/ 
Mojolicious-9.42
River stage four • 1019 direct dependents • 1130 total dependents
⭐ Starred 2674 GitHub stars
/ Mojo::URL
Security Advisories (2)
CVE-2024-58134 (2025-05-03)

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. These predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user's session.

CVE-2024-58135 (2025-05-03)

Mojolicious versions from 7.28 for Perl may generate weak HMAC session secrets. When creating a default app with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys.

NAME

Mojo::URL - Uniform Resource Locator

SYNOPSIS

use Mojo::URL;

# Parse
my $url = Mojo::URL->new('http://sri:foo@example.com:3000/foo?foo=bar#23');
say $url->scheme;
say $url->userinfo;
say $url->host;
say $url->port;
say $url->path;
say $url->query;
say $url->fragment;

# Build
my $url = Mojo::URL->new;
$url->scheme('http');
$url->host('example.com');
$url->port(3000);
$url->path('/foo/bar');
$url->query(foo => 'bar');
$url->fragment(23);
say "$url";

DESCRIPTION

Mojo::URL implements a subset of RFC 3986, RFC 3987 and the URL Living Standard for Uniform Resource Locators with support for IDNA and IRIs.

ATTRIBUTES

Mojo::URL implements the following attributes.

base

my $base = $url->base;
$url     = $url->base(Mojo::URL->new);

Base of this URL, defaults to a Mojo::URL object.

"http://example.com/a/b?c"
Mojo::URL->new("/a/b?c")->base(Mojo::URL->new("http://example.com"))->to_abs;

fragment

my $fragment = $url->fragment;
$url         = $url->fragment('♥mojolicious♥');

Fragment part of this URL.

# "yada"
Mojo::URL->new('http://example.com/foo?bar=baz#yada')->fragment;

host

my $host = $url->host;
$url     = $url->host('127.0.0.1');

Host part of this URL.

# "example.com"
Mojo::URL->new('http://sri:t3st@example.com:8080/foo')->host;

port

my $port = $url->port;
$url     = $url->port(8080);

Port part of this URL.

# "8080"
Mojo::URL->new('http://sri:t3st@example.com:8080/foo')->port;

scheme

my $scheme = $url->scheme;
$url       = $url->scheme('http');

Scheme part of this URL.

# "http"
Mojo::URL->new('http://example.com/foo')->scheme;

userinfo

my $info = $url->userinfo;
$url     = $url->userinfo('root:♥');

Userinfo part of this URL.

# "sri:t3st"
Mojo::URL->new('https://sri:t3st@example.com/foo')->userinfo;

METHODS

Mojo::URL inherits all methods from Mojo::Base and implements the following new ones.

clone

my $url2 = $url->clone;

Return a new Mojo::URL object cloned from this URL.

host_port

my $host_port = $url->host_port;
$url          = $url->host_port('example.com:8080');

Normalized version of "host" and "port".

# "xn--n3h.net:8080"
Mojo::URL->new('http://☃.net:8080/test')->host_port;

# "example.com"
Mojo::URL->new('http://example.com/test')->host_port;

ihost

my $ihost = $url->ihost;
$url      = $url->ihost('xn--bcher-kva.ch');

Host part of this URL in punycode format.

# "xn--n3h.net"
Mojo::URL->new('http://☃.net')->ihost;

# "example.com"
Mojo::URL->new('http://example.com')->ihost;

is_abs

my $bool = $url->is_abs;

Check if URL is absolute.

# True
Mojo::URL->new('http://example.com')->is_abs;
Mojo::URL->new('http://example.com/test/index.html')->is_abs;

# False
Mojo::URL->new('test/index.html')->is_abs;
Mojo::URL->new('/test/index.html')->is_abs;
Mojo::URL->new('//example.com/test/index.html')->is_abs;

new

my $url = Mojo::URL->new;
my $url = Mojo::URL->new('http://127.0.0.1:3000/foo?f=b&baz=2#foo');

Construct a new Mojo::URL object and "parse" URL if necessary.

parse

$url = $url->parse('http://127.0.0.1:3000/foo/bar?fo=o&baz=23#foo');

Parse relative or absolute URL.

# "/test/123"
$url->parse('/test/123?foo=bar')->path;

# "example.com"
$url->parse('http://example.com/test/123?foo=bar')->host;

# "sri@example.com"
$url->parse('mailto:sri@example.com')->path;

password

my $password = $url->password;

Password part of "userinfo".

