Security Advisories (12)
CPANSA-Mojolicious-2022-03 (2022-12-10)

Mojo::DOM did not correctly parse <script> tags.

CPANSA-Mojolicious-2021-02 (2021-06-01)

Small sessions could be used as part of a brute-force attack to decode the session secret.

CVE-2021-47208 (2021-03-16)

A bug in format detection can potentially be exploited for a DoS attack.

CVE-2018-25100 (2018-02-13)

Mojo::UserAgent::CookieJar leaks old cookies because of the missing host_only flag on empty domain.

CPANSA-Mojolicious-2015-01 (2015-02-02)

Directory traversal on Windows

CPANSA-Mojolicious-2018-03 (2018-05-19)

Mojo::UserAgent was not checking peer SSL certificates by default.

CPANSA-Mojolicious-2018-02 (2018-05-11)

GET requests with embedded backslashes can be used to access local files on Windows hosts

CPANSA-Mojolicious-2014-01 (2014-10-07)

Context sensitivity of method param could lead to parameter injection attacks.

CVE-2011-1841 (2011-03-10)

Mojolicious is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by link_to helper. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

CVE-2011-1589 (2011-04-05)

Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot slash) in a URI.

CVE-2011-1841 (2011-05-03)

Cross-site scripting (XSS) vulnerability in the link_to helper in Mojolicious before 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2024-58134 (2025-05-03)

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies.  An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.

NAME

Mojolicious::Guides::CodingGuidelines - Coding Guidelines

OVERVIEW

This document describes the coding guidelines that are the foundations of Mojo and Mojolicious development.

Please don't send patches unless you agree with them.

MISSION STATEMENT

Mojo is a runtime environment for Perl web frameworks. It provides all the basic tools and helpers needed to write simple web applications and higher level web frameworks such as Mojolicious.

All components should be reusable in other projects and in a UNIXish way only loosely coupled.

Especially for people new to Perl it should be as easy as possible to install Mojolicious and get started. Writing web applications can be one of the most fun ways to learn a language!

For developers of other web frameworks it should be possible to reuse all the infrastructure and just consider the higher levels of the Mojolicious distribution an example application.

RULES

Web development should be easy and fun, this is what we optimize for.

The web is a moving target, to stay relevant we have to stay in motion too.

Keep it simple, no magic unless absolutely necessary.

Code should be written with a Perl6 port in mind.

No refactoring unless a very important feature absolutely depends on it.

It's not a feature without a test.

A feature is only needed when the majority of the userbase benefits from it.

Features may not be changed without being deprecated for at least one major release.

Deprecating a feature should be avoided at all costs.

A major release can be version number independent and is signaled by a new unique code name based on a unicode character.

New features can be marked as experimental to be excluded from deprecation policies.

Only add prereqs if absolutely necessary and make them optional if possible.

Domain specific languages should be avoided in favor of Perl'ish solutions.

No inline POD.

Documentation belongs to the guides, module POD is just an API reference.

The main focus of the included documentation should be on examples, no walls of text. (An example for every one or two sentences is a good rule of thumb)

The master source code repository should always be kept in a stable state, use feature branches for actual development.

Lines should not be longer than 78 characters and we indent with 4 whitespaces.

Code should be run through Perl::Tidy with the included .perltidyrc.

No spaghetti code.

Code should be organized in blocks and those blocks should be commented.

Comments should be funny if possible.

Every file should contain at least one quote from The Simpsons or Futurama.

No names outside of the CREDITS section of Mojo.pm.

No Elitism.

Peace!