Route::_check_options interpolates the option name into a regex

Status: reasoned from code

lib/Dancer2/Core/Route.pm:63:

croak "Not a valid option for route matching: `$opt'"
  if not( grep {/^$opt$/} @supported_options );

$opt is a hash key interpolated straight into a pattern.

Impact

• An option named . matches every supported option and defeats the validation entirely.
• An option containing regex metacharacters dies with a regex compile error instead of the intended message.
• It recompiles a pattern per option per route.

Developer-supplied rather than request-supplied, so this is correctness rather than security.

Suggested fix

if ( not grep { $_ eq $opt } @supported_options ) {

Strictly better and faster.

Start at lib/Dancer2/Core/Route.pm:63 and inspect how _check_options validates each route option. Replace the regex-based comparison with literal option-name matching, then verify that valid options still pass and invalid or regex-like names produce the intended validation error.