Security Advisories (10)
CPANSA-Mojolicious-2022-03 (2022-12-10)

Mojo::DOM did not correctly parse <script> tags.

CPANSA-Mojolicious-2021-02 (2021-06-01)

Small sessions could be used as part of a brute-force attack to decode the session secret.

CVE-2021-47208 (2021-03-16)

A bug in format detection can potentially be exploited for a DoS attack.

CVE-2018-25100 (2018-02-13)

Mojo::UserAgent::CookieJar leaks old cookies because of the missing host_only flag on empty domain.

CPANSA-Mojolicious-2015-01 (2015-02-02)

Directory traversal on Windows

CPANSA-Mojolicious-2018-03 (2018-05-19)

Mojo::UserAgent was not checking peer SSL certificates by default.

CVE-2020-36829 (2020-11-10)

Mojo::Util secure_compare can leak the string length. By immediately returning when the two strings are not the same length, the function allows an attacker to guess the length of the secret string using timing attacks.

CPANSA-Mojolicious-2018-02 (2018-05-11)

GET requests with embedded backslashes can be used to access local files on Windows hosts

CPANSA-Mojolicious-2014-01 (2014-10-07)

Context sensitivity of method param could lead to parameter injection attacks.

CVE-2024-58134 (2025-05-03)

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. These predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user's session.

NAME

Mojo::Util - Portable utility functions

SYNOPSIS

use Mojo::Util qw/url_escape url_unescape/;

my $string = 'test=23';
my $escaped = url_escape $string;
say url_unescape $escaped;

DESCRIPTION

Mojo::Util provides portable utility functions for Mojo. Note that this module is EXPERIMENTAL and might change without warning!

FUNCTIONS

Mojo::Util implements the following functions.

b64_decode

my $string = b64_decode $b64;

Base64 decode string.

b64_encode

my $b64 = b64_encode $string;

Base64 encode string.

camelize

my $camelcase = camelize $snakecase;

Convert snake case string to camel case and replace - with ::.

foo_bar     -> FooBar
foo_bar-baz -> FooBar::Baz

decamelize

my $snakecase = decamelize $camelcase;

Convert camel case string to snake case and replace :: with -.

FooBar      -> foo_bar
FooBar::Baz -> foo_bar-baz

decode

my $chars = decode 'UTF-8', $bytes;

Decode bytes to characters.

encode

my $bytes = encode 'UTF-8', $chars;

Encode characters to bytes.

get_line

my $line = get_line $chunk;

Extract a whole line from chunk or return undef. Lines are expected to end with 0x0d 0x0a or 0x0a.

hmac_md5_sum

my $checksum = hmac_md5_sum $string, $secret;

Generate HMAC-MD5 checksum for string.

hmac_sha1_sum

my $checksum = hmac_sha1_sum $string, $secret;

Generate HMAC-SHA1 checksum for string.

html_escape

my $escaped = html_escape $string;

HTML escape string.

html_unescape

my $string = html_unescape $escaped;

HTML unescape string.

md5_bytes

my $checksum = md5_bytes $string;

Generate binary MD5 checksum for string.

md5_sum

my $checksum = md5_sum $string;

Generate MD5 checksum for string.

punycode_decode

my $string = punycode_decode $punycode;

Punycode decode string.

punycode_encode

my $punycode = punycode_encode $string;

Punycode encode string.

quote

my $quoted = quote $string;

Quote string.

qp_decode

my $string = qp_decode $qp;

Quoted Printable decode string.

qp_encode

my $qp = qp_encode $string;

Quoted Printable encode string.

secure_compare

my $success = secure_compare $string1, $string2;

Constant time comparison algorithm to prevent timing attacks.

sha1_bytes

my $checksum = sha1_bytes $string;

Generate binary SHA1 checksum for string.

sha1_sum

my $checksum = sha1_sum $string;

Generate SHA1 checksum for string.

trim

my $trimmed = trim $string;

Trim whitespace characters from both ends of string.

unquote

my $string = unquote $quoted;

Unquote string.

url_escape

my $escaped = url_escape $string;
my $escaped = url_escape $string, 'A-Za-z0-9\-\.\_\~';

URL escape string.

url_unescape

my $string = url_unescape $escaped;

URL unescape string.

xml_escape

my $escaped = xml_escape $string;

XML escape string, this is a much faster version of html_escape escaping only the characters &, <, >, " and '.

SEE ALSO

Mojolicious, Mojolicious::Guides, http://mojolicio.us.