Security Advisories (8)
CPANSA-Mojolicious-2022-03 (2022-12-10)

Mojo::DOM did not correctly parse <script> tags.

CPANSA-Mojolicious-2021-02 (2021-06-01)

Small sessions could be used as part of a brute-force attack to decode the session secret.

CVE-2021-47208 (2021-03-16)

A bug in format detection can potentially be exploited for a DoS attack.

CVE-2018-25100 (2018-02-13)

Mojo::UserAgent::CookieJar leaks old cookies because of the missing host_only flag on empty domain.

CPANSA-Mojolicious-2018-03 (2018-05-19)

Mojo::UserAgent was not checking peer SSL certificates by default.

CVE-2020-36829 (2020-11-10)

Mojo::Util secure_compare can leak the string length. By immediately returning when the two strings are not the same length, the function allows an attacker to guess the length of the secret string using timing attacks.

CPANSA-Mojolicious-2018-02 (2018-05-11)

GET requests with embedded backslashes can be used to access local files on Windows hosts

CVE-2024-58134 (2025-05-03)

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. These predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user's session.

NAME

Mojo::File - File system paths

SYNOPSIS

use Mojo::File;

# Portably deal with file system paths
my $path = Mojo::File->new('/home/sri/.vimrc');
say $path->slurp;
say $path->basename;
say $path->dirname->child('.bashrc');

# Use the alternative constructor
use Mojo::File 'path';
my $path = path('/tmp/foo/bar')->make_path;
$path->child('test.txt')->spurt('Hello Mojo!');

DESCRIPTION

Mojo::File is a scalar-based container for file system paths that provides a friendly API for dealing with different operating systems.

# Access scalar directly to manipulate path
my $path = Mojo::File->new('/home/sri/test');
$$path .= '.txt';

FUNCTIONS

Mojo::File implements the following functions, which can be imported individually.

path

my $path = path;
my $path = path('/home/sri/.vimrc');
my $path = path('/home', 'sri', '.vimrc');
my $path = path(File::Temp->newdir);

Construct a new scalar-based Mojo::File object, defaults to using the current working directory.

# "foo/bar/baz.txt" (on UNIX)
path('foo', 'bar', 'baz.txt');

tempdir

my $path = tempdir;
my $path = tempdir('tempXXXXX');

Construct a new scalar-based Mojo::File object for a temporary directory with File::Temp.

# Longer version
my $path = Mojo::File->new(File::Temp->newdir('tempXXXXX'));

METHODS

Mojo::File implements the following methods.

basename

my $name = $path->basename;
my $name = $path->basename('.txt');

Return the last level of the path with File::Basename.

# ".vimrc" (on UNIX)
Mojo::File->new('/home/sri/.vimrc')->basename;

# "test" (on UNIX)
Mojo::File->new('/home/sri/test.txt')->basename('.txt');

child

my $child = $path->child('.vimrc');

Return a new Mojo::File object relative to the path.

# "/home/sri/.vimrc" (on UNIX)
Mojo::File->new('/home')->child('sri', '.vimrc');

dirname

my $name = $path->dirname;

Return all but the last level of the path with File::Basename as a Mojo::File object.

# "/home/sri" (on UNIX)
Mojo::File->new('/home/sri/.vimrc')->dirname;

is_abs

my $bool = $path->is_abs;

Check if the path is absolute.

# True (on UNIX)
Mojo::File->new('/home/sri/.vimrc')->is_abs;

# False (on UNIX)
Mojo::File->new('.vimrc')->is_abs;

list

my $collection = $path->list;
my $collection = $path->list({hidden => 1});

List all files in the directory and return a Mojo::Collection object containing the results as Mojo::File objects.

# List files
say for Mojo::File->new('/home/sri/myapp')->list->each;

These options are currently available:

dir
dir => 1

Include directories.

hidden
hidden => 1

Include hidden files.

list_tree

my $collection = $path->list_tree;
my $collection = $path->list_tree({hidden => 1});

List all files recursively in the directory and return a Mojo::Collection object containing the results as Mojo::File objects.

# List all templates
say for Mojo::File->new('/home/sri/myapp/templates')->list_tree->each;

These options are currently available:

hidden
hidden => 1

Include hidden files and directories.

make_path

$path = $path->make_path;

Create the directories if they don't already exist with File::Path.

move_to

$path = $path->move_to('/home/sri/.vimrc.backup');

Move the file.

new

my $path = Mojo::File->new;
my $path = Mojo::File->new('/home/sri/.vimrc');
my $path = Mojo::File->new('/home', 'sri', '.vimrc');
my $path = Mojo::File->new(File::Temp->newdir);

Construct a new Mojo::File object, defaults to using the current working directory.

# "foo/bar/baz.txt" (on UNIX)
Mojo::File->new('foo', 'bar', 'baz.txt');

slurp

my $bytes = $path->slurp;

Read all data at once from the file.

spurt

$path = $path->spurt($bytes);

Write all data at once to the file.

tap

$path = $path->tap(sub {...});

Alias for "tap" in Mojo::Base.

to_abs

my $absolute = $path->to_abs;

Return the canonical path as a Mojo::File object.

to_array

my $parts = $path->to_array;

Split the path on directory separators.

# "home:sri:.vimrc" (on UNIX)
join ':', @{Mojo::File->new('/home/sri/.vimrc')->to_array};

to_rel

my $relative = $path->to_rel('/some/base/path');

Return a relative path from the original path to the destination path as a Mojo::File object.

# "sri/.vimrc" (on UNIX)
Mojo::File->new('/home/sri/.vimrc')->to_rel('/home');

to_string

my $str = $path->to_string;

Stringify the path.

OPERATORS

Mojo::File overloads the following operators.

array

my @parts = @$path;

Alias for "to_array".

bool

my $bool = !!$path;

Always true.

stringify

my $str = "$path";

Alias for "to_string".

SEE ALSO

Mojolicious, Mojolicious::Guides, http://mojolicious.org.