Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
For bugs related to Red Hat Enterprise Linux 5 product line. The current stable release is 5.10. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 523827

Summary: CGI.pm popup_menu if optgroup, $selected is not properly escaped.
Product: Red Hat Enterprise Linux 5 Reporter: Bryan Mason <bmason>
Component: perlAssignee: perl-maint-list
Status: CLOSED ERRATA QA Contact: Petr Šplíchal <psplicha>
Severity: high Docs Contact:
Priority: high    
Version: 5.4CC: ohudlick, plyons, ppisar, psplicha, rbiba, tao
Target Milestone: rcKeywords: EasyFix, Patch, ZStream
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: perl-5.8.8-29.el5 Doc Type: Bug Fix
Doc Text:
Cause CGI::popup_menu does not generated correct HTML if the default option contains a plus-sign ("+"). Consequence There could be missing closing tag. Fix Fix of regular expression fixed generation of HTML code. Result Closing tags are generated allright.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2012-02-21 05:39:26 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 590060, 701631    
Attachments:
Description Flags
Proposed patch none

Description Bryan Mason 2009-09-16 19:23:29 UTC 
Created attachment 361356 [details]
Proposed patch

Description of problem:

    CGI::popup_menu does not generated correct HTML if the default 
    option contains a plus-sign ("+").

Version-Release number of selected component (if applicable):

    perl-5.8.8-27.el5

How reproducible:

    Every time

Steps to Reproduce:

    perl -MCGI -e 'print CGI::popup_menu(-values=>[CGI::optgroup(-name=>"A",-values=>["a","b+"])],-default=>"b+")';
  
Actual results:

    <select name="" >
    <optgroup label="A">
    <option value="a">a</option>
    <option value="b+">b+</option>
    </optgroup>

Expected results:
    
    <select name="" >
    <optgroup label="A">
    <option value="a">a</option>
    <option selected="selected" value="b+">b+</option>
    </optgroup>
    </select>

Additional info:

    Proposed patch submitted by Ian Page Hands with help from
    #raleigh.pm on irc.perl.org, is attached and has been 
    accepted upstream:

        http://rt.cpan.org/Public/Bug/Display.html?id=49606#txn-663058
Comment 6 RHEL Program Management 2010-08-09 18:55:51 UTC 
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated in the
current release, Red Hat is unfortunately unable to address this
request at this time. Red Hat invites you to ask your support
representative to propose this request, if appropriate and relevant,
in the next release of Red Hat Enterprise Linux.
Comment 20 Marcela Mašláňová 2011-09-26 07:11:08 UTC 
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause
    CGI::popup_menu does not generated correct HTML if the  default option contains a plus-sign ("+").
Consequence
    There could be missing closing tag.
Fix
    Fix of regular expression fixed generation of HTML code.
Result
    Closing tags are generated allright.
Comment 22 errata-xmlrpc 2012-02-21 05:39:26 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0199.html