Security Advisories (10)

CPANSA-Mojolicious-2022-03 (2022-12-10)

Mojo::DOM did not correctly parse <script> tags.

CPANSA-Mojolicious-2021-02 (2021-06-01)

Small sessions could be used as part of a brute-force attack to decode the session secret.

https://github.com/mojolicious/mojo/pull/1791

CVE-2021-47208 (2021-03-16)

A bug in format detection can potentially be exploited for a DoS attack.

CVE-2018-25100 (2018-02-13)

Mojo::UserAgent::CookieJar leaks old cookies because of the missing host_only flag on empty domain.

CPANSA-Mojolicious-2015-01 (2015-02-02)

Directory traversal on Windows

CPANSA-Mojolicious-2018-03 (2018-05-19)

Mojo::UserAgent was not checking peer SSL certificates by default.

CVE-2020-36829 (2020-11-10)

Mojo::Util secure_compare can leak the string length. By immediately returning when the two strings are not the same length, the function allows an attacker to guess the length of the secret string using timing attacks.

https://github.com/mojolicious/mojo/pull/1601

CPANSA-Mojolicious-2018-02 (2018-05-11)

GET requests with embedded backslashes can be used to access local files on Windows hosts

CPANSA-Mojolicious-2014-01 (2014-10-07)

Context sensitivity of method param could lead to parameter injection attacks.

https://github.com/mojolicious/mojo/commit/a815d4797145f872ef6e9f1270841eda1d410afb

CVE-2024-58134 (2025-05-03)

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. These predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user's session.

NAME

Test::Mojo - Testing Mojo!

SYNOPSIS

use Test::More;
use Test::Mojo;

my $t = Test::Mojo->new('MyApp');

# HTML/XML
$t->get_ok('/welcome')->status_is(200)->text_is('div#message' => 'Hello!');

# JSON
$t->post_form_ok('/search.json' => {q => 'Perl'})
  ->status_is(200)
  ->header_is('X-Powered-By' => 'Mojolicious (Perl)')
  ->header_isnt('X-Bender' => 'Bite my shiny metal ass!');
  ->json_is('/results/4/title' => 'Perl rocks!');

# WebSocket
$t->websocket_ok('/echo')
  ->send_ok('hello')
  ->message_ok
  ->message_is('echo: hello')
  ->finish_ok;

done_testing();

DESCRIPTION

Test::Mojo is a collection of testing helpers for everyone developing Mojo and Mojolicious applications.

ATTRIBUTES

Test::Mojo implements the following attributes.

message

my $msg = $t->message;
$t      = $t->message([text => $bytes]);

Current WebSocket message.

# Test custom message
$t->message([binary => $bytes])
  ->json_message_has('/foo/bar')
  ->json_message_hasnt('/bar')
  ->json_message_is('/foo/baz' => {yada => [1, 2, 3]});

tx

my $tx = $t->tx;
$t     = $t->tx(Mojo::Transaction::HTTP->new);

Current transaction, usually a Mojo::Transaction::HTTP object.

# More specific tests
is $t->tx->res->json->{foo}, 'bar', 'right value';
ok $t->tx->res->is_multipart, 'multipart content';

# Test custom transactions
$t->tx($t->tx->previous)->status_is(302)->header_like(Location => qr/foo/);

ua

my $ua = $t->ua;
$t     = $t->ua(Mojo::UserAgent->new);

User agent used for testing, defaults to a Mojo::UserAgent object.

# Allow redirects
$t->ua->max_redirects(10);

# Customize all transactions (including followed redirects)
$t->ua->on(start => sub {
  my ($ua, $tx) = @_;
  $tx->req->headers->accept_language('en-US');
});

# Request with Basic authentication
$t->get_ok($t->ua->app_url->userinfo('sri:secr3t')->path('/secrets'));

METHODS

Test::Mojo inherits all methods from Mojo::Base and implements the following new ones.

new

my $t = Test::Mojo->new;
my $t = Test::Mojo->new('MyApp');
my $t = Test::Mojo->new(MyApp->new);

Construct a new Test::Mojo object.

app

my $app = $t->app;
$t      = $t->app(MyApp->new);

Access application with "app" in Mojo::UserAgent.

