Security Advisories (2)
CVE-2024-58134 (2025-05-03)

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. These predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user's session.

CVE-2024-58135 (2025-05-03)

Mojolicious versions from 7.28 for Perl may generate weak HMAC session secrets. When creating a default app with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys.

NAME

Mojo::Server::Morbo::Backend - Morbo backend base class

SYNOPSIS

package Mojo::Server::Morbo::Backend::Inotify:
use Mojo::Base 'Mojo::Server::Morbo::Backend';

sub modified_files {...}

DESCRIPTION

Mojo::Server::Morbo::Backend is an abstract base class for Morbo backends, like Mojo::Server::Morbo::Backend::Poll.

ATTRIBUTES

Mojo::Server::Morbo::Backend implements the following attributes.

watch

my $watch = $backend->watch;
$backend  = $backend->watch(['/home/sri/my_app']);

Files and directories to watch for changes, defaults to the application script as well as the lib and templates directories in the current working directory.

watch_timeout

my $timeout = $backend->watch_timeout;
$backend    = $backend->watch_timeout(10);

Maximum amount of time in seconds a backend may block when waiting for files to change, defaults to the value of the MOJO_MORBO_TIMEOUT environment variable or 1.

METHODS

Mojo::Server::Morbo::Backend inherits all methods from Mojo::Base and implements the following new ones.

modified_files

my $files = $backend->modified_files;

Check if files from "watch" have been modified since the last check and return an array reference with the results. Meant to be overloaded in a subclass.

# All files that have been modified
say for @{$backend->modified_files};

SEE ALSO

Mojolicious, Mojolicious::Guides, https://mojolicious.org.