Security Advisories (2)
CVE-2024-58134 (2025-05-03)

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. These predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user's session.

CVE-2024-58135 (2025-05-03)

Mojolicious versions from 7.28 for Perl may generate weak HMAC session secrets. When creating a default app with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys.

NAME

Mojolicious::Validator - Validate values

SYNOPSIS

use Mojolicious::Validator;

my $validator = Mojolicious::Validator->new;
my $v = $validator->validation;
$v->input({foo => 'bar'});
$v->required('foo')->like(qr/ar$/);
say $v->param('foo');

DESCRIPTION

Mojolicious::Validator validates values for Mojolicious.

CHECKS

These validation checks are available by default.

equal_to

$v = $v->equal_to('foo');

String value needs to be equal to the value of another field.

in

$v = $v->in('foo', 'bar', 'baz');

String value needs to match one of the values in the list.

like

$v = $v->like(qr/^[A-Z]/);

String value needs to match the regular expression.

num

$v = $v->num;
$v = $v->num(2, 5);
$v = $v->num(-3, 7);
$v = $v->num(2, undef);
$v = $v->num(undef, 5);

String value needs to be a non-fractional number (positive or negative) and if provided in the given range.

size

$v = $v->size(2, 5);
$v = $v->size(2, undef);
$v = $v->size(undef, 5);

String value length or size of Mojo::Upload object in bytes needs to be between these two values.

upload

$v = $v->upload;

Value needs to be a Mojo::Upload object, representing a file upload.

FILTERS

These filters are available by default.

comma_separated

$v = $v->optional('foo', 'comma_separated');

Split string of comma separated values into separate values.

not_empty

$v = $v->optional('foo', 'not_empty');

Remove empty string values and treat them as if they had not been submitted.

trim

$v = $v->optional('foo', 'trim');

Trim whitespace characters from both ends of string value with "trim" in Mojo::Util.

ATTRIBUTES

Mojolicious::Validator implements the following attributes.

checks

my $checks = $validator->checks;
$validator = $validator->checks({size => sub ($v, $name, $value, @args) {...}});

Registered validation checks, by default only "equal_to", "in", "like", "num", "size" and "upload" are already defined.

filters

my $filters = $validator->filters;
$validator  = $validator->filters({trim => sub {...}});

Registered filters, by default only "comma_separated", "not_empty" and "trim" are already defined.

METHODS

Mojolicious::Validator inherits all methods from Mojo::Base and implements the following new ones.

add_check

$validator = $validator->add_check(size => sub ($v, $name, $value, @args) {...});

Register a validation check.

$validator->add_check(foo => sub ($v, $name, $value, @args) {
  ...
  return undef;
});

add_filter

$validator = $validator->add_filter(trim => sub ($v, $name, $value) {...});

Register a new filter.

$validator->add_filter(foo => sub ($v, $name, $value) {
  ...
  return $value;
});

new

my $validator = Mojolicious::Validator->new;

Construct a new Mojolicious::Validator object.

validation

my $v = $validator->validation;

Build Mojolicious::Validator::Validation object to perform validations.

my $v = $validator->validation;
$v->input({foo => 'bar'});
$v->required('foo')->size(1, 5);
say $v->param('foo');

SEE ALSO

Mojolicious, Mojolicious::Guides, https://mojolicious.org.