# Change log level
$t->app->log->level('fatal');

# Test application directly
is $t->app->defaults->{foo}, 'bar', 'right value';
ok $t->app->routes->find('echo')->is_websocket, 'WebSocket route';

# Change application behavior
$t->app->hook(before_dispatch => sub {
  my $self = shift;
  $self->render(text => 'This request did not reach the router.')
    if $self->req->url->path->contains('/user');
});

# Extract additional information
my $stash;
$t->app->hook(after_dispatch => sub { $stash = shift->stash });

content_is

$t = $t->content_is('working!');
$t = $t->content_is('working!', 'right content');

Check response content for exact match.

content_isnt

$t = $t->content_isnt('working!');
$t = $t->content_isnt('working!', 'different content');

Opposite of content_is.

content_like

$t = $t->content_like(qr/working!/);
$t = $t->content_like(qr/working!/, 'right content');

Check response content for similar match.

content_unlike

$t = $t->content_unlike(qr/working!/);
$t = $t->content_unlike(qr/working!/, 'different content');

Opposite of content_like.

content_type_is

$t = $t->content_type_is('text/html');
$t = $t->content_type_is('text/html', 'right content type');

Check response Content-Type header for exact match.

content_type_isnt

$t = $t->content_type_isnt('text/html');
$t = $t->content_type_isnt('text/html', 'different content type');

Opposite of content_type_is.

content_type_like

$t = $t->content_type_like(qr/text/);
$t = $t->content_type_like(qr/text/, 'right content type');

Check response Content-Type header for similar match.

content_type_unlike

$t = $t->content_type_unlike(qr/text/);
$t = $t->content_type_unlike(qr/text/, 'different content type');

Opposite of content_type_like.

delete_ok

$t = $t->delete_ok('/foo');
$t = $t->delete_ok('/foo' => {DNT => 1} => 'Hi!');

Perform a DELETE request and check for transport errors, takes the same arguments as "delete" in Mojo::UserAgent.

element_exists

$t = $t->element_exists('div.foo[x=y]');
$t = $t->element_exists('html head title', 'has a title');

Checks for existence of the CSS selectors first matching HTML/XML element with Mojo::DOM.

element_exists_not

$t = $t->element_exists_not('div.foo[x=y]');
$t = $t->element_exists_not('html head title', 'has no title');

Opposite of element_exists.

finish_ok

$t = $t->finish_ok;
$t = $t->finish_ok('finished successfully');

Finish WebSocket connection.

get_ok

$t = $t->get_ok('/foo');
$t = $t->get_ok('/foo' => {DNT => 1} => 'Hi!');

Perform a GET request and check for transport errors, takes the same arguments as "get" in Mojo::UserAgent.

head_ok

$t = $t->head_ok('/foo');
$t = $t->head_ok('/foo' => {DNT => 1} => 'Hi!');

Perform a HEAD request and check for transport errors, takes the same arguments as "head" in Mojo::UserAgent.

header_is

$t = $t->header_is(Expect => 'fun');
$t = $t->header_is(Expect => 'fun', 'right header');

Check response header for exact match.

header_isnt

$t = $t->header_isnt(Expect => 'fun');
$t = $t->header_isnt(Expect => 'fun', 'different header');

Opposite of header_is.

header_like

$t = $t->header_like(Expect => qr/fun/);
$t = $t->header_like(Expect => qr/fun/, 'right header');

Check response header for similar match.

header_unlike

$t = $t->header_like(Expect => qr/fun/);
$t = $t->header_like(Expect => qr/fun/, 'different header');

Opposite of header_like.

json_content_is

$t = $t->json_content_is([1, 2, 3]);
$t = $t->json_content_is([1, 2, 3], 'right content');
$t = $t->json_content_is({foo => 'bar', baz => 23}, 'right content');

