Bug#1147103: trixie-pu: package libtemplate-perl/2.27-1+deb13u1
Salvatore Bonaccorso
carnil at debian.org
Mon Sep 7 17:06:24 BST 2026
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: libtemplate-perl at packages.debian.org, team at security.debian.org, debian-perl at lists.debian.org, gregoa at debian.org, carnil at debian.org
Control: affects -1 + src:libtemplate-perl
User: release.debian.org at packages.debian.org
Usertags: pu
Hi SRMers,
This is too late for 13.7, but please consider it for 13.8.
libtemplate-perl in trixie is affected by CVE-2026-5090 which we
marked no-dsa. The html_filter function did not escape single quotes,
allowing limited HTML or JavaScript to be injected.
The update cherry-picks the upstream commit including tests for the
problem. Additionally the update has been tested on debusine with
autopkgtests run for the reverse dependencies:
https://debusine.debian.net/debian/developers/work-request/1232282/
Can you accept it for 13.8?
Regards,
Salvatore
-------------- next part --------------
diff -Nru libtemplate-perl-2.27/debian/changelog libtemplate-perl-2.27/debian/changelog
--- libtemplate-perl-2.27/debian/changelog 2018-03-11 00:39:18.000000000 +0000
+++ libtemplate-perl-2.27/debian/changelog 2026-09-05 12:35:27.000000000 +0000
@@ -1,3 +1,11 @@
+libtemplate-perl (2.27-1+deb13u1) trixie; urgency=medium
+
+ * Team upload.
+ * fix: escape single quotes in html_filter and HTML.escape (CVE-2026-5090)
+ (Closes: #1137160)
+
+ -- Salvatore Bonaccorso <carnil at debian.org> Sat, 05 Sep 2026 14:35:27 +0200
+
libtemplate-perl (2.27-1) unstable; urgency=low
* New upstream release.
diff -Nru libtemplate-perl-2.27/debian/patches/fix-escape-single-quotes-in-html_filter-and-HTML.esc.patch libtemplate-perl-2.27/debian/patches/fix-escape-single-quotes-in-html_filter-and-HTML.esc.patch
--- libtemplate-perl-2.27/debian/patches/fix-escape-single-quotes-in-html_filter-and-HTML.esc.patch 1970-01-01 00:00:00.000000000 +0000
+++ libtemplate-perl-2.27/debian/patches/fix-escape-single-quotes-in-html_filter-and-HTML.esc.patch 2026-09-05 12:35:27.000000000 +0000
@@ -0,0 +1,129 @@
+From: =?UTF-8?q?K=C5=8Dan?= <koan.bot at atoomic.org>
+Date: Fri, 20 Feb 2026 23:41:41 -0700
+Subject: fix: escape single quotes in html_filter and HTML.escape
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Origin: https://github.com/cpan-authors/Template2/commit/11c78a7a771d4af505efeb754a0b8775689c2eae
+Bug-Debian: https://bugs.debian.org/1137160
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-5090
+
+Single quotes were not escaped by the HTML filter or HTML plugin's
+escape method, creating XSS risk in single-quoted HTML attributes.
+
+Uses ' (numeric entity) which is valid across all HTML versions,
+unlike ' which is only defined in XML. The xml_filter already
+handled single quotes via ' ? its comment is updated to clarify
+the distinction.
+
+Test coverage added for both filter.t, html.t and vmethods/text.t.
+
+Co-Authored-By: K?an <koan-bot at users.noreply.github.com>
+---
+ lib/Template/Filters.pm | 10 ++++++----
+ lib/Template/Plugin/HTML.pm | 1 +
+ t/filter.t | 8 +++++++-
+ t/html.t | 7 +++++++
+ t/vmethods/text.t | 2 +-
+ 5 files changed, 22 insertions(+), 6 deletions(-)
+
+diff --git a/lib/Template/Filters.pm b/lib/Template/Filters.pm
+index deeb2f201e6b..f033378e82c7 100644
+--- a/lib/Template/Filters.pm
++++ b/lib/Template/Filters.pm
+@@ -297,8 +297,9 @@ sub url_filter {
+ #------------------------------------------------------------------------
+ # html_filter() [% FILTER html %]
+ #
+-# Convert any '<', '>' or '&' characters to the HTML equivalents, '<',
+-# '>' and '&', respectively.
