Jhawthorn

Action View tag helpers are susceptible to an issue where attribute escaping is bypassed when a blank string is used as an HTML attribute name, resulting in malformed HTML. A specially crafted attribute value could be misinterpreted by the browser as a separate attribute name, potentially leading to cross-site scripting (XSS). Applications that permit users to define custom HTML attributes are at risk.

The `NumberToDelimitedConverter` component utilizes a regular expression with `gsub!` to insert thousands delimiters. The interaction between a repeated lookahead group and `gsub!` can result in quadratic time complexity when processing long digit strings. This can potentially stall Ruby on Rails applications.

Active Support number helpers are susceptible to a denial-of-service condition. The number helpers accept strings containing scientific notation, such as `1e10000`, which are expanded into extremely large decimal representations by `BigDecimal`. This expansion can lead to excessive memory allocation and CPU usage during formatting, potentially causing a DoS.

Active Storage enables users to attach cloud and local files within Rails applications. A flaw exists in the `DiskService#delete prefixed` function where blob keys are passed directly to `Dir.glob` without proper escaping of glob metacharacters. This can lead to the deletion of unintended files from the storage directory if a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters.

The issue is related to the `content security policy` helper in Action Pack, which may allow an attacker to conduct Cross Site Scripting (XSS) attacks by injecting new directives into the Content-Security-Policy (CSP) headers. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Applications that set CSP headers dynamically from untrusted user input may be vulnerable.

The issue is related to an integer overflow in the yajl-ruby library, which leads to heap memory corruption when dealing with large inputs (~2GB). The reallocation logic at `yajl buf.c#L64` may result in the `need` 32bit integer wrapping to 0, causing a reallocation of `buf->alloc` into a small heap chunk. This vulnerability mostly impacts process availability, and maintainers believe exploitation for arbitrary code execution is unlikely.