Check response content for JSON data.

json_has

$t = $t->json_has('/foo');
$t = $t->json_has('/minibar', 'has a minibar');

Check if JSON response contains a value that can be identified using the given JSON Pointer with Mojo::JSON::Pointer.

json_hasnt

$t = $t->json_hasnt('/foo');
$t = $t->json_hasnt('/minibar', 'no minibar');

Opposite of json_has.

json_is

$t = $t->json_is('/' => {foo => [1, 2, 3]});
$t = $t->json_is('/foo' => [1, 2, 3]);
$t = $t->json_is('/foo/1' => 2, 'right value');

Check the value extracted from JSON response using the given JSON Pointer with Mojo::JSON::Pointer.

json_message_has

$t = $t->json_message_has('/foo');
$t = $t->json_message_has('/minibar', 'has a minibar');

Check if JSON WebSocket message contains a value that can be identified using the given JSON Pointer with Mojo::JSON::Pointer.

json_message_hasnt

$t = $t->json_message_hasnt('/foo');
$t = $t->json_message_hasnt('/minibar', 'no minibar');

Opposite of json_message_has.

json_message_is

$t = $t->json_message_is('/' => {foo => [1, 2, 3]});
$t = $t->json_message_is('/foo' => [1, 2, 3]);
$t = $t->json_message_is('/foo/1' => 2, 'right value');

Check the value extracted from JSON WebSocket message using the given JSON Pointer with Mojo::JSON::Pointer.

message_is

$t = $t->message_is({binary => $bytes});
$t = $t->message_is({text   => $bytes});
$t = $t->message_is('working!');
$t = $t->message_is('working!', 'right message');

Check WebSocket message for exact match.

message_isnt

$t = $t->message_isnt({binary => $bytes});
$t = $t->message_isnt({text   => $bytes});
$t = $t->message_isnt('working!');
$t = $t->message_isnt('working!', 'different message');

Opposite of message_is.

message_like

$t = $t->message_like({binary => qr/$bytes/});
$t = $t->message_like({text   => qr/$bytes/});
$t = $t->message_like(qr/working!/);
$t = $t->message_like(qr/working!/, 'right message');

Check WebSocket message for similar match.

message_ok

$t = $t->message_ok;
$t = $t->message_ok('got a message');

Wait for next WebSocket message to arrive.

# Wait for message and perform multiple tests on it
$t->websocket_ok('/time')
  ->message_ok
  ->message_like(qr/\d+/)
  ->message_unlike(qr/\w+/)
  ->finish_ok;

message_unlike

$t = $t->message_unlike({binary => qr/$bytes/});
$t = $t->message_unlike({text   => qr/$bytes/});
$t = $t->message_unlike(qr/working!/);
$t = $t->message_unlike(qr/working!/, 'different message');

Opposite of message_like.

options_ok

$t = $t->options_ok('/foo');
$t = $t->options_ok('/foo' => {DNT => 1} => 'Hi!');

Perform a OPTIONS request and check for transport errors, takes the same arguments as "options" in Mojo::UserAgent.

or

$t = $t->or(sub {...});

Invoke callback if previous test failed.

# Diagnostics
$t->get_ok('/bad')->or(sub { diag 'Must have been Glen!' })
  ->status_is(200)->or(sub { diag $t->tx->res->dom->at('title')->text });

patch_ok

$t = $t->patch_ok('/foo');
$t = $t->patch_ok('/foo' => {DNT => 1} => 'Hi!');

Perform a PATCH request and check for transport errors, takes the same arguments as "patch" in Mojo::UserAgent.

post_ok

$t = $t->post_ok('/foo');
$t = $t->post_ok('/foo' => {DNT => 1} => 'Hi!');

Perform a POST request and check for transport errors, takes the same arguments as "post" in Mojo::UserAgent.

post_form_ok

$t = $t->post_form_ok('/foo' => {a => 'b'});
$t = $t->post_form_ok('/foo' => 'UTF-8' => {a => 'b'} => {DNT => 1});

Perform a POST request with form data and check for transport errors, takes the same arguments as "post_form" in Mojo::UserAgent.

