When you encouter an unsafe string that you actually made html_safe before, perhaps you called one of the following methods on it:

"capitalize", "chomp", "chop", "delete", "downcase", "gsub", "lstrip", "next", "reverse", "rstrip", "slice", "squeeze", "strip", "sub", "succ", "swapcase", "tr", "tr_s", "upcase"

Rails Long Term Support

Rails LTS provides security patches for old versions of Ruby on Rails (2.3, 3.2, 4.2 and 5.2)

• Prevents you from data breaches and liability risks
• Upgrade at your own pace
• Works with modern Rubies

Read more Show archive.org snapshot

All these methods are possibly unsafe, so they will return an unsafe String even if called on a SafeBuffer. If used for in-place replacements (e.g. sub! instead of sub), a TypeError is raised.

This is to prevent tricks like my_safe_string.gsub!(/.*/, params[:user_input]).