html_escape_once decodes items flagged html_safe

[antemasqued]

If we mark something html_safe, we typically expect it to be rendered as-is and left alone.

If we utilize html_escape_once then somehow the above purpose of html_safe is neglected and that item is decoded.

This doesn't appear to be an uncaught edge case, but rather something done explicitly as is shown below (ref)

# File activesupport/lib/active_support/core_ext/string/output_safety.rb, line 44
    def html_escape_once(s)
      result = s.to_s.gsub(HTML_ESCAPE_ONCE_REGEXP, HTML_ESCAPE)
      s.html_safe? ? result.html_safe : result
    end

This seems to be inconsistent behavior as html_escape itself explicitly skips the escaping. What's the purpose of this? We have an explicit line here for this, so surely there was some thought put into this 🤔.

https://github.com/rails/rails/blob/4e1fe73028f4b01c8e5179989511b21925f70b20/activesupport/lib/active_support/core_ext/erb/util.rb#LL67C1-L67C47

[flavorjones]

Historical note: this behavior seems to date back to 608eddc (2012-01-12) when the method was extracted from TagHelper and the existing behavior was preserved.

The original implementation in TagHelper is from dbd0bd5 and 02358c8 (2006-10-18) and e711d8f (2007-09-24). Note that the concept of html_safe was not introduced until 9415935 (2009-10-08).

A reasonable conclusion might be that the decision to preserve the html_safe property was not an intentional one, but the existing behavior from 2009 has simply been preserved going forward. There have been quite a few inconsistencies like this raised or fixed in the past few years, see #47361 for a discussion and some links to prior issues and PRs.

I think it would be appropriate to update the behavior of this method to always return an html_safe string, but I'm interested in hearing what the Rails committers think. cc @jhawthorn and @matthewd who have chatted with me about html safety in the past.

[flavorjones]

I've created #48265 to have this method always return an html_safe string.

[antemasqued]

thanks @flavorjones and @byroot 🍾