Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected], [email protected], [email protected], [email protected], [email protected] Control: affects -1 + src:libtemplate-perl User: [email protected] Usertags: pu
Hi SRMers, This is too late for 13.7, but please consider it for 13.8. libtemplate-perl in trixie is affected by CVE-2026-5090 which we marked no-dsa. The html_filter function did not escape single quotes, allowing limited HTML or JavaScript to be injected. The update cherry-picks the upstream commit including tests for the problem. Additionally the update has been tested on debusine with autopkgtests run for the reverse dependencies: https://debusine.debian.net/debian/developers/work-request/1232282/ Can you accept it for 13.8? Regards, Salvatore
diff -Nru libtemplate-perl-2.27/debian/changelog libtemplate-perl-2.27/debian/changelog --- libtemplate-perl-2.27/debian/changelog 2018-03-11 00:39:18.000000000 +0000 +++ libtemplate-perl-2.27/debian/changelog 2026-09-05 12:35:27.000000000 +0000 @@ -1,3 +1,11 @@ +libtemplate-perl (2.27-1+deb13u1) trixie; urgency=medium + + * Team upload. + * fix: escape single quotes in html_filter and HTML.escape (CVE-2026-5090) + (Closes: #1137160) + + -- Salvatore Bonaccorso <[email protected]> Sat, 05 Sep 2026 14:35:27 +0200 + libtemplate-perl (2.27-1) unstable; urgency=low * New upstream release. diff -Nru libtemplate-perl-2.27/debian/patches/fix-escape-single-quotes-in-html_filter-and-HTML.esc.patch libtemplate-perl-2.27/debian/patches/fix-escape-single-quotes-in-html_filter-and-HTML.esc.patch --- libtemplate-perl-2.27/debian/patches/fix-escape-single-quotes-in-html_filter-and-HTML.esc.patch 1970-01-01 00:00:00.000000000 +0000 +++ libtemplate-perl-2.27/debian/patches/fix-escape-single-quotes-in-html_filter-and-HTML.esc.patch 2026-09-05 12:35:27.000000000 +0000 @@ -0,0 +1,129 @@ +From: =?UTF-8?q?K=C5=8Dan?= <[email protected]> +Date: Fri, 20 Feb 2026 23:41:41 -0700 +Subject: fix: escape single quotes in html_filter and HTML.escape +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Origin: https://github.com/cpan-authors/Template2/commit/11c78a7a771d4af505efeb754a0b8775689c2eae +Bug-Debian: https://bugs.debian.org/1137160 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-5090 + +Single quotes were not escaped by the HTML filter or HTML plugin's +escape method, creating XSS risk in single-quoted HTML attributes. + +Uses ' (numeric entity) which is valid across all HTML versions, +unlike ' which is only defined in XML. The xml_filter already +handled single quotes via ' — its comment is updated to clarify +the distinction. + +Test coverage added for both filter.t, html.t and vmethods/text.t. + +Co-Authored-By: Kōan <[email protected]> +--- + lib/Template/Filters.pm | 10 ++++++---- + lib/Template/Plugin/HTML.pm | 1 + + t/filter.t | 8 +++++++- + t/html.t | 7 +++++++ + t/vmethods/text.t | 2 +- + 5 files changed, 22 insertions(+), 6 deletions(-) + +diff --git a/lib/Template/Filters.pm b/lib/Template/Filters.pm +index deeb2f201e6b..f033378e82c7 100644 +--- a/lib/Template/Filters.pm ++++ b/lib/Template/Filters.pm +@@ -297,8 +297,9 @@ sub url_filter { + #------------------------------------------------------------------------ + # html_filter() [% FILTER html %] + # +-# Convert any '<', '>' or '&' characters to the HTML equivalents, '<', +-# '>' and '&', respectively. ++# Convert any '<', '>', '&', '"' or "'" characters to the HTML ++# equivalents, '<', '>', '&', '"' and ''', ++# respectively. + #------------------------------------------------------------------------ + + sub html_filter { +@@ -308,6 +309,7 @@ sub html_filter { + s/</</g; + s/>/>/g; + s/"/"/g; ++ s/'/'/g; + } + return $text; + } +@@ -316,8 +318,8 @@ sub html_filter { + #------------------------------------------------------------------------ + # xml_filter() [% FILTER xml %] + # +-# Same as the html filter, but adds the conversion of ' to ' which +-# is native to XML. ++# Same as the html filter, but uses ' for single quotes (the XML ++# named entity) instead of ' (the numeric reference used for HTML). + #------------------------------------------------------------------------ + + sub xml_filter { +diff --git a/lib/Template/Plugin/HTML.pm b/lib/Template/Plugin/HTML.pm +index 3275093a5018..58d11e3b891b 100644 +--- a/lib/Template/Plugin/HTML.pm ++++ b/lib/Template/Plugin/HTML.pm +@@ -115,6 +115,7 @@ sub escape { + s/</</g; + s/>/>/g; + s/"/"/g; ++ s/'/'/g; + } + $text; + } +diff --git a/t/filter.t b/t/filter.t +index 1e8f17bb9726..e1aa2b4c8cbf 100644 +--- a/t/filter.t ++++ b/t/filter.t +@@ -291,7 +291,13 @@ The <cat> sat on the <mat> + "It isn't what I expected", he replied. + [% END %] + -- expect -- +-"It isn't what I expected", he replied. ++"It isn't what I expected", he replied. ++ ++-- test -- ++-- name html filter single-quoted attributes -- ++[% val = "it's <dangerous> & \"broken\""; val FILTER html %] ++-- expect -- ++it's <dangerous> & "broken" + + -- test -- + [% FILTER xml %] +diff --git a/t/html.t b/t/html.t +index 1cc692af1926..8479dffcd72f 100644 +--- a/t/html.t ++++ b/t/html.t +@@ -104,6 +104,13 @@ my%20file.html + -- expect -- + if (a < b && c > d) ... + ++-- test -- ++-- name escape single quotes -- ++[% USE HTML -%] ++[% HTML.escape("it's a <tag attr='val'>test") %] ++-- expect -- ++it's a <tag attr='val'>test ++ + -- test -- + -- name sorted -- + [% USE HTML(sorted=1) -%] +diff --git a/t/vmethods/text.t b/t/vmethods/text.t +index 13e6b36bda61..a9ec5e21a3bb 100644 +--- a/t/vmethods/text.t ++++ b/t/vmethods/text.t +@@ -215,7 +215,7 @@ Tim O'Reilly said \"Oh really?\" + -- name text.html -- + [% markup.html %] + -- expect -- +-a < b > & c "d" 'e' ++a < b > & c "d" 'e' + + -- test -- + -- name text.xml -- +-- +2.55.0 + diff -Nru libtemplate-perl-2.27/debian/patches/series libtemplate-perl-2.27/debian/patches/series --- libtemplate-perl-2.27/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ libtemplate-perl-2.27/debian/patches/series 2026-09-05 12:35:27.000000000 +0000 @@ -0,0 +1 @@ +fix-escape-single-quotes-in-html_filter-and-HTML.esc.patch
