Merge pull request #6355 from amutz/fix_number_with_delimiter_escaping

NumberHelper.number_with_delimiter should html_escape both delimiters and separators

actionpack/lib/action_view/helpers/number_helper.rb

@@ -254,7 +254,7 @@ def number_with_delimiter(number, options = {})
 
         parts = number.to_s.to_str.split('.')
         parts[0].gsub!(/(\d)(?=(\d\d\d)+(?!\d))/, "\\1#{options[:delimiter]}")
-        parts.join(options[:separator]).html_safe
+        safe_join(parts, options[:separator])
       end
 
       # Formats a +number+ with the specified level of

actionpack/test/template/number_helper_test.rb

@@ -78,6 +78,8 @@ def test_number_with_delimiter_with_options_hash
     assert_equal '12,345,678-05', number_with_delimiter(12345678.05, :separator => '-')
     assert_equal '12.345.678,05', number_with_delimiter(12345678.05, :separator => ',', :delimiter => '.')
     assert_equal '12.345.678,05', number_with_delimiter(12345678.05, :delimiter => '.', :separator => ',')
+    assert_equal '1&lt;script&gt;&lt;/script&gt;01', number_with_delimiter(1.01, :separator => "<script></script>")
+    assert_equal '1&lt;script&gt;&lt;/script&gt;000', number_with_delimiter(1000, :delimiter => "<script></script>")
   end
 
   def test_number_with_precision

activesupport/lib/active_support/testing/performance.rb

@@ -196,6 +196,7 @@ def self.[](name)
 
         class Base
           include ActionView::Helpers::NumberHelper
+          include ActionView::Helpers::OutputSafetyHelper
 
           attr_reader :total