/ 
HTML-FormFu-2.07
/ HTML::FormFu::Role::Element::Input
Security Advisories (1)
CVE-2026-19873 (2026-08-31)

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has counter_name set, its process method reads the repeat count from the named query string parameter, checks only that it is a positive integer, and passes it to repeat, which deep-clones the element's child subtree once per iteration. Nothing caps the value, and no attribute lets an application impose a limit. The count is read on every request, before the form decides whether it was submitted, so a plain GET reaches the clone loop with no credentials, no session and no request body. Nesting multiplies: a Repeatable inside a Repeatable takes a counter at each level, so an outer and an inner value of 100 build 10,000 clones. Once the form is submitted, each cloned field's constraints scan the whole element tree in _find_field_value, so cost grows faster than linearly with the count. A single request exhausts memory and CPU. The latest release on CPAN is 2.07, from 2018. Version 2.08 exists only in the git repository.

NAME

HTML::FormFu::Role::Element::Input - Role for input fields

VERSION

version 2.07

DESCRIPTION

Base-class for HTML::FormFu::Element::Button, HTML::FormFu::Element::Checkbox, HTML::FormFu::Element::File, HTML::FormFu::Element::Hidden, HTML::FormFu::Element::Password, HTML::FormFu::Element::Radio, HTML::FormFu::Element::Text.

METHODS

datalist_options

Arguments: none

Arguments: \@options

Use either "datalist_options" or "datalist_values" to generate a HTML5-compatible datalist group of option tags. This will be associated with the input element via a list attribute on the input tag.

The datalist ID attribute must be set using either "datalist_id" or "auto_datalist_id".

---
elements:
  - type: Text
    name: foo
    options:
      - [ 01, January ]
      - [ 02, February ]
      - [ 03, March ]
      - [ 04, April ]

The syntax is similar to "options" in HTML::FormFu::Role::Element::Group, except hash-ref items only accept value and label keys (and their variants).

If passed no arguments, it returns an arrayref of the currently set datalist options.

Its arguments must be an array-ref of items. Each item may be an array ref of the form [ $value, $label ] or a hash-ref of the form { value => $value, label => $label }.

When using the hash-ref construct, the label_xml and label_loc variants of label are supported, as are the value_xml and value_loc variants of value.

datalist_values

Arguments: \@values

---
elements:
  - type: Radiogroup
    name: foo
    values:
      - jan
      - feb
      - mar
      - apr

A more concise alternative to "datalist_options".

Its arguments must be an array-ref of values. The labels used are the result of ucfirst($value).

datalist_id

Arguments: [$string]

Sets the datalist ID attribute, and automatically sets this input element's list ID to the same.

Either "datalist_id" or "auto_datalist_id" is required, if either "datalist_options" or "datalist_values" are set.

auto_datalist_id

See "auto_datalist_id" in HTML::FormFu for details.

ATTRIBUTE ACCESSORS

Get / set input attributes directly with these methods.

Arguments: [$string]

Return Value: $string

alt

autocomplete

checked

maxlength

pattern

placeholder

size

BOOLEAN ATTRIBUTE ACCESSORS

Arguments: [$bool]

Return Value: $self Return Value: $string Return Value: undef

Get / set boolean XHTML attributes such as required="required".

If given any true argument, the attribute value will be set equal to the attribute key name. E.g. $element->required(1) will set the attribute required="required".

If given a false argument, the attribute key will be deleted.

When used as a setter, the return value is $self to allow chaining.

autofocus

multiple

required

SEE ALSO

Is a sub-class of, and inherits methods from HTML::FormFu::Role::Element::Field, HTML::FormFu::Element

HTML::FormFu

AUTHOR

Carl Franks, cfranks@cpan.org

LICENSE

This library is free software, you can redistribute it and/or modify it under the same terms as Perl itself.

AUTHOR

Carl Franks <cpan@fireartist.com>

COPYRIGHT AND LICENSE

This software is copyright (c) 2018 by Carl Franks.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.