public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/perl-HTML-FormFu] rawhide: Update to 2.09
@ 2026-09-27 8:23 Emmanuel Seyman
0 siblings, 0 replies; only message in thread
From: Emmanuel Seyman @ 2026-09-27 8:23 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/perl-HTML-FormFu
Branch : rawhide
Commit : ffc679ac2209a685a3fcd444111319eb403e4a4e
Author : Emmanuel Seyman <emmanuel@seyman.fr>
Date : 2026-09-27T10:23:46+02:00
Stats : +11/-294 in 4 file(s)
URL : https://src.fedoraproject.org/rpms/perl-HTML-FormFu/c/ffc679ac2209a685a3fcd444111319eb403e4a4e?branch=rawhide
Log:
Update to 2.09
---
diff --git a/.gitignore b/.gitignore
index 1921b61..f207335 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,4 @@ HTML-FormFu-0.07002.tar.gz
/HTML-FormFu-2.05.tar.gz
/HTML-FormFu-2.06.tar.gz
/HTML-FormFu-2.07.tar.gz
+/HTML-FormFu-2.09.tar.gz
diff --git a/HTML-FormFu-CVE-2026-19873.patch b/HTML-FormFu-CVE-2026-19873.patch
deleted file mode 100644
index b1f70e3..0000000
--- a/HTML-FormFu-CVE-2026-19873.patch
+++ /dev/null
@@ -1,286 +0,0 @@
-commit 0480f51ab3d4283e64c645bd15bea1348f1ffc76
-Author: Dean Hamstead <dean@fragfest.com.au>
-Date: Wed Aug 26 21:55:57 2026 +1000
-
- Bound Repeatable counter_name to prevent CPU/memory DoS (CVE-2026-19873)
-
- Add max_counter attribute to Repeatable elements that caps the
- client-supplied repeat count from the query string. Default is 100,
- inherited from a new form-level repeatable_max_counter attribute.
-
- Additional hardening beyond the base patch:
- - counter_clamped read-only flag signals when clamping occurred
- - max_counter=0 means unlimited (safer than undef escape hatch)
- - Form-level repeatable_max_counter sets the default for all
- Repeatable elements in the form
-
-diff --git a/lib/HTML/FormFu.pm b/lib/HTML/FormFu.pm
-index b94d5047..733c0069 100644
---- a/lib/HTML/FormFu.pm
-+++ b/lib/HTML/FormFu.pm
-@@ -111,6 +111,13 @@ has form_error_message_class => (
- lazy => 1,
- );
-
-+has repeatable_max_counter => (
-+ is => 'rw',
-+ default => 100,
-+ lazy => 1,
-+ traits => ['Chained'],
-+);
-+
- our @MULTIFORM_SHARED = ( qw(
- javascript
- javascript_src
-@@ -1485,6 +1492,19 @@ used as the return value for L</submitted>.
- If L</indicator> is not set, L</submitted> will return true if a value for
- any known fieldname was submitted.
-
-+=head2 repeatable_max_counter
-+
-+Arguments: $number
-+
-+Default Value: C<100>
-+
-+The default L<max_counter|HTML::FormFu::Element::Repeatable/max_counter>
-+for all L<Repeatable|HTML::FormFu::Element::Repeatable> elements in this
-+form. Individual Repeatable elements can override this by setting their own
-+L<max_counter|HTML::FormFu::Element::Repeatable/max_counter>.
-+
-+Set to C<0> to disable clamping form-wide.
