Security Advisories (1)
CVE-2026-5090 (2026-05-19)

Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in <a id='ref' title='[% var | html %]'> would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example, var = " ' onclick='while (true) { alert(1) }'" Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.

NAME

Template::Plugin::Wrap - Plugin interface to Text::Wrap

SYNOPSIS

[% USE wrap %]

# call wrap subroutine
[% wrap(mytext, width, initial_tab,  subsequent_tab) %]

# or use wrap FILTER
[% mytext FILTER wrap(width, initital_tab, subsequent_tab) %]

DESCRIPTION

This plugin provides an interface to the Text::Wrap module which provides simple paragraph formatting.

It defines a wrap subroutine which can be called, passing the input text and further optional parameters to specify the page width (default: 72), and tab characters for the first and subsequent lines (no defaults).

[% USE wrap %]

[% text = BLOCK %]
First, attach the transmutex multiplier to the cross-wired
quantum homogeniser.
[% END %]

[% wrap(text, 40, '* ', '  ') %]

Output:

* First, attach the transmutex
  multiplier to the cross-wired quantum
  homogeniser.

It also registers a wrap filter which accepts the same three optional arguments but takes the input text directly via the filter input.

Example 1:

[% FILTER bullet = wrap(40, '* ', '  ') -%]
First, attach the transmutex multiplier to the cross-wired quantum
homogeniser.
[%- END %]

Output:

* First, attach the transmutex
  multiplier to the cross-wired quantum
  homogeniser.

Example 2:

[% FILTER bullet -%]
Then remodulate the shield to match the harmonic frequency, taking
care to correct the phase difference.
[% END %]

Output:

* Then remodulate the shield to match
  the harmonic frequency, taking
  care to correct the phase difference.

AUTHOR

Andy Wardley <abw@wardley.org> http://wardley.org/

The Text::Wrap module was written by David Muir Sharnoff with help from Tim Pierce and many others.

COPYRIGHT

Copyright (C) 1996-2022 Andy Wardley. All Rights Reserved.

This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

SEE ALSO

Template::Plugin, Text::Wrap