/ 
Template-Toolkit-2.11 UNAUTHORIZED RELEASE
/ Template::Plugin::GD::Text::Align
Security Advisories (1)
CVE-2026-5090 (2026-05-19)

Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in <a id='ref' title='[% var | html %]'> would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example, var = " ' onclick='while (true) { alert(1) }'" Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.

NAME

Template::Plugin::GD::Text::Align - Draw aligned strings in GD images

SYNOPSIS

[% USE align = GD.Text.Align(gd_image); %]

EXAMPLES

[% FILTER null;
    USE im  = GD.Image(100,100);
    USE gdc = GD.Constants;
    # allocate some colors
    black = im.colorAllocate(0,   0, 0);
    red   = im.colorAllocate(255,0,  0);
    blue  = im.colorAllocate(0,  0,  255);
    # Draw a blue oval
    im.arc(50,50,95,75,0,360,blue);

    USE a = GD.Text.Align(im);
    a.set_font(gdc.gdLargeFont);
    a.set_text("Hello");
    a.set(colour => red, halign => "center");
    a.draw(50,70,0);

    # Output image in PNG format
    im.png | stdout(1);
   END;
-%]

DESCRIPTION

The GD.Text.Align plugin provides an interface to the GD::Text::Align module. It allows text to be drawn in GD images with various alignments and orientations.

See GD::Text::Align for more details. See Template::Plugin::GD::Text::Wrap for a plugin that allow you to render wrapped text in GD images.

AUTHOR

Craig Barratt <craig@arraycomm.com>

The GD::Text module was written by Martien Verbruggen.

VERSION

1.51, distributed as part of the Template Toolkit version 2.11, released on 06 January 2004.

COPYRIGHT

Copyright (C) 2001 Craig Barratt <craig@arraycomm.com>

GD::Text is copyright 1999 Martien Verbruggen.

This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

SEE ALSO

Template::Plugin, Template::Plugin::GD, Template::Plugin::GD::Text, Template::Plugin::GD::Text::Wrap, GD, GD::Text::Align