Bug#1147147: trixie-pu: package libhtml-formfu-perl/2.07000-2+deb13u1

[Salvatore Bonaccorso]

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: libhtml-formfu-perl at packages.debian.org, team at security.debian.org, debian-perl at lists.debian.org, gregoa at debian.org, carnil at debian.org
Control: affects -1 + src:libhtml-formfu-perl
User: release.debian.org at packages.debian.org
Usertags: pu

Hi SRM

This was to late for 13.7, but please consider it for 13.8.

libhtml-formfu-perl in trixie is vulnerable to CVE-2026-19873, which
is marked as no-dsa, which may result in denial of service (resource
exhaustion).

Attached is the debdiff. QA testing was as well done with debusine at:
https://debusine.debian.net/debian/developers/work-request/1232730/

Regards,
Salvatore
-------------- next part --------------
diff -Nru libhtml-formfu-perl-2.07000/debian/changelog libhtml-formfu-perl-2.07000/debian/changelog
--- libhtml-formfu-perl-2.07000/debian/changelog	2024-04-10 15:35:50.000000000 +0000
+++ libhtml-formfu-perl-2.07000/debian/changelog	2026-09-05 12:43:35.000000000 +0000
@@ -1,3 +1,13 @@
+libhtml-formfu-perl (2.07000-2+deb13u1) trixie; urgency=medium
+
+  * Team upload.
+
+  [ gregor herrmann ]
+  * Add patch from CPANSec to fix resource exhaustion vulnerability
+    (CVE-2026-19873) (Closes: #1146310)
+
+ -- Salvatore Bonaccorso <carnil at debian.org>  Sat, 05 Sep 2026 14:43:35 +0200
+
 libhtml-formfu-perl (2.07000-2) unstable; urgency=medium
 
   [ gregor herrmann ]
diff -Nru libhtml-formfu-perl-2.07000/debian/patches/CVE-2026-19873-r1.patch.patch libhtml-formfu-perl-2.07000/debian/patches/CVE-2026-19873-r1.patch.patch
--- libhtml-formfu-perl-2.07000/debian/patches/CVE-2026-19873-r1.patch.patch	1970-01-01 00:00:00.000000000 +0000
+++ libhtml-formfu-perl-2.07000/debian/patches/CVE-2026-19873-r1.patch.patch	2026-09-05 12:43:35.000000000 +0000
@@ -0,0 +1,83 @@
+From f04c57ca5f65b179b70ce13422df1aa0788fb849 Mon Sep 17 00:00:00 2001
+From: Robert Rothenberg <rrwo at cpansec.org>
+Date: Fri, 21 Aug 2026 12:05:00 +0100
+Subject: [PATCH] Bound the Repeatable counter taken from the query string
+
+The counter_name query parameter was passed to repeat() with no upper
+bound, so a single request could ask for an arbitrary number of copies
+of the block's child subtree. (CVE-2026-19873)
+
+Add a max_counter attribute, defaulting to 100, that clamps the value
+read from the query. A count passed to repeat() by application code is
+not affected.
+
+Assisted-by: Claude Opus 5 (1M context)
+
+Signed-off-by: Robert Rothenberg <rrwo at cpansec.org>
+
+Bug-Debian: https://bugs.debian.org/1146310
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-19873
+
+---
+ lib/HTML/FormFu/Element/Repeatable.pm | 31 +++++++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+diff --git a/lib/HTML/FormFu/Element/Repeatable.pm b/lib/HTML/FormFu/Element/Repeatable.pm
+index 920221c..e39818b 100644
+--- a/lib/HTML/FormFu/Element/Repeatable.pm
++++ b/lib/HTML/FormFu/Element/Repeatable.pm
+@@ -14,6 +14,13 @@ use Carp qw( croak );
+ 
+ has counter_name => ( is => 'rw', traits => ['Chained'] );
+ 
++has max_counter => (
++    is      => 'rw',
++    default => 100,
++    lazy    => 1,
++    traits  => ['Chained'],
++);
++
+ has _original_elements => ( is => 'rw' );
+ 
+ has increment_field_names => (
+@@ -280,6 +287,15 @@ sub process {
+ 
+         if ( defined $input && $input =~ /^[1-9][0-9]*\z/ ) {
+             $count = $input;
++
++            my $max = $self->max_counter;
++
++            if ( defined $max && $count > $max ) {
++                DEBUG_PROCESS
++                    && debug("clamping counter $count to max_counter $max");
++
++                $count = $max;
++            }
+         }
+     }
+ 
+@@ -442,6 +458,21 @@ present on the form during L<HTML::FormFu/process>, no Processors
+ (Constraints, etc.) will be run on the fields, and their values will not
+ be returned by L<HTML::FormFu/params> or L<HTML::FormFu/param>.
+ 
++=head2 max_counter
++
++Arguments: $count
++
++Default Value: 100
++
++The largest value that will be taken from the L</counter_name> query
++parameter. A larger value in the query is clamped to this limit, so the
++number of copies created from untrusted input is bounded.
++
++Set to C<undef> to restore the previous unbounded behaviour.
++
++This limit applies only to counts read from the query. A count passed
++directly to L</repeat> by application code is not affected.
++
+ =head2 increment_field_names
+ 
+ Arguments: $bool
+-- 
+2.53.0
+
diff -Nru libhtml-formfu-perl-2.07000/debian/patches/series libhtml-formfu-perl-2.07000/debian/patches/series
--- libhtml-formfu-perl-2.07000/debian/patches/series	2024-04-10 15:35:50.000000000 +0000
+++ libhtml-formfu-perl-2.07000/debian/patches/series	2026-09-05 12:43:35.000000000 +0000
@@ -1 +1,2 @@
 how-to-report-bugs.diff
+CVE-2026-19873-r1.patch.patch