Security Advisories (1)
CVE-2026-5090 (2026-05-19)

Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in <a id='ref' title='[% var | html %]'> would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example, var = " ' onclick='while (true) { alert(1) }'" Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.

NAME

Template::Directive - Object class for defining directives that represent the opcodes of the Template processor.

SYNOPSIS

use Template::Directive;

my $dir = Template::Directive->new(\@opcodes);
my $inc = Template::Directive::Include->new(\@ident, \@params);
my $if  = Template::Directive::If->new(\@expr, $true_block, $else_block);
my $for = Template::Directive::For->new(\@list, $block, $varname);
my $blk = Template::Directive::Block->new($content);
my $txt = Template::Directive::Text->new($text);
my $thr = Template::Directive::Throw->new($errtype, \@expr);
my $cth = Template::Directive::Catch->new($errtype, $block);
my $ret = Template::Directive::Return->new($retval);
my $dbg = Template::Directive::Debug->new($text);

DESCRIPTION

The Template::Directive module defines a class which represents the basic operations of the Template Processor. These are created and returned (in tree form) by the Template::Parser object as a product of parsing a template file. The process() method is called on the directives at the time at which the "compiled" template is rendered for output.

The derived classes of Template::Directive, as listed above, define specific operations of the template processor. You don't really need to worry about them unless you plan to hack on the internals of the processor.

AUTHOR

Andy Wardley <abw@cre.canon.co.uk>

REVISION

$Revision: 1.30 $

COPYRIGHT

Copyright (C) 1996-1999 Andy Wardley. All Rights Reserved. Copyright (C) 1998-1999 Canon Research Centre Europe Ltd.

This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

SEE ALSO

Template, Template::Stash, Template::Parser, Template::Grammar