und3f

package NoticeBackend::Author;
use Mojo::Base 'Mojolicious::Controller';

use 5.12.0;
use warnings;
use utf8;

use MojoX::Redis;
use Mojo::IOLoop;

und3f

#!/usr/bin/env perl

use strict;
use warnings;
use MojoX::Redis 0.8;

my $redis1 = MojoX::Redis->new();

$redis1->sadd("set1" => "foo")->set("foo" => "foo desc")
  ->sadd("set1" => "bar")->set("bar" => "bar desc")

und3f

=head1 NAME

Protocol::Redis::Test - reusable tests for Protocol::Redis implementations.

=head1 SYNOPSIS

    use Test::More plan => 5;
    use Protocol::Redis::Test;

    use_ok 'Protocol::Redis';

und3f

#!/usr/bin/env perl

use strict;
use warnings;
use MojoX::Redis;

my $redis1 = MojoX::Redis->new();

$redis1->sadd("set1" => "foo")->set("foo" => "foo desc")
  ->sadd("set1" => "bar")->set("bar" => "bar desc")->quit(sub { shift->stop })

und3f

Issue description

Mojo::IOLoop listens to the random "workaround" port additionally to the "normal" one. Attempt to connect to "workaround" port causes high CPU load and denial of service in some cases (all mojolicious applications that use IOLoop (hypnotoad, mojo daemon, mojo fastcgi, etc…)).

mojolicious/mojo#116

Vulnerable versions

Up to v1.17

und3f

#!/usr/bin/env perl

use strict;
use warnings;
use v5.10;

use LWP::UserAgent;
use JSON;
use Encode;

und3f

#!/usr/bin/env perl

use strict;
use warnings;

use Data::Dumper;
use MojoX::Redis;

my $redis = MojoX::Redis->new(server => '127.0.0.1:6379');
$redis = $redis->ioloop(Mojo::IOLoop->new);

und3f

#!/usr/bin/env perl
use Mojolicious::Lite;
use MojoX::Redis;
use Data::Dumper;

get '/' => sub {
    my $self = shift;

    my $redis = MojoX::Redis->new(server => '127.0.0.1:6379');
    $redis = $redis->ioloop(Mojo::IOLoop->new);

und3f

#!/usr/bin/env perl

use v5.10;
use strict;
use warnings;

use LWP::UserAgent;
use JSON;

my $METACPAN = 'http://api.metacpan.org/v0';

und3f

SELECT 
    sender.jid || COALESCE('/' || sender_resource, '') AS sender,
    recipient.jid || COALESCE('/' || recipient_resource, '') AS recipient,
    message.id, message.type, message.body, message.thread
FROM messages message
JOIN identificators sender
    ON sender.id = message.sender
JOIN identificators recipient
    ON recipient.id = message.recipient