Merge branch 'tags-public-send'

Fixes #14180
Fixes #17461

2 files changed, 15 insertions, 1 deletions

diff --git a/actionview/lib/action_view/helpers/tags/base.rb b/actionview/lib/action_view/helpers/tags/base.rb
index 8607da301c..f8abb19698 100644
--- a/actionview/lib/action_view/helpers/tags/base.rb
+++ b/actionview/lib/action_view/helpers/tags/base.rb
@@ -25,7 +25,7 @@ module ActionView
         private
 
         def value(object)
-          object.send @method_name if object
+          object.public_send @method_name if object
         end
 
         def value_before_type_cast(object)
diff --git a/actionview/test/template/form_helper_test.rb b/actionview/test/template/form_helper_test.rb
index f2238d1443..4bbbdf4fb1 100644
--- a/actionview/test/template/form_helper_test.rb
+++ b/actionview/test/template/form_helper_test.rb
@@ -1785,6 +1785,20 @@ class FormHelperTest < ActionView::TestCase
     assert_dom_equal expected, output_buffer
   end
 
+  def test_form_tags_do_not_call_private_properties_on_form_object
+    obj = Class.new do
+      private
+
+      def private_property
+        raise "This method should not be called."
+      end
+    end.new
+
+    form_for(obj, as: "other_name", url: '/', html: { id: "edit-other-name" }) do |f|
+      assert_raise(NoMethodError) { f.hidden_field(:private_property) }
+    end
+  end
+
   def test_form_for_with_method_as_part_of_html_options
     form_for(@post, url: '/', html: { id: 'create-post', method: :delete }) do |f|
       concat f.text_field(:title)