Improve performance of NumberToDelimitedConverter

byroot · jhawthorn · commit b54a4b373c6f · 2026-03-23T11:19:16.000-07:00
[CVE-2026-33169] [GHSA-cg4j-q9v8-6v38]
diff --git a/activesupport/lib/active_support/number_helper/number_to_delimited_converter.rb b/activesupport/lib/active_support/number_helper/number_to_delimited_converter.rb
@@ -16,9 +16,24 @@ def convert
       private
         def parts
           left, right = number.to_s.split(".")
-          left.gsub!(delimiter_pattern) do |digit_to_delimit|
-            "#{digit_to_delimit}#{options[:delimiter]}"
+          if delimiter_pattern
+            left.gsub!(delimiter_pattern) do |digit_to_delimit|
+              "#{digit_to_delimit}#{options[:delimiter]}"
+            end
+          else
+            left_parts = []
+            offset = left.size % 3
+            if offset > 0
+              left_parts << left[0, offset]
+            end
+
+            (left.size / 3).times do |i|
+              left_parts << left[offset + (i * 3), 3]
+            end
+
+            left = left_parts.join(options[:delimiter])
           end
+
           [left, right].compact
         end
 
diff --git a/activesupport/test/number_helper_test.rb b/activesupport/test/number_helper_test.rb
@@ -139,6 +139,8 @@ def test_to_delimited
           assert_equal("12,345,678", number_helper.number_to_delimited(12345678))
           assert_equal("0", number_helper.number_to_delimited(0))
           assert_equal("123", number_helper.number_to_delimited(123))
+          assert_equal("1,234", number_helper.number_to_delimited(1234))
+          assert_equal("12,345", number_helper.number_to_delimited(12345))
           assert_equal("123,456", number_helper.number_to_delimited(123456))
           assert_equal("123,456.78", number_helper.number_to_delimited(123456.78))
           assert_equal("123,456.789", number_helper.number_to_delimited(123456.789))