-+
- =head2 auto_fieldset
-
- Arguments: 1
-diff --git a/lib/HTML/FormFu/Element/Repeatable.pm b/lib/HTML/FormFu/Element/Repeatable.pm
-index 1769e547..cb60b23a 100644
---- a/lib/HTML/FormFu/Element/Repeatable.pm
-+++ b/lib/HTML/FormFu/Element/Repeatable.pm
-@@ -14,6 +14,23 @@ use Carp qw( croak );
-
- has counter_name => ( is => 'rw', traits => ['Chained'] );
-
-+has max_counter => (
-+ is => 'rw',
-+ default => sub {
-+ my $form = $_[0]->form;
-+ return $form->repeatable_max_counter if $form;
-+ return 100;
-+ },
-+ lazy => 1,
-+ traits => ['Chained'],
-+);
-+
-+has counter_clamped => (
-+ is => 'ro',
-+ default => 0,
-+ writer => '_set_counter_clamped',
-+);
-+
- has _original_elements => ( is => 'rw' );
-
- has increment_field_names => (
-@@ -261,6 +278,8 @@ sub process {
- my $form = $self->form;
- my $count = 1;
-
-+ $self->_set_counter_clamped(0);
-+
- if ( defined $counter_name && defined $form->query ) {
-
- # are we in a nested-repeatable?
-@@ -279,7 +298,15 @@ sub process {
- my $input = $form->query->param($counter_name);
-
- if ( defined $input && $input =~ /^[1-9][0-9]*\z/ ) {
-- $count = $input;
-+ my $max = $self->max_counter;
-+
-+ if ( defined $max && $max > 0 && $input > $max ) {
-+ $count = $max;
-+ $self->_set_counter_clamped(1);
-+ }
-+ else {
-+ $count = $input;
-+ }
- }
- }
-
-@@ -426,6 +453,31 @@ present on the form during L<HTML::FormFu/process>, no Processors
- (Constraints, etc.) will be run on the fields, and their values will not
- be returned by L<HTML::FormFu/params> or L<HTML::FormFu/param>.
-
-+=head2 max_counter
-+
-+Arguments: $number
-+
-+Default Value: C<100>
-+
-+The largest repeat count that will be accepted from the L</counter_name>
-+query parameter. A larger client-supplied value is clamped to this number.
-+
-+The default is inherited from L<HTML::FormFu/repeatable_max_counter>, so
-+setting that on the form sets the default for all its Repeatable elements.
-+
-+Set to C<0> to accept any client-supplied count without clamping. Doing so
-+lets a single request drive an unbounded number of element clones.
-+
-+Calling L</repeat> from application code is not affected by this setting,
-+so a form repeated once per database row is unaffected however many rows
-+there are.
-+
-+=head2 counter_clamped
-+
-+Read-only boolean. True if the most recent L<HTML::FormFu/process> call
-+clamped the client-supplied count to L</max_counter>. Reset to false at the
-+start of each L<HTML::FormFu/process> call.
-+
- =head2 increment_field_names
-
- Arguments: $bool
-diff --git a/t/repeatable/max_counter.t b/t/repeatable/max_counter.t
-new file mode 100644
-index 00000000..ba51f325
---- /dev/null
-+++ b/t/repeatable/max_counter.t
-@@ -0,0 +1,123 @@
-+use strict;
-+use warnings;
-+
-+use Test::More tests => 13;
-+
-+use HTML::FormFu;
-+use lib 't/lib';
-+use HTMLFormFu::TestLib;
-+
-+# Test that max_counter defaults to 100 and clamps large values
-+{
-+ my $form = HTML::FormFu->new(
-+ { tt_args => { INCLUDE_PATH => 'share/templates/tt/xhtml' } } );
-+
-+ $form->load_config_file('t/repeatable/max_counter.yml');
-+
-+ my $repeatable = $form->get_element( { type => 'Repeatable' } );
-+
-+ is( $repeatable->max_counter, 100, 'default max_counter is 100' );
