/ 
HTML-FormFu-2.07
/ HTML::FormFu::Role::Element::Group
Security Advisories (1)
CVE-2026-19873 (2026-08-31)

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has counter_name set, its process method reads the repeat count from the named query string parameter, checks only that it is a positive integer, and passes it to repeat, which deep-clones the element's child subtree once per iteration. Nothing caps the value, and no attribute lets an application impose a limit. The count is read on every request, before the form decides whether it was submitted, so a plain GET reaches the clone loop with no credentials, no session and no request body. Nesting multiplies: a Repeatable inside a Repeatable takes a counter at each level, so an outer and an inner value of 100 build 10,000 clones. Once the form is submitted, each cloned field's constraints scan the whole element tree in _find_field_value, so cost grows faster than linearly with the count. A single request exhausts memory and CPU. The latest release on CPAN is 2.07, from 2018. Version 2.08 exists only in the git repository.

NAME

HTML::FormFu::Role::Element::Group - Role for grouped form fields

VERSION

version 2.07

DESCRIPTION

Base class for HTML::FormFu::Element::Checkboxgroup, HTML::FormFu::Element::Radiogroup, and HTML::FormFu::Element::Select fields.

METHODS

options

Arguments: none

Arguments: \@options

---
elements:
  - type: Select
    name: foo
    options:
      - [ 01, January ]
      - [ 02, February ]
      - value: 03
        label: March
        attributes:
          style: highlighted
      - [ 04, April ]

If passed no arguments, it returns an arrayref of the currently set options.

Use to set the list of items in the select menu / radiogroup.

Its arguments must be an array-ref of items. Each item may be an array ref of the form [ $value, $label ] or a hash-ref of the form { value => $value, label => $label }. Each hash-ref may also have an attributes key.

Passing an item containing a group key will, for Select fields, create an optgroup. And for Radiogroup fields or Checkboxgroup fields, create a sub-group of radiobuttons or checkboxes with a new span block, with the classname subgroup.

An example of Select optgroups:

---
elements:
  - type: Select
    name: foo
    options:
      - label: "group 1"
        group:
          - [1a, 'item 1a']
          - [1b, 'item 1b']
      - label: "group 2"
        group:
          - [2a, 'item 2a']
          - [2b, 'item 2b']

When using the hash-ref construct, the label_xml and label_loc variants of label are supported, as are the value_xml and value_loc variants of value, the attributes_xml variant of attributes and the label_attributes_xml variant of label_attributes.

container_attributes or container_attributes_xml is used by HTML::FormFu::Element::Checkboxgroup and HTML::FormFu::Element::Radiogroup for the c<span> surrounding each item's input and label. It is ignored by HTML::FormFu::Element::Select elements.

label_attributes / label_attributes_xml is used by HTML::FormFu::Element::Checkboxgroup and HTML::FormFu::Element::Radiogroup for the c<label> tag of each item. It is ignored by HTML::FormFu::Element::Select elements.

values

Arguments: \@values

---
elements:
  - type: Radiogroup
    name: foo
    values:
      - jan
      - feb
      - mar
      - apr

A more concise alternative to "options". Use to set the list of values in the select menu / radiogroup.

Its arguments must be an array-ref of values. The labels used are the result of ucfirst($value).

value_range

Arguments: \@values

---
elements:
  - type: Select
    name: foo
    value_range:
      - ""
      - 1
      - 12

Similar to "values", but the last 2 values are expanded to a range. Any preceding values are used literally, allowing the common empty first item in select menus.

empty_first

If true, then a blank option will be inserted at the start of the option list (regardless of whether "options", "values" or "value_range" was used to populate the options). See also "empty_first_label".

empty_first_label

empty_first_label_xml

empty_first_label_loc

If "empty_first" is true, and "empty_first_label" is set, this value will be used as the label for the first option - so only the first option's value will be empty.

SEE ALSO

Is a sub-class of, and inherits methods from HTML::FormFu::Role::Element::Field, HTML::FormFu::Element

HTML::FormFu

AUTHOR

Carl Franks, cfranks@cpan.org

LICENSE

This library is free software, you can redistribute it and/or modify it under the same terms as Perl itself.

AUTHOR

Carl Franks <cpan@fireartist.com>

COPYRIGHT AND LICENSE

This software is copyright (c) 2018 by Carl Franks.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.