' => sub {
    my $term = body_parameters->get('term');
    return "You searched for $term";
};

What comes with it:

• A new query route keyword
• QUERY request bodies are deserialized, same as POST, PUT, PATCH, and DELETE
• A new request->is_query method
• any routes with no method list now match QUERY requests too

Heads up: query is now a reserved DSL keyword.

• If your app defines its own sub query, you'll get a "Subroutine redefined" warning. Rename yours.
• Old-style plugins that register a query keyword will die at load time.

(GH #1794, Mohammad S Anwar)

Security

• JSON error responses no longer leak file paths. When a client sent malformed JSON (or valid JSON with trailing garbage), the 400 response included the path and line number of Dancer2::Serializer::JSON on your server. It's low severity, but it tells an attacker where your Perl modules live. The error now stops at the part that's actually useful. (PR #1866, Russell Jenkins)

Bug fixes

• JSON numbers are numbers again. Since 2.1.0, the serializer's UTF-8 scan gave numeric values a string form. JSON::XS, and JSON::PP before 2.97, then encoded them as quoted strings, so 42 went out as "42". (GH #1861, David Precious)
• The JSON serializer no longer modifies your data. In 2.2.0 through 2.2.2, serializing a hash with keys that needed UTF-8 decoding deleted those keys from your copy of the data. Arrays had been decoded in place since 2.1.0. If you hold on to a data structure after serializing it, this one may have bitten you. The serializer now builds new containers and leaves yours alone. (GH #1863, David Precious)
• Fixed test failures that only showed up on Windows. (PR #1845, David Precious)
• Fixed a test that used __FILE__() syntax, which needs Perl 5.16. This allows Dancer2 to continue to run on Perl 5.14. (PR #1847, Mikko Koivunalho)

Thank you

Thanks to Mohammad S Anwar, Russell Jenkins, David Precious, and Mikko Koivunalho for the code. Thanks also to Ruth Holloway for suggesting QUERY support, and to Tina Müller for tracking down the JSON number bug from openSUSE's builds.

To upgrade:

cpanm Dancer2

Found a bug? Issues and pull requests are always welcome on GitHub.

Happy Dancing!

Jason/CromeDome, on behalf of the Dancer Core Team