Security Advisories (8)
CPANSA-Mojolicious-2022-03 (2022-12-10)

Mojo::DOM did not correctly parse <script> tags.

CPANSA-Mojolicious-2021-02 (2021-06-01)

Small sessions could be used as part of a brute-force attack to decode the session secret.

CVE-2021-47208 (2021-03-16)

A bug in format detection can potentially be exploited for a DoS attack.

CVE-2018-25100 (2018-02-13)

Mojo::UserAgent::CookieJar leaks old cookies because of the missing host_only flag on empty domain.

CPANSA-Mojolicious-2018-03 (2018-05-19)

Mojo::UserAgent was not checking peer SSL certificates by default.

CVE-2020-36829 (2020-11-10)

Mojo::Util secure_compare can leak the string length. By immediately returning when the two strings are not the same length, the function allows an attacker to guess the length of the secret string using timing attacks.

CPANSA-Mojolicious-2018-02 (2018-05-11)

GET requests with embedded backslashes can be used to access local files on Windows hosts

CVE-2024-58134 (2025-05-03)

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. These predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user's session.

NAME

Mojo::JSON - Minimalistic JSON

SYNOPSIS

use Mojo::JSON qw(decode_json encode_json);

my $bytes = encode_json {foo => [1, 2], bar => 'hello!', baz => \1};
my $hash  = decode_json $bytes;

DESCRIPTION

Mojo::JSON is a minimalistic and possibly the fastest pure-Perl implementation of RFC 7159.

It supports normal Perl data types like scalar, array reference, hash reference and will try to call the TO_JSON method on blessed references, or stringify them if it doesn't exist. Differentiating between strings and numbers in Perl is hard, depending on how it has been used, a scalar can be both at the same time. The string value has a higher precedence unless both representations are equivalent.

[1, -2, 3]     -> [1, -2, 3]
{"foo": "bar"} -> {foo => 'bar'}

Literal names will be translated to and from Mojo::JSON constants or a similar native Perl value.

true  -> Mojo::JSON->true
false -> Mojo::JSON->false
null  -> undef

In addition scalar references will be used to generate booleans, based on if their values are true or false.

\1 -> true
\0 -> false

The two Unicode whitespace characters u2028 and u2029 will always be escaped to make JSONP easier, and the character / to prevent XSS attacks.

"\x{2028}\x{2029}</script>" -> "\u2028\u2029<\/script>"

FUNCTIONS

Mojo::JSON implements the following functions, which can be imported individually.

decode_json

my $value = decode_json $bytes;

Decode JSON to Perl value and die if decoding fails.

encode_json

my $bytes = encode_json {i => '♥ mojolicious'};

Encode Perl value to JSON.

false

my $false = false;

False value, used because Perl has no native equivalent.

from_json

my $value = from_json $chars;

Decode JSON text that is not UTF-8 encoded to Perl value and die if decoding fails.

j

my $bytes = j [1, 2, 3];
my $bytes = j {i => '♥ mojolicious'};
my $value = j $bytes;

Encode Perl data structure (which may only be an array reference or hash reference) or decode JSON, an undef return value indicates a bare null or that decoding failed.

to_json

my $chars = to_json {i => '♥ mojolicious'};

Encode Perl value to JSON text without UTF-8 encoding it.

true

my $true = true;

True value, used because Perl has no native equivalent.

SEE ALSO

Mojolicious, Mojolicious::Guides, http://mojolicious.org.