/ 
HTML-FormFu-2.07
/ HTML::FormFu::Element::Date
Security Advisories (1)
CVE-2026-19873 (2026-08-31)

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has counter_name set, its process method reads the repeat count from the named query string parameter, checks only that it is a positive integer, and passes it to repeat, which deep-clones the element's child subtree once per iteration. Nothing caps the value, and no attribute lets an application impose a limit. The count is read on every request, before the form decides whether it was submitted, so a plain GET reaches the clone loop with no credentials, no session and no request body. Nesting multiplies: a Repeatable inside a Repeatable takes a counter at each level, so an outer and an inner value of 100 build 10,000 clones. Once the form is submitted, each cloned field's constraints scan the whole element tree in _find_field_value, so cost grows faster than linearly with the count. A single request exhausts memory and CPU. The latest release on CPAN is 2.07, from 2018. Version 2.08 exists only in the git repository.

NAME

HTML::FormFu::Element::Date - 3 select menu multi-field

VERSION

version 2.07

SYNOPSIS

---
elements:
  - type: Date
    name: birthdate
    label: 'Birthdate:'
    day:
      prefix: "- Day -"
    month:
      prefix: "- Month -"
    year:
      prefix: "- Year -"
      less: 70
      plus: 0
    auto_inflate: 1

DESCRIPTION

Creates a multi element containing 3 select menus for the day, month and year.

A date element named foo would result in 3 select menus with the names foo_day, foo_month and foo_year. The names can instead be overridden by the name value in "day", "month" and "year".

This element automatically merges the input parameters from the select menu into a single date parameter (and doesn't delete the individual menu's parameters).

METHODS

default

Arguments: DateTime object

Arguments: $date_string

Accepts either a DateTime object, or a string containing a date, matching the "strftime" format. Overwrites any default value set in "day", "month" or "year".

default_natural

Arguments: $date_string

- type: Date
  default_natural: 'today'

Accepts a date/time string suitable for passing to "parse_datetime" in DateTime::Format::Natural.

default_datetime_args

- type: Date
  default_natural: 'today'
  default_datetime_args:
    set_time_zone: 'Europe/London'

Accepts a hashref of method-names / values that will be called on the "default" DateTime object, before the select fields' values are set from it.

strftime

Default Value: "%d-%m-%Y"

The format of the date as returned by "params" in HTML::FormFu, if "auto_inflate" is not set.

If "auto_inflate" is used, this is still the format that the parameter will be in prior to the DateTime inflator being run; which is what any Filters and Constraints will receive.

day

Arguments: \%setting

Set values effecting the day select menu. Known keys are:

name

Override the auto-generated name of the select menu.

default

Set the default value of the select menu

prefix

Arguments: $value

Arguments: \@values

A string or arrayref of strings to be inserted into the start of the select menu.

Each value is only used as the label for a select item - the value for each of these items is always the empty string ''.

prefix_loc

Arguments: $localization_key

Arguments: \@localization_keys

A localized string or arrayref of localized strings to be inserted into the start of the select menu.

Each value is localized and then only used as the label for a select item - the value for each of these items is always the empty string ''.

Use prefix_loc insted of prefix.

month

Arguments: \%setting

Set values effecting the month select menu. Known keys are:

name

Override the auto-generated name of the select menu.

default

Set the default value of the select menu

prefix

Arguments: $value

Arguments: \@values

A string or arrayref of strings to be inserted into the start of the select menu.

Each value is only used as the label for a select item - the value for each of these items is always the empty string ''.

prefix_loc

Arguments: $localization_key

Arguments: \@localization_keys

A localized string or arrayref of localized strings to be inserted into the start of the select menu.

Each value is localized and then only used as the label for a select item - the value for each of these items is always the empty string ''.

Use prefix_loc insted of prefix.

names

Arguments: \@months

A list of month names used for the month menu.

If not set, the list of month names is obtained from DateTime::Locale using the locale set in "languages" in HTML::FormFu.

short_names

Argument: bool

If true (and months is not set) the list of abbreviated month names is obtained from DateTime::Locale using the locale set in "languages" in HTML::FormFu.

year

Arguments: \%setting

Set values effecting the year select menu. Known keys are:

name

Override the auto-generated name of the select menu.

default

Set the default value of the select menu

prefix

Arguments: $value

Arguments: \@values

A string or arrayref of strings to be inserted into the start of the select menu.

Each value is only used as the label for a select item - the value for each of these items is always the empty string ''.

prefix_loc

Arguments: $localization_key

Arguments: \@localization_keys

A localized string or arrayref of localized strings to be inserted into the start of the select menu.

Each value is localized and then only used as the label for a select item - the value for each of these items is always the empty string ''.

Use prefix_loc insted of prefix.

list

Arguments: \@years

A list of years used for the year menu.

If this is set, reference, less and plus are ignored.

reference

Arguments: $year

Default Value: the current year, calculated from time()

If list is not set, the list is created from the range of reference - year_less to reference + year_plus.

less

Arguments: $count

Default Value: 0

plus

Arguments: $count

Default Value: 10

reverse

Arguments: bool

Default Value: 0

If true, the list of years is listed in reverse (decreasing) order.

field_order

Arguments: \@fields

Default Value: ['day', 'month', 'year']

Specify the order of the date fields in the rendered HTML.

Not all 3 fields are required. No single field can be used more than once.

auto_inflate

If true, a DateTime Inflator will automatically be added to the element, and it will be given a formatter so that stringification will result in the format specified in "strftime".

If you require the DateTime Inflator to have a different stringification format to the format used internally by your Filters and Constraints, then you must explicitly add your own DateTime Inflator, rather than using "auto_inflate".

CAVEATS

Although this element inherits from HTML::FormFu::Element::Block, its behaviour for the methods filter/filters, constraint/constraints, inflator/inflators, validator/validators and transformer/transformers is more like that of a field element, meaning all processors are added directly to the date element, not to its select-menu child elements.

This element's get_elements and get_all_elements are inherited from HTML::FormFu::Element::Block, and so have the same behaviour. However, it overrides the get_fields|HTML::FormFu/get_fields method, such that it returns both itself and its child elements.

SEE ALSO

Is a sub-class of, and inherits methods from HTML::FormFu::Role::Element::Field, HTML::FormFu::Element::Multi, HTML::FormFu::Element::Block, HTML::FormFu::Element

HTML::FormFu

AUTHOR

Carl Franks, cfranks@cpan.org

LICENSE

This library is free software, you can redistribute it and/or modify it under the same terms as Perl itself.

AUTHOR

Carl Franks <cpan@fireartist.com>

COPYRIGHT AND LICENSE

This software is copyright (c) 2018 by Carl Franks.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.