From: CPANSec Security Scanner Bot <cpan-security@security.metacpan.org>
Subject: [PATCH] Form::Processor::Field::HtmlArea: keep tidy messages out of the Maketext format position

CVE-2026-13051.  validate runs HTML::Tidy over the submitted markup and
passes each resulting message to add_error as its first argument, which
add_error hands to the language handle as the Locale::Maketext message
key.  The default lexicon, Form::Processor::I18N::en_us, sets _AUTO, so a
message that is not a lexicon entry is compiled as bracket notation
rather than looked up.  Tidy diagnostics quote the attribute name or
value that provoked them, so a bracket group in the submitted markup
reaches the template position, where the first token of the group names a
method called on the language handle.  A group such as "[0]" makes the
compile croak, and neither the field nor the handle catches it, so the
exception leaves validate; "[sprintf,%2000000000d,7]" reaches
CORE::sprintf with an attacker chosen field width.

Fix: pass the message as an interpolation argument, add_error('[_1]',
$_->as_string), so the brackets it holds are displayed as data and never
compiled.  This is the shape the other field types already use, for
example "'[_1]' is not a valid value" in Form::Processor::Field.

Verified against the 1.162360 sources, with the message half of the path
driven directly (HTML::Tidy needs libtidy, which was not available):
tidy style messages carrying "[0]" and "[" raise an exception out of
add_error unpatched, and one carrying "[sprintf,%100000d,7]" expands to
over 100000 characters.  With the message passed as an argument, both are
returned verbatim and uncompiled, and a diagnostic holding no brackets is
unchanged either way.

diff --git a/lib/Form/Processor/Field/HtmlArea.pm b/lib/Form/Processor/Field/HtmlArea.pm
index 6ac11b5..843c68d 100644
--- a/lib/Form/Processor/Field/HtmlArea.pm
+++ b/lib/Form/Processor/Field/HtmlArea.pm
@@ -26,7 +26,12 @@ sub validate {
     my $ok = 1;
 
     for ( $tidy->messages ) {
-        $field->add_error( $_->as_string );
+        # The first argument to add_error is the Locale::Maketext format,
+        # and the default lexicon is _AUTO, so a message passed there is
+        # compiled as bracket notation.  A tidy message quotes the markup
+        # that provoked it, so pass it as an interpolation argument to
+        # keep any brackets it holds inert.
+        $field->add_error( '[_1]', $_->as_string );
         $ok = 0;
     }