/ 
Mojolicious-2.21
⭐ Starred 2674
/ Test::Mojo
Security Advisories (10)
CPANSA-Mojolicious-2022-03 (2022-12-10)

Mojo::DOM did not correctly parse <script> tags.

CPANSA-Mojolicious-2021-02 (2021-06-01)

Small sessions could be used as part of a brute-force attack to decode the session secret.

CVE-2021-47208 (2021-03-16)

A bug in format detection can potentially be exploited for a DoS attack.

CVE-2018-25100 (2018-02-13)

Mojo::UserAgent::CookieJar leaks old cookies because of the missing host_only flag on empty domain.

CPANSA-Mojolicious-2015-01 (2015-02-02)

Directory traversal on Windows

CPANSA-Mojolicious-2018-03 (2018-05-19)

Mojo::UserAgent was not checking peer SSL certificates by default.

CVE-2020-36829 (2020-11-10)

Mojo::Util secure_compare can leak the string length. By immediately returning when the two strings are not the same length, the function allows an attacker to guess the length of the secret string using timing attacks.

CPANSA-Mojolicious-2018-02 (2018-05-11)

GET requests with embedded backslashes can be used to access local files on Windows hosts

CPANSA-Mojolicious-2014-01 (2014-10-07)

Context sensitivity of method param could lead to parameter injection attacks.

CVE-2024-58134 (2025-05-03)

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. These predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user's session.

NAME

Test::Mojo - Testing Mojo!

SYNOPSIS

use Test::More tests => 10;
use Test::Mojo;

my $t = Test::Mojo->new('MyApp');

$t->get_ok('/welcome')
  ->status_is(200)
  ->content_like(qr/Hello!/, 'welcome message');

$t->post_form_ok('/search', {title => 'Perl', author => 'taro'})
  ->status_is(200)
  ->content_like(qr/Perl.+taro/);

$t->delete_ok('/something')
  ->status_is(200)
  ->header_is('X-Powered-By' => 'Mojolicious (Perl)')
  ->header_isnt('X-Bender' => 'Bite my shiny metal ass!');
  ->content_is('Hello world!');

$t->websocket_ok('/echo')
  ->send_message_ok('hello')
  ->message_is('echo: hello')
  ->finish_ok;

DESCRIPTION

Test::Mojo is a collection of testing helpers for everyone developing Mojo and Mojolicious applications.

ATTRIBUTES

Test::Mojo implements the following attributes.

tx

my $tx = $t->tx;
$t     = $t->tx(Mojo::Transaction::HTTP->new);

Current transaction, usually a Mojo::Transaction::HTTP object.

ua

my $ua = $t->ua;
$t     = $t->ua(Mojo::UserAgent->new);

User agent used for testing, defaults to a Mojo::UserAgent object.

METHODS

Test::Mojo inherits all methods from Mojo::Base and implements the following new ones.

new

my $t = Test::Mojo->new;
my $t = Test::Mojo->new('MyApp');
my $t = Test::Mojo->new(MyApp->new);

Construct a new Test::Mojo object.

app

my $app = $t->app;
$t      = $t->app(MyApp->new);

Alias for "app" in Mojo::UserAgent.

my $secret = $t->app->secret;
$t->app->log->level('fatal');
$t->app->defaults(testing => 'oh yea!');

content_is

$t = $t->content_is('working!');
$t = $t->content_is('working!', 'right content');

Check response content for exact match.

content_isnt

$t = $t->content_isnt('working!');
$t = $t->content_isnt('working!', 'different content');

Opposite of content_is.

content_like

$t = $t->content_like(qr/working!/);
$t = $t->content_like(qr/working!/, 'right content');

Check response content for similar match.

content_unlike

$t = $t->content_unlike(qr/working!/);
$t = $t->content_unlike(qr/working!/, 'different content');

Opposite of content_like.

content_type_is

$t = $t->content_type_is('text/html');

Check response Content-Type header for exact match.

content_type_isnt

$t = $t->content_type_isnt('text/html');

Opposite of content_type_is.

content_type_like

$t = $t->content_type_like(qr/text/);
$t = $t->content_type_like(qr/text/, 'right content type');

Check response Content-Type header for similar match.

content_type_unlike

$t = $t->content_type_unlike(qr/text/);
$t = $t->content_type_unlike(qr/text/, 'different content type');

Opposite of content_type_like.

delete_ok

$t = $t->delete_ok('/foo');

Perform a DELETE request and check for success, takes the exact same arguments as "delete" in Mojo::UserAgent.

element_exists

$t = $t->element_exists('div.foo[x=y]');
$t = $t->element_exists('html head title', 'has a title');

Checks for existence of the CSS3 selectors first matching XML/HTML element with Mojo::DOM.

