Security Advisories (10)
CPANSA-Mojolicious-2022-03 (2022-12-10)

Mojo::DOM did not correctly parse <script> tags.

CPANSA-Mojolicious-2021-02 (2021-06-01)

Small sessions could be used as part of a brute-force attack to decode the session secret.

CVE-2021-47208 (2021-03-16)

A bug in format detection can potentially be exploited for a DoS attack.

CVE-2018-25100 (2018-02-13)

Mojo::UserAgent::CookieJar leaks old cookies because of the missing host_only flag on empty domain.

CPANSA-Mojolicious-2015-01 (2015-02-02)

Directory traversal on Windows

CPANSA-Mojolicious-2018-03 (2018-05-19)

Mojo::UserAgent was not checking peer SSL certificates by default.

CVE-2020-36829 (2020-11-10)

Mojo::Util secure_compare can leak the string length. By immediately returning when the two strings are not the same length, the function allows an attacker to guess the length of the secret string using timing attacks.

CPANSA-Mojolicious-2018-02 (2018-05-11)

GET requests with embedded backslashes can be used to access local files on Windows hosts

CPANSA-Mojolicious-2014-01 (2014-10-07)

Context sensitivity of method param could lead to parameter injection attacks.

CVE-2024-58134 (2025-05-03)

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. These predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user's session.

NAME

Mojo::JSON - Minimalistic JSON

SYNOPSIS

use Mojo::JSON;

my $json   = Mojo::JSON->new;
my $string = $json->encode({foo => [1, 2], bar => 'hello!'});
my $hash   = $json->decode('{"foo": [3, -2, 1]}');

DESCRIPTION

Mojo::JSON is a minimalistic and relaxed implementation of RFC 4627. While it is possibly the fastest pure-Perl JSON parser available, you should not use it for validation.

It supports normal Perl data types like Scalar, Array, Hash and will try to stringify blessed references.

[1, -2, 3]     -> [1, -2, 3]
{"foo": "bar"} -> {foo => 'bar'}

Literal names will be translated to and from Mojo::JSON constants or a similar native Perl value.

true  -> Mojo::JSON->true
false -> Mojo::JSON->false
null  -> undef

Decoding UTF-16 (LE/BE) and UTF-32 (LE/BE) will be handled transparently, encoding will only generate UTF-8. The two unicode whitespace characters u2028 and u2029 will always be escaped to make JSONP easier.

ATTRIBUTES

Mojo::JSON implements the following attributes.

error

my $error = $json->error;
$json     = $json->error('Oops!');

Parser errors.

METHODS

Mojo::JSON inherits all methods from Mojo::Base and implements the following new ones.

decode

my $array = $json->decode('[1, 2, 3]');
my $hash  = $json->decode('{"foo": "bar"}');

Decode JSON string.

encode

my $string = $json->encode({foo => 'bar'});

Encode Perl structure.

false

my $false = Mojo::JSON->false;
my $false = $json->false;

False value, used because Perl has no native equivalent.

true

my $true = Mojo::JSON->true;
my $true = $json->true;

True value, used because Perl has no native equivalent.

SEE ALSO

Mojolicious, Mojolicious::Guides, http://mojolicio.us.