-+
-+ $form->process( { count => 200 } );
-+
-+ my @blocks = @{ $repeatable->get_elements };
-+ is( scalar @blocks, 100, '200 repeats clamped to 100' );
-+ ok( $repeatable->counter_clamped, 'counter_clamped is true after clamping' );
-+}
-+
-+# Test that max_counter can be set lower
-+{
-+ my $form = HTML::FormFu->new(
-+ { tt_args => { INCLUDE_PATH => 'share/templates/tt/xhtml' } } );
-+
-+ $form->load_config_file('t/repeatable/max_counter.yml');
-+
-+ my $repeatable = $form->get_element( { type => 'Repeatable' } );
-+ $repeatable->max_counter(5);
-+
-+ $form->process( { count => 10 } );
-+
-+ my @blocks = @{ $repeatable->get_elements };
-+ is( scalar @blocks, 5, '10 repeats clamped to 5' );
-+ ok( $repeatable->counter_clamped, 'counter_clamped is true' );
-+}
-+
-+# Test that max_counter=0 means unlimited (not clamped)
-+{
-+ my $form = HTML::FormFu->new(
-+ { tt_args => { INCLUDE_PATH => 'share/templates/tt/xhtml' } } );
-+
-+ $form->load_config_file('t/repeatable/max_counter.yml');
-+
-+ my $repeatable = $form->get_element( { type => 'Repeatable' } );
-+ $repeatable->max_counter(0);
-+
-+ $form->process( { count => 3 } );
-+
-+ my @blocks = @{ $repeatable->get_elements };
-+ is( scalar @blocks, 3, 'max_counter=0 allows 3 repeats unclamped' );
-+ ok( !$repeatable->counter_clamped, 'counter_clamped is false' );
-+}
-+
-+# Test that normal small values are unaffected
-+{
-+ my $form = HTML::FormFu->new(
-+ { tt_args => { INCLUDE_PATH => 'share/templates/tt/xhtml' } } );
-+
-+ $form->load_config_file('t/repeatable/max_counter.yml');
-+
-+ $form->process( { count => 3 } );
-+
-+ my $repeatable = $form->get_element( { type => 'Repeatable' } );
-+ my @blocks = @{ $repeatable->get_elements };
-+ is( scalar @blocks, 3, '3 repeats below default max_counter' );
-+ ok( !$repeatable->counter_clamped, 'counter_clamped is false' );
-+}
-+
-+# Test that calling repeat() directly is unaffected by max_counter
-+{
-+ my $form = HTML::FormFu->new(
-+ { tt_args => { INCLUDE_PATH => 'share/templates/tt/xhtml' } } );
-+
-+ $form->load_config_file('t/repeatable/max_counter.yml');
-+
-+ my $repeatable = $form->get_element( { type => 'Repeatable' } );
-+ $repeatable->repeat(200);
-+
-+ my @blocks = @{ $repeatable->get_elements };
-+ is( scalar @blocks, 200, 'direct repeat(200) unaffected by max_counter' );
-+}
-+
-+# Test form-level repeatable_max_counter
-+{
-+ my $form = HTML::FormFu->new(
-+ { tt_args => { INCLUDE_PATH => 'share/templates/tt/xhtml' },
-+ repeatable_max_counter => 50,
-+ } );
-+
-+ $form->load_config_file('t/repeatable/max_counter.yml');
-+
-+ my $repeatable = $form->get_element( { type => 'Repeatable' } );
-+
-+ is( $repeatable->max_counter, 50,
-+ 'max_counter inherits form repeatable_max_counter' );
-+
-+ $form->process( { count => 200 } );
-+
-+ my @blocks = @{ $repeatable->get_elements };
-+ is( scalar @blocks, 50, '200 clamped to form-level 50' );
-+}
-+
-+# Test chained method works
-+{
-+ my $form = HTML::FormFu->new(
-+ { tt_args => { INCLUDE_PATH => 'share/templates/tt/xhtml' } } );
-+
-+ $form->load_config_file('t/repeatable/max_counter.yml');
-+
-+ my $repeatable = $form->get_element( { type => 'Repeatable' } );
-+
-+ $repeatable->max_counter(10)->max_counter(20);
