Disabled Auto-Escape (ARCH6134)

Key ruby.security.disabled-auto-escape · Severity warning · Category security · CWE CWE-79

Turning off auto-escaping in templates, or marking output with raw/html_safe, disables the default XSS protection. Always render untrusted data escaped.

Incorrect

<%= raw @comment.body %>
<%= @comment.body.html_safe %>

Correct

<%= @comment.body %>
<%# If limited safe markup is required, sanitize with an allowlist %>
<%= sanitize @comment.body, tags: %w[b i a], attributes: %w[href] %>

Fix

Avoid raw/html_safe; keep auto-escaping on and use sanitize with an allowlist when needed.