Question

I have a model tag with attribute title (string).

A tag belongs_to a model document with a has_many :throught association.

In document#show view, I need to show all tags associated to that document, so I do:

%p= raw @document.tags.map{|t| link_to t.title.prepend('#'), t}.join(', ')

Is this safe considering that a user can be able to create a tag ?

If it’s not safe, how can I achieve the same result?

Thank you.

Answer 1

Yes, the tag’s title will be escaped before becoming the content of the link, so even if there were HTML in it, it would be rendered, not output raw. What will be output without escaping here is the string resulting from the join, which is fine.