Security Advisories (10)
CPANSA-Mojolicious-2022-03 (2022-12-10)

Mojo::DOM did not correctly parse <script> tags.

CPANSA-Mojolicious-2021-02 (2021-06-01)

Small sessions could be used as part of a brute-force attack to decode the session secret.

CVE-2021-47208 (2021-03-16)

A bug in format detection can potentially be exploited for a DoS attack.

CVE-2018-25100 (2018-02-13)

Mojo::UserAgent::CookieJar leaks old cookies because of the missing host_only flag on empty domain.

CPANSA-Mojolicious-2015-01 (2015-02-02)

Directory traversal on Windows

CPANSA-Mojolicious-2018-03 (2018-05-19)

Mojo::UserAgent was not checking peer SSL certificates by default.

CVE-2020-36829 (2020-11-10)

Mojo::Util secure_compare can leak the string length. By immediately returning when the two strings are not the same length, the function allows an attacker to guess the length of the secret string using timing attacks.

CPANSA-Mojolicious-2018-02 (2018-05-11)

GET requests with embedded backslashes can be used to access local files on Windows hosts

CPANSA-Mojolicious-2014-01 (2014-10-07)

Context sensitivity of method param could lead to parameter injection attacks.

CVE-2024-58134 (2025-05-03)

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. These predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user's session.

NAME

Mojo::Transaction::WebSocket - WebSocket Transaction Container

SYNOPSIS

use Mojo::Transaction::WebSocket;

DESCRIPTION

Mojo::Transaction::WebSocket is a container for WebSocket transactions as described in draft-ietf-hybi-thewebsocketprotocol-10. Note that this module is EXPERIMENTAL and might change without warning!

ATTRIBUTES

Mojo::Transaction::WebSocket inherits all attributes from Mojo::Transaction and implements the following new ones.

handshake

my $handshake = $ws->handshake;
$ws           = $ws->handshake(Mojo::Transaction::HTTP->new);

The original handshake transaction, defaults to a Mojo::Transaction::HTTP object.

masked

my $masked = $ws->masked;
$ws        = $ws->masked(1);

Mask outgoing frames with XOR cipher and a random 32bit key.

max_websocket_size

my $size = $ws->max_websocket_size;
$ws      = $ws->max_websocket_size(1024);

Maximum WebSocket message size in bytes, defaults to 262144.

on_message

my $cb = $ws->on_message;
$ws    = $ws->on_message(sub {...});

Callback to be invoked for each decoded message.

$ws->on_message(sub {
  my ($self, $message) = @_;
});

METHODS

Mojo::Transaction::WebSocket inherits all methods from Mojo::Transaction and implements the following new ones.

client_challenge

my $success = $ws->client_challenge;

Check WebSocket handshake challenge, only used by client.

client_close

$ws = $ws->client_close;

Connection got closed, only used by clients.

client_handshake

$ws = $ws->client_handshake;

WebSocket handshake, only used by clients.

client_read

$ws = $ws->client_read($data);

Read raw WebSocket data, only used by clients.

client_write

my $chunk = $ws->client_write;

Raw WebSocket data to write, only used by clients.

connection

my $connection = $ws->connection;

The connection this websocket is using.

finish

$ws = $ws->finish;

Finish the WebSocket connection gracefully.

is_websocket

my $is_websocket = $ws->is_websocket;

True.

local_address

my $local_address = $ws->local_address;

The local address of this WebSocket.

local_port

my $local_port = $ws->local_port;

The local port of this WebSocket.

remote_address

my $remote_address = $ws->remote_address;

The remote address of this WebSocket.

remote_port

my $remote_port = $ws->remote_port;

The remote port of this WebSocket.

req

my $req = $ws->req;

The original handshake request.

res

my $req = $ws->res;

The original handshake response.

resume

$ws = $ws->resume;

Resume transaction.

send_message

$ws->send_message('Hi there!');
$ws->send_message('Hi there!', sub {...});

Send a message over the WebSocket, encoding and framing will be handled transparently.

server_handshake

$ws = $ws->server_handshake;

WebSocket handshake, only used by servers.

server_read

$ws = $ws->server_read($data);

Read raw WebSocket data, only used by servers.

server_write

my $chunk = $ws->server_write;

Raw WebSocket data to write, only used by servers.

DEBUGGING

You can set the MOJO_WEBSOCKET_DEBUG environment variable to get some advanced diagnostics information printed to STDERR.

MOJO_WEBSOCKET_DEBUG=1

SEE ALSO

Mojolicious, Mojolicious::Guides, http://mojolicio.us.