++# Convert any '<', '>', '&', '"' or "'" characters to the HTML
++# equivalents, '<', '>', '&', '"' and ''',
++# respectively.
+ #------------------------------------------------------------------------
+
+ sub html_filter {
+@@ -308,6 +309,7 @@ sub html_filter {
+ s/</</g;
+ s/>/>/g;
+ s/"/"/g;
++ s/'/'/g;
+ }
+ return $text;
+ }
+@@ -316,8 +318,8 @@ sub html_filter {
+ #------------------------------------------------------------------------
+ # xml_filter() [% FILTER xml %]
+ #
+-# Same as the html filter, but adds the conversion of ' to ' which
+-# is native to XML.
++# Same as the html filter, but uses ' for single quotes (the XML
++# named entity) instead of ' (the numeric reference used for HTML).
+ #------------------------------------------------------------------------
+
+ sub xml_filter {
+diff --git a/lib/Template/Plugin/HTML.pm b/lib/Template/Plugin/HTML.pm
+index 3275093a5018..58d11e3b891b 100644
+--- a/lib/Template/Plugin/HTML.pm
++++ b/lib/Template/Plugin/HTML.pm
+@@ -115,6 +115,7 @@ sub escape {
+ s/</</g;
+ s/>/>/g;
+ s/"/"/g;
++ s/'/'/g;
+ }
+ $text;
+ }
+diff --git a/t/filter.t b/t/filter.t
+index 1e8f17bb9726..e1aa2b4c8cbf 100644
+--- a/t/filter.t
++++ b/t/filter.t
+@@ -291,7 +291,13 @@ The <cat> sat on the <mat>
+ "It isn't what I expected", he replied.
+ [% END %]
+ -- expect --
+-"It isn't what I expected", he replied.
++"It isn't what I expected", he replied.
++
++-- test --
++-- name html filter single-quoted attributes --
++[% val = "it's <dangerous> & \"broken\""; val FILTER html %]
++-- expect --
++it's <dangerous> & "broken"
+
+ -- test --
+ [% FILTER xml %]
+diff --git a/t/html.t b/t/html.t
+index 1cc692af1926..8479dffcd72f 100644
+--- a/t/html.t
++++ b/t/html.t
+@@ -104,6 +104,13 @@ my%20file.html
+ -- expect --
+ if (a < b && c > d) ...
+
++-- test --
++-- name escape single quotes --
++[% USE HTML -%]
++[% HTML.escape("it's a <tag attr='val'>test") %]
++-- expect --
++it's a <tag attr='val'>test
++
+ -- test --
+ -- name sorted --
+ [% USE HTML(sorted=1) -%]
+diff --git a/t/vmethods/text.t b/t/vmethods/text.t
+index 13e6b36bda61..a9ec5e21a3bb 100644
+--- a/t/vmethods/text.t
++++ b/t/vmethods/text.t
+@@ -215,7 +215,7 @@ Tim O'Reilly said \"Oh really?\"
+ -- name text.html --
+ [% markup.html %]
+ -- expect --
+-a < b > & c "d" 'e'
++a < b > & c "d" 'e'
+
+ -- test --
+ -- name text.xml --
+--
+2.55.0
+
diff -Nru libtemplate-perl-2.27/debian/patches/series libtemplate-perl-2.27/debian/patches/series
--- libtemplate-perl-2.27/debian/patches/series 1970-01-01 00:00:00.000000000 +0000
+++ libtemplate-perl-2.27/debian/patches/series 2026-09-05 12:35:27.000000000 +0000
@@ -0,0 +1 @@
+fix-escape-single-quotes-in-html_filter-and-HTML.esc.patch
More information about the pkg-perl-maintainers
mailing list