Security Advisories (13)
CPANSA-Mojolicious-2015-01 (2015-02-02)

Directory traversal on Windows

CVE-2010-4802 (2011-05-03)

Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment detection, which has unspecified impact and remote attack vectors.

CPANSA-Mojolicious-2014-01 (2014-10-07)

Context sensitivity of method param could lead to parameter injection attacks.

CVE-2011-1841 (2011-03-10)

Mojolicious is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by link_to helper. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

CVE-2011-1589 (2011-04-05)

Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot slash) in a URI.

CVE-2010-4803 (2011-05-03)

Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has unspecified impact and remote attack vectors.

CVE-2011-1841 (2011-05-03)

Cross-site scripting (XSS) vulnerability in the link_to helper in Mojolicious before 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CPANSA-Mojolicious-2022-03 (2022-12-10)

Mojo::DOM did not correctly parse <script> tags.

CPANSA-Mojolicious-2021-02 (2021-06-01)

Small sessions could be used as part of a brute-force attack to decode the session secret.

CVE-2021-47208 (2021-03-16)

A bug in format detection can potentially be exploited for a DoS attack.

CPANSA-Mojolicious-2018-03 (2018-05-19)

Mojo::UserAgent was not checking peer SSL certificates by default.

CPANSA-Mojolicious-2018-02 (2018-05-11)

GET requests with embedded backslashes can be used to access local files on Windows hosts

CVE-2018-25100 (2018-02-13)

Mojo::UserAgent::CookieJar leaks old cookies because of the missing host_only flag on empty domain.

NAME

Mojolicious::Plugins - Plugins

SYNOPSIS

use Mojolicious::Plugins;

DESCRIPTION

Mojolicous::Plugins is the plugin manager of Mojolicious. In your application you will usually use it to load plugins. To implement your own plugins see Mojolicious::Plugin and the add_hook method below.

ATTRIBUTES

Mojolicious::Plugins implements the following attributes.

hooks

my $hooks = $plugins->hooks;
$plugins  = $plugins->hooks({foo => [sub {...}]});

Hash reference containing all hooks that have been registered by loaded plugins.

namespaces

my $namespaces = $plugins->namespaces;
$plugins       = $plugins->namespaces(['Mojolicious::Plugin']);

Namespaces to load plugins from. You can add more namespaces to load application specific plugins.

METHODS

Mojolicious::Plugins inherits all methods from Mojo::Base and implements the following new ones.

add_hook

$plugins = $plugins->add_hook(event => sub {...});

Hook into an event. The following events are available. (Note that after_* hooks run in reverse order)

before_dispatch

Runs before the dispatchers determines what action to run. (Passed the default controller instance)

$plugins->add_hook(before_dispatch => sub {
    my ($self, $c) = @_;
});
after_dispatch

Runs after the dispatchers determines what action to run. (Passed the default controller instance)

$plugins->add_hook(after_dispatch => sub {
    my ($self, $c) = @_;
});
after_static_dispatch

Runs after the static dispatcher determines if a static file should be served. (Passed the default controller instance)

$plugins->add_hook(after_static_dispatch => sub {
    my ($self, $c) = @_;
})
after_build_tx

Runs right after the transaction is built and before the HTTP message gets parsed. One usage case would be upload progress bars. (Passed the transaction instance)

$plugins->add_hook(after_build_tx => sub {
    my ($self, $tx) = @_;
})

You could also add custom events by using run_hook and run_hook_reverse in your application.

load_plugin

$plugins = $plugins->load_plugin($app, 'something');
$plugins = $plugins->load_plugin($app, 'something', foo => 23);
$plugins = $plugins->load_plugin($app, 'something', {foo => 23});

Load a plugin from the configured namespaces and run register. Optional arguments are passed to register.

run_hook

$plugins = $plugins->run_hook('foo');
$plugins = $plugins->run_hook(foo => 123);

Runs a hook.

run_hook_reverse

$plugins = $plugins->run_hook_reverse('foo');
$plugins = $plugins->run_hook_reverse(foo => 123);

Runs a hook in reverse order.

SEE ALSO

Mojolicious, Mojolicious::Book, http://mojolicious.org.