# "s3cret"
Mojo::URL->new('http://isabel:s3cret@mojolicious.org')->password;

# "s:3:c:r:e:t"
Mojo::URL->new('http://isabel:s:3:c:r:e:t@mojolicious.org')->password;

path

my $path = $url->path;
$url     = $url->path('foo/bar');
$url     = $url->path('/foo/bar');
$url     = $url->path(Mojo::Path->new);

Path part of this URL, relative paths will be merged with "merge" in Mojo::Path, defaults to a Mojo::Path object.

# "test"
Mojo::URL->new('http://example.com/test/Mojo')->path->parts->[0];

# "/test/DOM/HTML"
Mojo::URL->new('http://example.com/test/Mojo')->path->merge('DOM/HTML');

# "http://example.com/DOM/HTML"
Mojo::URL->new('http://example.com/test/Mojo')->path('/DOM/HTML');

# "http://example.com/test/DOM/HTML"
Mojo::URL->new('http://example.com/test/Mojo')->path('DOM/HTML');

# "http://example.com/test/Mojo/DOM/HTML"
Mojo::URL->new('http://example.com/test/Mojo/')->path('DOM/HTML');

path_query

my $path_query = $url->path_query;
$url           = $url->path_query('/foo/bar?a=1&b=2');

Normalized version of "path" and "query".

# "/test?a=1&b=2"
Mojo::URL->new('http://example.com/test?a=1&b=2')->path_query;

# "/"
Mojo::URL->new('http://example.com/')->path_query;

protocol

my $proto = $url->protocol;

Normalized version of "scheme".

# "http"
Mojo::URL->new('HtTp://example.com')->protocol;

query

my $query = $url->query;
$url      = $url->query({merge => 'to'});
$url      = $url->query([append => 'with']);
$url      = $url->query(replace => 'with');
$url      = $url->query('a=1&b=2');
$url      = $url->query(Mojo::Parameters->new);

Query part of this URL, key/value pairs in an array reference will be appended with "append" in Mojo::Parameters, and key/value pairs in a hash reference merged with "merge" in Mojo::Parameters, defaults to a Mojo::Parameters object.

# "2"
Mojo::URL->new('http://example.com?a=1&b=2')->query->param('b');

# "a=2&b=2&c=3"
Mojo::URL->new('http://example.com?a=1&b=2')->query->merge(a => 2, c => 3);

# "http://example.com?a=2&c=3"
Mojo::URL->new('http://example.com?a=1&b=2')->query(a => 2, c => 3);

# "http://example.com?a=2&a=3"
Mojo::URL->new('http://example.com?a=1&b=2')->query(a => [2, 3]);

# "http://example.com?a=2&b=2&c=3"
Mojo::URL->new('http://example.com?a=1&b=2')->query({a => 2, c => 3});

# "http://example.com?b=2"
Mojo::URL->new('http://example.com?a=1&b=2')->query({a => undef});

# "http://example.com?a=1&b=2&a=2&c=3"
Mojo::URL->new('http://example.com?a=1&b=2')->query([a => 2, c => 3]);

to_abs

my $abs = $url->to_abs;
my $abs = $url->to_abs(Mojo::URL->new('http://example.com/foo'));

Return a new Mojo::URL object cloned from this relative URL and turn it into an absolute one using "base" or provided base URL.

# "http://example.com/foo/baz.xml?test=123"
Mojo::URL->new('baz.xml?test=123')
  ->to_abs(Mojo::URL->new('http://example.com/foo/bar.html'));

# "http://example.com/baz.xml?test=123"
Mojo::URL->new('/baz.xml?test=123')
  ->to_abs(Mojo::URL->new('http://example.com/foo/bar.html'));

# "http://example.com/foo/baz.xml?test=123"
Mojo::URL->new('//example.com/foo/baz.xml?test=123')
  ->to_abs(Mojo::URL->new('http://example.com/foo/bar.html'));

to_string

my $str = $url->to_string;

Turn URL into a string. Note that "userinfo" will not be included for security reasons.

# "http://mojolicious.org"
Mojo::URL->new->scheme('http')->host('mojolicious.org')->to_string;

# "http://mojolicious.org"
Mojo::URL->new('http://daniel:s3cret@mojolicious.org')->to_string;

to_unsafe_string

my $str = $url->to_unsafe_string;

Same as "to_string", but includes "userinfo".

# "http://daniel:s3cret@mojolicious.org"
Mojo::URL->new('http://daniel:s3cret@mojolicious.org')->to_unsafe_string;

username

my $username = $url->username;

Username part of "userinfo".

# "isabel"
Mojo::URL->new('http://isabel:s3cret@mojolicious.org')->username;

OPERATORS

Mojo::URL overloads the following operators.

bool

my $bool = !!$url;

Always true.

stringify

my $str = "$url";

Alias for "to_string".

SEE ALSO

Mojolicious, Mojolicious::Guides, https://mojolicious.org.