# Test file upload
$t->post_form_ok('/upload' => {foo => {content => 'bar'}})->status_is(200);

post_json_ok

$t = $t->post_json_ok('/foo' => {a => 'b'});
$t = $t->post_json_ok('/foo' => {a => 'b'} => {DNT => 1});

Perform a POST request with JSON data and check for transport errors, takes the same arguments as "post_json" in Mojo::UserAgent.

# Test JSON API
$t->post_json_ok('/hello.json' => {hello => 'world'})
  ->status_is(200)
  ->json_content_is({bye => 'world'});

put_ok

$t = $t->put_ok('/foo');
$t = $t->put_ok('/foo' => {DNT => 1} => 'Hi!');

Perform a PUT request and check for transport errors, takes the same arguments as "put" in Mojo::UserAgent.

request_ok

$t = $t->request_ok(Mojo::Transaction::HTTP->new);
$t = $t->request_ok(Mojo::Transaction::HTTP->new, 'request successful');

Perform request and check for transport errors.

# Customize transaction
my $tx = $t->ua->build_json_tx('/user/99' => {name => 'sri'});
$tx->req->method('PUT');
$t->request_ok($tx)
  ->status_is(200)
  ->json_is('/message' => 'User has been replaced.');

reset_session

$t = $t->reset_session;

Reset user agent session.

send_ok

$t = $t->send_ok({binary => $bytes});
$t = $t->send_ok({text   => $bytes});
$t = $t->send_ok([$fin, $rsv1, $rsv2, $rsv3, $op, $payload]);
$t = $t->send_ok($chars);
$t = $t->send_ok($chars, 'sent successfully');

Send message or frame via WebSocket.

status_is

$t = $t->status_is(200);
$t = $t->status_is(200, 'right status');

Check response status for exact match.

status_isnt

$t = $t->status_isnt(200);
$t = $t->status_isnt(200, 'different status');

Opposite of status_is.

text_is

$t = $t->text_is('div.foo[x=y]' => 'Hello!');
$t = $t->text_is('html head title' => 'Hello!', 'right title');

Checks text content of the CSS selectors first matching HTML/XML element for exact match with Mojo::DOM.

text_isnt

$t = $t->text_isnt('div.foo[x=y]' => 'Hello!');
$t = $t->text_isnt('html head title' => 'Hello!', 'different title');

Opposite of text_is.

text_like

$t = $t->text_like('div.foo[x=y]' => qr/Hello/);
$t = $t->text_like('html head title' => qr/Hello/, 'right title');

Checks text content of the CSS selectors first matching HTML/XML element for similar match with Mojo::DOM.

text_unlike

$t = $t->text_unlike('div.foo[x=y]' => qr/Hello/);
$t = $t->text_unlike('html head title' => qr/Hello/, 'different title');

Opposite of text_like.

websocket_ok

$t = $t->websocket_ok('/echo');
$t = $t->websocket_ok('/echo' => {DNT => 1});

Open a WebSocket connection with transparent handshake, takes the same arguments as "websocket" in Mojo::UserAgent.

	Global
`s`	Focus search bar
`?`	Bring up this help dialog

	GitHub
`g` `p`	Go to pull requests
`g` `i`	Go to GitHub issues (only if GitHub is preferred repository)

	POD
`g` `a`	Go to author
`g` `c`	Go to changes
`g` `i`	Go to issues
`g` `d`	Go to dist
`g` `r`	Go to repository/SCM
`g` `s`	Go to source
`g` `b`	Go to file browse

Search terms
module: (e.g. module:Plugin)
distribution: (e.g. distribution:Dancer auth)
author: (e.g. author:SONGMU Redis)
version: (e.g. version:1.00)