Arib06

The access-log formatter in the HTTP server can write past its log-line buffer when a custom access-log format is configured. This occurs due to allocation errors involving `%{error}x`, `%q` when the query string is empty, and numeric elements where the temporary terminating NUL reaches the end of the buffer. A specifically crafted request can cause the server to crash, although the impact of a one-byte NUL overwrite beyond a crash has not been determined.

An XSS filter bypass exists in the InputFilter. The `cleanAttribute()` function fails to properly remove HTML data URIs when whitespace characters are injected, allowing an attacker to circumvent the cleanup process and execute a Cross-Site Scripting (XSS) attack.

Lack of output processing in multiple download views allows for response header injection. This issue can lead to reflected file download or content-type confusion, where the browser is misled about the nature of the file being downloaded.

Improper escaping flags in schema.org markup outputs create a Cross-Site Scripting (XSS) vector. XSS is a security flaw that allows an attacker to inject malicious scripts into web pages viewed by other users.