Clean tag attributes before passing through the escape_once logic.

Addresses CVE-2009-3009

Author: NZKoz

actionpack/lib/action_view/helpers/tag_helper.rb

@@ -99,7 +99,7 @@ def cdata_section(content)
       #   escape_once("<< Accept & Checkout")
       #   # => "<< Accept & Checkout"
       def escape_once(html)
-        html.to_s.gsub(/[\"><]|&(?!([a-zA-Z]+|(#\d+));)/) { |special| ERB::Util::HTML_ESCAPE[special] }
+        ActiveSupport::Multibyte.clean(html.to_s).gsub(/[\"><]|&(?!([a-zA-Z]+|(#\d+));)/) { |special| ERB::Util::HTML_ESCAPE[special] }
       end
 
       private