/ 
Form-Processor-1.162360
/ Form::Processor::Field::Select
Security Advisories (1)
CVE-2026-13051 (2026-08-13)

Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_error as a Locale::Maketext template. validate runs HTML::Tidy over the submitted markup and passes each resulting message to add_error as its first argument, which add_error hands to the language handle as the Locale::Maketext message key. The default handle's lexicon sets `_AUTO`, so a message that is not a lexicon entry is compiled as a bracket notation template instead of being looked up. Tidy diagnostics quote the offending attribute name or value, so a bracket group in the submitted markup reaches the template position, where the first token of the group names a method called on the language handle and the remaining tokens are its arguments. A group such as `[0]` makes the compile croak, and neither the field nor the handle catches it, so the exception leaves validate. `[sprintf,%2000000000d,7]` reaches CORE::sprintf with an attacker chosen field width. One submission of crafted markup to an HtmlArea field throws an unhandled exception out of form validation or allocates an arbitrary amount of memory, and an application whose language handle subclass defines side effecting public methods makes those callable with attacker chosen arguments. The other field types pass fixed templates with the submitted value in an argument slot, where it stays inert, and are unaffected.

NAME

Form::Processor::Field::Select - ** Please provide abstract **

VERSION

version 1.162360

SYNOPSIS

See Form::Processor

DESCRIPTION

This is a field that includes a list of possible valid options. This can be used for select and mulitple-select fields.

Widget

Fields can be given a widget type that is used as a hint for the code that renders the field.

This field's widget type is: "select".

Subclass

Fields may inherit from other fields. This field inherits from: "Field"

NAME

Form::Processor::Field::Select

METHODS

options

This is an array of hashes for this field. Each has must have a label and value keys.

multiple

If true allows multiple input values

auto_widget_size

This is a way to provide a hint as to when to automatically select the widget to display for fields with a small number of options. For example, this can be used to decided to display a radio select for select lists smaller than the size specified.

See select_widget below.

select_widget

If the widget is 'select' for the field then will look if the field also has a auto_widget_size. If the options list is less than or equal to the auto_widget_size then will return radio if multiple is false, otherwise will return checkbox.

size

This can be used to store how many items should be offered in the UI at a given time.

Defaults to 0.

label_column

Sets or returns the name of the method to call on the foreign class to fetch the text to use for the select list.

Refers to the method (or column) name to use in a related object class for the label for select lists.

Defaults to "name"

active_column

Sets or returns the name of a boolean column that is used as a flag to indicate that a row is active or not. Rows that are not active are ignored.

The default is "active".

If this column exists on the class then the list of options will included only rows that are marked "active".

The exception is any columns that are marked inactive, but are also part of the input data will be included with brackets around the label. This allows updating records that might have data that is now considered inactive.

sort_order

Sets or returns the column used in the foreign class for sorting the options labels. Default is undefined.

If this column exists in the foreign table then labels returned will be sorted by this column.

If not defined or the column is not found as a method on the foreign class then the label_column is used as the sort condition.

as_label

Returns the option label for the option value that matches the field's current value. Can be helpful for displaying information about the field in a more friendly format.

This does a string compare, although probably al

SUPPORT / WARRANTY

Form::Processor is free software and is provided WITHOUT WARRANTY OF ANY KIND. Users are expected to review software for fitness and usability.

AUTHOR

Bill Moseley <mods@hank.org>

COPYRIGHT AND LICENSE

This software is copyright (c) 2012 by Bill Moseley.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.