Security Advisories (10)
CPANSA-Mojolicious-2022-03 (2022-12-10)

Mojo::DOM did not correctly parse <script> tags.

CPANSA-Mojolicious-2021-02 (2021-06-01)

Small sessions could be used as part of a brute-force attack to decode the session secret.

CVE-2021-47208 (2021-03-16)

A bug in format detection can potentially be exploited for a DoS attack.

CVE-2018-25100 (2018-02-13)

Mojo::UserAgent::CookieJar leaks old cookies because of the missing host_only flag on empty domain.

CPANSA-Mojolicious-2015-01 (2015-02-02)

Directory traversal on Windows

CPANSA-Mojolicious-2018-03 (2018-05-19)

Mojo::UserAgent was not checking peer SSL certificates by default.

CVE-2020-36829 (2020-11-10)

Mojo::Util secure_compare can leak the string length. By immediately returning when the two strings are not the same length, the function allows an attacker to guess the length of the secret string using timing attacks.

CPANSA-Mojolicious-2018-02 (2018-05-11)

GET requests with embedded backslashes can be used to access local files on Windows hosts

CPANSA-Mojolicious-2014-01 (2014-10-07)

Context sensitivity of method param could lead to parameter injection attacks.

CVE-2024-58134 (2025-05-03)

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. These predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user's session.

NAME

Mojo::Util - Portable utility functions

SYNOPSIS

use Mojo::Util qw/url_escape url_unescape/;

my $string = 'test=23';
url_escape $string;
url_unescape $string;

DESCRIPTION

Mojo::Util provides portable utility functions for Mojo. Note that this module is EXPERIMENTAL and might change without warning!

FUNCTIONS

Mojo::Util implements the following functions.

b64_decode

b64_decode $string;

Base64 decode in-place.

b64_encode

b64_encode $string;

Base64 encode in-place.

camelize

camelize $string;

Convert snake case string to camel case and replace - with :: in-place.

foo_bar     -> FooBar
foo_bar-baz -> FooBar::Baz

decamelize

decamelize $string;

Convert camel case string to snake case and replace :: with - in-place.

FooBar      -> foo_bar
FooBar::Baz -> foo_bar-baz

decode

decode 'UTF-8', $octets;

Decode octets in-place.

encode

encode 'UTF-8', $chars;

Encode characters in-place.

get_line

my $line = get_line $chunk;

Extract a whole line from chunk or return undef. Lines are expected to end with 0x0d 0x0a or 0x0a.

hmac_md5_sum

my $checksum = hmac_md5_sum $string, $secret;

Generate HMAC-MD5 checksum for string.

hmac_sha1_sum

my $checksum = hmac_sha1_sum $string, $secret;

Generate HMAC-SHA1 checksum for string.

html_escape

html_escape $string;

HTML escape string in-place.

html_unescape

html_unescape $string;

HTML unescape string in-place.

md5_bytes

my $checksum = md5_bytes $string;

Generate binary MD5 checksum.

md5_sum

my $checksum = md5_sum $string;

Generate MD5 checksum.

punycode_decode

punycode_decode $string;

Punycode decode string in-place, as described in RFC 3492.

punycode_encode

punycode_encode $string;

Punycode encode string in-place, as described in RFC 3492.

quote

quote $string;

Quote string in-place.

qp_decode

qp_decode $string;

Quoted Printable decode in-place.

qp_encode

qp_encode $string;

Quoted Printable encode in-place.

secure_compare

my $success = secure_compare $string1, $string2;

Constant time comparison algorithm to prevent timing attacks.

sha1_bytes

my $checksum = sha1_bytes $string;

Generate binary SHA1 checksum.

sha1_sum

my $checksum = sha1_sum $string;

Generate SHA1 checksum.

trim

trim $string;

Trim whitespace characters from both ends of string in-place.

unquote

unquote $string;

Unquote string in-place.

url_escape

url_escape $string;
url_escape $string, 'A-Za-z0-9\-\.\_\~';

URL escape in-place.

url_unescape

url_unescape $string;

URL unescape in-place.

xml_escape

xml_escape $string;

XML escape string in-place, this is a much faster version of html_escape escaping only the characters &, <, >, " and '.

SEE ALSO

Mojolicious, Mojolicious::Guides, http://mojolicio.us.