element_exists_not

$t = $t->element_exists_not('div.foo[x=y]');
$t = $t->element_exists_not('html head title', 'has no title');

Opposite of element_exists.

finish_ok

$t = $t->finish_ok;
$t = $t->finish_ok('finished successfully');

Finish WebSocket connection. Note that this method is EXPERIMENTAL and might change without warning!

get_ok

$t = $t->get_ok('/foo');

Perform a GET request and check for success, takes the exact same arguments as "get" in Mojo::UserAgent.

head_ok

$t = $t->head_ok('/foo');

Perform a HEAD request and check for success, takes the exact same arguments as "head" in Mojo::UserAgent.

header_is

$t = $t->header_is(Expect => 'fun');

Check response header for exact match.

header_isnt

$t = $t->header_isnt(Expect => 'fun');

Opposite of header_is.

header_like

$t = $t->header_like(Expect => qr/fun/);
$t = $t->header_like(Expect => qr/fun/, 'right header');

Check response header for similar match.

header_unlike

$t = $t->header_like(Expect => qr/fun/);
$t = $t->header_like(Expect => qr/fun/, 'different header');

Opposite of header_like.

json_content_is

$t = $t->json_content_is([1, 2, 3]);
$t = $t->json_content_is([1, 2, 3], 'right content!');
$t = $t->json_content_is({foo => 'bar', baz => 23}, 'right content!');

Check response content for JSON data.

max_redirects

my $max_redirects = $t->max_redirects;
$t                = $t->max_redirects(3);

Alias for the "max_redirects" in Mojo::UserAgent.

message_is

$t = $t->message_is('working!');
$t = $t->message_is('working!', 'right message');

Check WebSocket message for exact match. Note that this method is EXPERIMENTAL and might change without warning!

message_isnt

$t = $t->message_isnt('working!');
$t = $t->message_isnt('working!', 'different message');

Opposite of message_is. Note that this method is EXPERIMENTAL and might change without warning!

message_like

$t = $t->message_like(qr/working!/);
$t = $t->message_like(qr/working!/, 'right message');

Check WebSocket message for similar match. Note that this method is EXPERIMENTAL and might change without warning!

message_unlike

$t = $t->message_unlike(qr/working!/);
$t = $t->message_unlike(qr/working!/, 'different message');

Opposite of message_like. Note that this method is EXPERIMENTAL and might change without warning!

post_ok

$t = $t->post_ok('/foo');

Perform a POST request and check for success, takes the exact same arguments as "post" in Mojo::UserAgent.

post_form_ok

$t = $t->post_form_ok('/foo' => {test => 123});

Submit a POST form and check for success, takes the exact same arguments as "post_form" in Mojo::UserAgent.

put_ok

$t = $t->put_ok('/foo');

Perform a PUT request and check for success, takes the exact same arguments as "put" in Mojo::UserAgent.

reset_session

$t = $t->reset_session;

Reset user agent session.

send_message_ok

$t = $t->send_message_ok('hello');
$t = $t->send_message_ok('hello', 'sent successfully');

Send WebSocket message. Note that this method is EXPERIMENTAL and might change without warning!

status_is

$t = $t->status_is(200);

Check response status for exact match.

status_isnt

$t = $t->status_isnt(200);

Opposite of status_is.

test_server

my $url = $t->test_server;
my $url = $t->test_server('http');
my $url = $t->test_server('https');

Alias for "test_server" in Mojo::UserAgent. Note that this method is EXPERIMENTAL and might change without warning!

$t->get_ok($t->test_server->userinfo('sri:secr3t')->path('/protected'));

text_is

$t = $t->text_is('div.foo[x=y]' => 'Hello!');
$t = $t->text_is('html head title' => 'Hello!', 'right title');

Checks text content of the CSS3 selectors first matching XML/HTML element for exact match with Mojo::DOM.

text_isnt

$t = $t->text_isnt('div.foo[x=y]' => 'Hello!');
$t = $t->text_isnt('html head title' => 'Hello!', 'different title');

Opposite of text_is.

text_like

$t = $t->text_like('div.foo[x=y]' => qr/Hello/);
$t = $t->text_like('html head title' => qr/Hello/, 'right title');

Checks text content of the CSS3 selectors first matching XML/HTML element for similar match with Mojo::DOM.

text_unlike

$t = $t->text_unlike('div.foo[x=y]' => qr/Hello/);
$t = $t->text_unlike('html head title' => qr/Hello/, 'different title');

Opposite of text_like.

websocket_ok

$t = $t->websocket_ok('/echo');

Open a WebSocket connection with transparent handshake, takes the exact same arguments as "websocket" in Mojo::UserAgent. Note that this method is EXPERIMENTAL and might change without warning!

SEE ALSO

Mojolicious, Mojolicious::Guides, http://mojolicio.us.