Unsafe string methods in Rails

When you encouter an unsafe string that you actually made html_safe before, perhaps you called one of the following methods on it:

"capitalize", "chomp", "chop", "delete", "downcase", "gsub", "lstrip", "next", "reverse", "rstrip", "slice", "squeeze", "strip", "sub", "succ", "swapcase", "tr", "tr_s", "upcase"

All these methods are possibly unsafe, so they will return an unsafe String even if called on a SafeBuffer. If used for in-place replacements (e.g. sub! instead of sub), a TypeError is raised.

This is to prevent tricks like my_safe_string.gsub!(/.*/, params[:user_input]).