When you encouter an unsafe string that you actually made html_safe before, perhaps you called one of the following methods on it:

"capitalize", "chomp", "chop", "delete", "downcase", "gsub", "lstrip", "next", "reverse", "rstrip", "slice", "squeeze", "strip", "sub", "succ", "swapcase", "tr", "tr_s", "upcase"

Opscomplete powered by

Save money by migrating from AWS to our fully managed hosting in Germany.

• Trusted by over 100 customers
• Ready to use with Ruby, Node.js, PHP
• Proactive management by operations experts

Read more Show archive.org snapshot

All these methods are possibly unsafe, so they will return an unsafe String even if called on a SafeBuffer. If used for in-place replacements (e.g. sub! instead of sub), a TypeError is raised.

This is to prevent tricks like my_safe_string.gsub!(/.*/, params[:user_input]).