Stig Palmquist
969ed2bc64
Also disables Plack::Middleware::XSendfile due to CVE-2026-7381. The feature can be enabled by setting PLACK_ENABLE_INSECURE_XSENDFILE=1
32 lines
1.1 KiB
Diff
32 lines
1.1 KiB
Diff
diff --git a/lib/Plack/Middleware/XSendfile.pm b/lib/Plack/Middleware/XSendfile.pm
|
|
index f2cd859..f96ccb5 100644
|
|
--- a/lib/Plack/Middleware/XSendfile.pm
|
|
+++ b/lib/Plack/Middleware/XSendfile.pm
|
|
@@ -10,7 +10,11 @@ use Plack::Util::Accessor qw( variation );
|
|
|
|
sub new {
|
|
my $class = shift;
|
|
- Carp::carp("Plack::Middleware::XSendfile is deprecated and will be removed in a future release");
|
|
+ unless (($ENV{PLACK_ENABLE_INSECURE_XSENDFILE} // '') eq '1') {
|
|
+ Carp::croak(
|
|
+ "CVE-2026-7381: Plack::Middleware::XSendfile is disabled by default. Set PLACK_ENABLE_INSECURE_XSENDFILE=1 to enable"
|
|
+ );
|
|
+ }
|
|
$class->SUPER::new(@_);
|
|
}
|
|
|
|
diff --git a/t/Plack-Middleware/xsendfile.t b/t/Plack-Middleware/xsendfile.t
|
|
index f1a02fa..248815e 100644
|
|
--- a/t/Plack-Middleware/xsendfile.t
|
|
+++ b/t/Plack-Middleware/xsendfile.t
|
|
@@ -6,6 +6,9 @@ use Plack::Builder;
|
|
use Plack::Test;
|
|
use Cwd;
|
|
|
|
+# CVE-2026-7381: Insecure feature disabled by default, but enable for tests
|
|
+$ENV{PLACK_ENABLE_INSECURE_XSENDFILE} = 1;
|
|
+
|
|
sub is_wo_case($$;$) {
|
|
is lc $_[0], lc $_[1], $_[2];
|
|
}
|