Thepo1Es

Action View tag helpers fail to properly handle HTML attribute names consisting only of whitespace when they are provided as Symbols or passed to asset tag helpers like `image tag`, `video tag`, and `audio tag`. Because the system tests if the name is blank before converting it to a string, a whitespace Symbol is not identified as blank, resulting in the emission of an attribute with no name and the production of malformed HTML. This can allow a crafted attribute value to be misinterpreted by the browser as a separate attribute name, potentially leading to Cross-Site Scripting (XSS), a technique where malicious scripts are injected into trusted websites. This issue affects applications that allow users to specify custom HTML attribute names.

When a GCS service is configured with the `cache control` option, the `url for direct upload()` function in `ActiveStorage::Service::GCSService` signs direct-upload URLs using V4, but the signature only covers the `Host` and `Cache-Control` headers. This allows a client to specify an arbitrary `Content-Type` or omit the `Content-MD5` without invalidating the URL. Because GCS prioritizes the supplied content type as object metadata over the response-content-type set by Active Storage, an attacker could upload an object served as inline HTML on the storage origin. This could enable the registration of a Service Worker scoped to the bucket path, allowing the attacker to read or replace subsequent responses for signed URLs within that bucket.