-+
-+ is( $repeatable->max_counter, 20, 'chained max_counter setter works' );
-+}
-diff --git a/t/repeatable/max_counter.yml b/t/repeatable/max_counter.yml
-new file mode 100644
-index 00000000..2166822b
---- /dev/null
-+++ b/t/repeatable/max_counter.yml
-@@ -0,0 +1,11 @@
-+---
-+elements:
-+ - type: Hidden
-+ name: count
-+
-+ - type: Repeatable
-+ nested_name: rep
-+ increment_field_names: 1
-+ counter_name: count
-+ elements:
-+ - name: foo
diff --git a/perl-HTML-FormFu.spec b/perl-HTML-FormFu.spec
index 5fcff82..4a4fcf5 100644
--- a/perl-HTML-FormFu.spec
+++ b/perl-HTML-FormFu.spec
@@ -1,12 +1,11 @@
Name: perl-HTML-FormFu
-Version: 2.07
-Release: 25%{?dist}
+Version: 2.09
+Release: 1%{?dist}
Summary: HTML Form Creation, Rendering and Validation Framework
# lib/HTML/FormFu.pm
License: GPL-1.0-or-later OR Artistic-1.0-Perl
URL: https://metacpan.org/dist/HTML-FormFu
-Source0: https://cpan.metacpan.org/authors/id/C/CF/CFRANKS/HTML-FormFu-%{version}.tar.gz
-Patch0: HTML-FormFu-CVE-2026-19873.patch
+Source0: https://cpan.metacpan.org/authors/id/P/PL/PLICEASE/HTML-FormFu-%{version}.tar.gz
BuildArch: noarch
BuildRequires: coreutils
BuildRequires: findutils
@@ -45,7 +44,7 @@ BuildRequires: perl(HTML::TokeParser::Simple) >= 3.14
BuildRequires: perl(HTTP::Headers) >= 1.64
BuildRequires: perl(IO::File)
BuildRequires: perl(JSON::MaybeXS)
-BuildRequires: perl(List::MoreUtils)
+BuildRequires: perl(List::SomeUtils)
BuildRequires: perl(Locale::Maketext)
BuildRequires: perl(Module::Pluggable)
BuildRequires: perl(Moose) >= 1.00
@@ -69,6 +68,7 @@ BuildRequires: perl(Test::Memory::Cycle)
BuildRequires: perl(Test::More) >= 0.92
BuildRequires: perl(Test::RequiresInternet)
BuildRequires: perl(YAML::XS) >= 0.32
+BuildRequires: perl(blib)
BuildRequires: sed
Requires: perl(Captcha::reCAPTCHA) >= 0.93
Requires: perl(Class::Accessor::Chained::Fast)
@@ -98,7 +98,6 @@ anything else you might want to do (as long as it involves forms).
%prep
%setup -q -n HTML-FormFu-%{version}
-%patch -P 0 -p1
find examples -type f | xargs chmod 644
find examples -type f | xargs sed -i -e 's/\r//'
@@ -109,7 +108,6 @@ perl Makefile.PL INSTALLDIRS=vendor NO_PACKLIST=1 NO_PERLLOCAL=1
%install
%{make_install}
-rm -rf $RPM_BUILD_ROOT/blib
%{_fixperms} $RPM_BUILD_ROOT/*
%check
@@ -124,6 +122,10 @@ rm -rf $RPM_BUILD_ROOT/blib
%{_mandir}/man3/HTML::FormFu*
%changelog
+* Sun Sep 27 2026 Emmanuel Seyman <emmanuel@seyman.fr> - 2.09-1
+- Update to 2.09
+- Drop upstreamed patch
+
* Sun Sep 20 2026 Emmanuel Seyman <emmanuel@seyman.fr> - 2.07-25
- Update release number
diff --git a/sources b/sources
index a4a1eea..3cbb077 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (HTML-FormFu-2.07.tar.gz) = e4dba675bdef952a26ac6b053be27d3d900a22c2adef19d6dabb92f2edddad395484b82f2b41b354176635073162017059364ee0fccfb149d2a220faa4d7d7cd
+SHA512 (HTML-FormFu-2.09.tar.gz) = 2ea44e2e461ad85ee2322ae56789428ae09443f642c6b67b2c3fd8c3f22cb784143447f965c49384cecc26cf8be80f17d3cff0a8d9b872d4c44573888982e0bf
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-27 8:23 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-27 8:23 [rpms/perl-HTML-FormFu] rawhide: Update to 2.09 Emmanuel Seyman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox