Add a separator to the cache key for ActiveSupport::CachingKeyGenerator

[JackMc]

Summary

The ActiveSupport::CachingKeyGenerator is a thin wrapper around ActiveSupport::KeyGenerator that uses a Hash to memoize the output. The Hash key is currently a simple concatenation of the salt and the key length. This means if generate_key is called like @caching_generator.generate_key("133", 7) and then @caching_generator.generate_key("13", 37), the cache key will be the same (1337) and the output in the second case will be a 7-byte key, rather than a 37-byte key. Neither of these values should be user-controlled in normal usage of this class, so it is unlikely that a cache key collision here would be exploitable in practice.

We fix this issue by adding a separator (|) that delineates the key size from the salt.

Other Information

This PR was a result of a report to the Rails bug bounty program by https://hackerone.com/mysterican.