Security Advisories (13)
CPANSA-Mojolicious-2022-03 (2022-12-10)

Mojo::DOM did not correctly parse <script> tags.

CPANSA-Mojolicious-2021-02 (2021-06-01)

Small sessions could be used as part of a brute-force attack to decode the session secret.

CVE-2021-47208 (2021-03-16)

A bug in format detection can potentially be exploited for a DoS attack.

CVE-2018-25100 (2018-02-13)

Mojo::UserAgent::CookieJar leaks old cookies because of the missing host_only flag on empty domain.

CPANSA-Mojolicious-2015-01 (2015-02-02)

Directory traversal on Windows

CVE-2010-4802 (2011-05-03)

Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment detection, which has unspecified impact and remote attack vectors.

CPANSA-Mojolicious-2018-03 (2018-05-19)

Mojo::UserAgent was not checking peer SSL certificates by default.

CPANSA-Mojolicious-2018-02 (2018-05-11)

GET requests with embedded backslashes can be used to access local files on Windows hosts

CPANSA-Mojolicious-2014-01 (2014-10-07)

Context sensitivity of method param could lead to parameter injection attacks.

CVE-2011-1841 (2011-03-10)

Mojolicious is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by link_to helper. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

CVE-2011-1589 (2011-04-05)

Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot slash) in a URI.

CVE-2010-4803 (2011-05-03)

Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has unspecified impact and remote attack vectors.

CVE-2011-1841 (2011-05-03)

Cross-site scripting (XSS) vulnerability in the link_to helper in Mojolicious before 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

NAME

Mojo::Transaction::HTTP - HTTP 1.1 Transaction Container

SYNOPSIS

use Mojo::Transaction::HTTP;

my $tx = Mojo::Transaction::HTTP->new;

my $req = $tx->req;
my $res = $tx->res;

my $keep_alive = $tx->keep_alive;

DESCRIPTION

Mojo::Transaction::HTTP is a container and state machine for HTTP 1.1 transactions.

ATTRIBUTES

Mojo::Transaction::HTTP inherits all attributes from Mojo::Transaction and implements the following new ones.

continue_handler_cb

my $cb = $tx->continue_handler_cb;
$tx    = $tx->continue_handler_cb(sub {...});

continue_timeout

my $timeout = $tx->continue_timeout;
$tx         = $tx->continue_timeout(3);

continued

my $continued = $tx->continued;
$tx           = $tx->continued(1);

handler_cb

my $cb = $tx->handler_cb;
$tx    = $tx->handler_cb(sub {...});

keep_alive

my $keep_alive = $tx->keep_alive;
$tx            = $tx->keep_alive(1);

req

my $req = $tx->req;
$tx     = $tx->req(Mojo::Message::Request->new);

res

my $res = $tx->res;
$tx     = $tx->res(Mojo::Message::Response->new);

upgrade_cb

my $cb = $tx->upgrade_cb;
$tx    = $tx->upgrade_cb(sub {...});

METHODS

Mojo::Transaction::HTTP inherits all methods from Mojo::Transaction and implements the following new ones.

client_leftovers

my $leftovers = $tx->client_leftovers;

client_read

$tx = $tx->client_read($chunk);

client_write

my $chunk = $tx->client_write;

server_leftovers

my $leftovers = $tx->server_leftovers;

server_read

$tx = $tx->server_read($chunk);

server_write

my $chunk = $tx->server_write;

SEE ALSO

Mojolicious, Mojolicious::Book, http://mojolicious.org.