HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_err...

HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template. add_error hands its first argument to the language handle as the Locale::Maketext message key, and the default handle's lexicon sets _AUTO, so a string that is not a lexicon entry is compiled as a bracket notation template instead of being looked up. In a bracket group the first token names a method called on the language handle and the remaining tokens are its arguments. Three kinds of text the library did not author reach that position. _apply_actions installs a $SIG{__WARN__} handler that stores the warning text in $error_message, and a captured warning survives a successful action, so a field carrying a numeric transform turns Argument "[sprintf,%50000000d,0]" isn't numeric into the template; a warning quotes the submitted value verbatim, so the group is well formed and dispatches. $error_message ||= $tobj->validate($new_value) takes a type constraint's own failure message, which renders the rejected value through a partial dumper in bracket and comma form (Devel::PartialDump when Moose can load it, Type::Tiny's own dumper always), so a field with apply => [ Str ] given a parameter sent more than once, which arrives as an array, gets Reference ["a","b"] did not pass type constraint "Str" as its template, from a…