Security Advisories (2)
CVE-2024-58134 (2025-05-03)

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. These predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user's session.

CVE-2024-58135 (2025-05-03)

Mojolicious versions from 7.28 for Perl may generate weak HMAC session secrets. When creating a default app with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys.

NAME

Mojo::JSON - Minimalistic JSON

SYNOPSIS

use Mojo::JSON qw(decode_json encode_json);

my $bytes = encode_json {foo => [1, 2], bar => 'hello!', baz => \1};
my $hash  = decode_json $bytes;

DESCRIPTION

Mojo::JSON is a minimalistic and possibly the fastest pure-Perl implementation of RFC 8259.

It supports normal Perl data types like scalar, array reference, hash reference and will try to call the TO_JSON method on blessed references, or stringify them if it doesn't exist. Differentiating between strings and numbers in Perl is hard, depending on how it has been used, a scalar can be both at the same time. The string value has a higher precedence unless both representations are equivalent.

[1, -2, 3]     -> [1, -2, 3]
{"foo": "bar"} -> {foo => 'bar'}

Literal names will be translated to and from Mojo::JSON constants or a similar native Perl value.

true  -> Mojo::JSON->true
false -> Mojo::JSON->false
null  -> undef

In addition scalar references will be used to generate booleans, based on if their values are true or false.

\1 -> true
\0 -> false

The character / will always be escaped to prevent XSS attacks.

"</script>" -> "<\/script>"

For better performance the optional module Cpanel::JSON::XS (4.20+) will be used automatically if possible. This can also be disabled with the MOJO_NO_JSON_XS environment variable.

FUNCTIONS

Mojo::JSON implements the following functions, which can be imported individually.

decode_json

my $value = decode_json $bytes;

Decode JSON to Perl value and die if decoding fails.

encode_json

my $bytes = encode_json {i => '♥ mojolicious'};

Encode Perl value to JSON.

false

my $false = false;

False value, used because Perl has no native equivalent.

from_json

my $value = from_json $chars;

Decode JSON text that is not UTF-8 encoded to Perl value and die if decoding fails.

j

my $bytes = j [1, 2, 3];
my $bytes = j {i => '♥ mojolicious'};
my $value = j $bytes;

Encode Perl data structure (which may only be an array reference or hash reference) or decode JSON, an undef return value indicates a bare null or that decoding failed.

to_json

my $chars = to_json {i => '♥ mojolicious'};

Encode Perl value to JSON text without UTF-8 encoding it.

true

my $true = true;

True value, used because Perl has no native equivalent.

SEE ALSO

Mojolicious, Mojolicious::Guides, https://mojolicious.org.