/ 
HTML-FormFu-2.07
/ HTML::FormFu::Model::HashRef
Security Advisories (1)
CVE-2026-19873 (2026-08-31)

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has counter_name set, its process method reads the repeat count from the named query string parameter, checks only that it is a positive integer, and passes it to repeat, which deep-clones the element's child subtree once per iteration. Nothing caps the value, and no attribute lets an application impose a limit. The count is read on every request, before the form decides whether it was submitted, so a plain GET reaches the clone loop with no credentials, no session and no request body. Nesting multiplies: a Repeatable inside a Repeatable takes a counter at each level, so an outer and an inner value of 100 build 10,000 clones. Once the form is submitted, each cloned field's constraints scan the whole element tree in _find_field_value, so cost grows faster than linearly with the count. A single request exhausts memory and CPU. The latest release on CPAN is 2.07, from 2018. Version 2.08 exists only in the git repository.

NAME

HTML::FormFu::Model::HashRef - handle hashrefs

VERSION

version 2.07

SYNOPSIS

---
  elements:
    - user_id
    - user_name
    - type: Repeatable
      nested_name: addresses
      elements:
        - type: Hidden
          name: id
        - street


$form->model('HashRef')->default_values( {
  user_id => 123,
  user_name => 'Hans',
  addresses => [
    { id => 2,
      street => 'Somewhere' },
    { id => 3,
      street => 'Somewhere Else' }
  ]
  } );

$form->default_model('HashRef');
my $hashref = $form->model->create();

# $hashref is very much the same as the hashref you passed to default_values()

DESCRIPTION

If you need the content of a formular as hashref or for processing with other modules like JSON you can use this model.

METHODS

create

This method creates a hashref from a filled form. This form can be filled by calling "default_values" in HTML::FormFu, default_values of any other model class (e. g. HTML::FormFu::Model::DBIC) or by simply submitting the form.

If "deflators" is true all deflators are processed (defaults to 1).

If "options" is true the value of all elements which have options like HTML::FormFu::Element::Select will be transformed.

---
  elements:
    - type: Select
      name: select
      options:
        - [1, "Foo"]
        - [2, "Bar"]

If the value of select is 1, create will create this hashref:

{ 'select' => { label => 'Foo', value => 1 } }

If there is more than one value selected, an arrayref is created instead:

{ 'select' => [ { label => 'Foo', value => 1 },
                { label => 'Bar', value => 2 } ] }

If "options" is false, the output will look like this:

{ 'select' => 1 }

respectively

{ 'select' => [1, 2] }

"options" is false by default.

To get a flattened hash, you can set /flatten to a true value (defaults to 0). This will generate a hash which uses the nested name of each field as key and the value of this field as hash value. If there is a field which has more than one value, a counter is added. The above example would result in a hash like this using /flatten:

{ 'select_0' => 1,
  'select_1' => 2 }

update

Alias for "create".

default_values

Populate a form using a hashref. This hashref has the same format as the output of "create". If "inflators" is true, all inflators will be processed (defaults to 1).

CONFIGURATION

These methods do not return the model object so chaining is not possible!

options

Adds the label of a value to the hashref if the element has "options" in HTML::FormFu::Role::Element::Group. See "create" for an example. Defaults to 0.

flatten

Flattens the hash using Hash::Flatten. See "create" for an example. Defaults to 0.

deflators

If true, processes deflators in /create. Defaults to 1.

inflators

If true, processes inflators in /default_values. Defaults to 1.

SEE ALSO

HTML::FormFu, Hash::Flatten

AUTHOR

Moritz Onken, onken@houseofdesign.de

AUTHOR

Carl Franks <cpan@fireartist.com>

COPYRIGHT AND LICENSE

This software is copyright (c) 2018 by Carl Franks.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.