/ 
Mojolicious-0.999921
⭐ Starred 2674
/ Mojolicious::Book::CodingGuidelines
Security Advisories (13)
CPANSA-Mojolicious-2022-03 (2022-12-10)

Mojo::DOM did not correctly parse <script> tags.

CPANSA-Mojolicious-2021-02 (2021-06-01)

Small sessions could be used as part of a brute-force attack to decode the session secret.

CVE-2021-47208 (2021-03-16)

A bug in format detection can potentially be exploited for a DoS attack.

CVE-2018-25100 (2018-02-13)

Mojo::UserAgent::CookieJar leaks old cookies because of the missing host_only flag on empty domain.

CPANSA-Mojolicious-2015-01 (2015-02-02)

Directory traversal on Windows

CVE-2010-4802 (2011-05-03)

Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment detection, which has unspecified impact and remote attack vectors.

CPANSA-Mojolicious-2018-03 (2018-05-19)

Mojo::UserAgent was not checking peer SSL certificates by default.

CPANSA-Mojolicious-2018-02 (2018-05-11)

GET requests with embedded backslashes can be used to access local files on Windows hosts

CPANSA-Mojolicious-2014-01 (2014-10-07)

Context sensitivity of method param could lead to parameter injection attacks.

CVE-2011-1841 (2011-03-10)

Mojolicious is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by link_to helper. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

CVE-2011-1589 (2011-04-05)

Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot slash) in a URI.

CVE-2010-4803 (2011-05-03)

Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has unspecified impact and remote attack vectors.

CVE-2011-1841 (2011-05-03)

Cross-site scripting (XSS) vulnerability in the link_to helper in Mojolicious before 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

NAME

Mojolicious::Book::CodingGuidelines - Coding Guidelines

OVERVIEW

This document describes the coding guidelines that are the foundations of Mojo and Mojolicious development.

Please don't send patches unless you agree with them.

MISSION STATEMENT

Mojo is a runtime environment for Perl web frameworks. It provides all the basic tools and helpers needed to write simple web applications and higher level web frameworks such as Mojolicious.

All components should be reusable in other projects and in a UNIXish way only loosely coupled.

Especially for people new to Perl it should be as easy as possible to install Mojolicious and get started. Writing web applications can be one of the most fun ways to learn a language!

For developers of other web frameworks it should be possible to reuse all the infrastructure and just consider the higher levels of the Mojolicious distribution an example application.

RULES

Keep it simple, no magic unless absolutely necessary.

Code should be written with a Perl6 port in mind.

No refactoring unless a very important feature absolutely depends on it.

It's not a feature without a test.

A feature is only needed when the majority of the userbase benefits from it.

Features may not be changed without being deprecated for at least one major release.

Deprecating a feature should be avoided at all costs.

A major release can be version number independent and is signaled by a new unique code name.

Only add prereqs if absolutely necessary.

Domain specific languages should be avoided in favor of Perl'ish solutions.

No inline POD.

Documentation belongs to the book, module POD is just an API reference.

Lines should not be longer than 78 characters and we indent with 4 whitespaces.

Code should be run through Perl::Tidy with the included .perltidyrc.

No spaghetti code.

Code should be organized in blocks and those blocks should be commented.

Comments should be funny if possible.

Every file should contain at least one quote from The Simpsons or Futurama.

No names outside of the CREDITS section of Mojo.pm.

No Elitism.

Peace!