Content_tag_string Sanitizes Possibly Unsafe HTML

This ticket is related to the ongoing work on HTML safe strings (ticket #3018 Introduce notion of 'html_safe?' to Strings in preparation for on-by-default ...). It is related to tickets #3448 Button_to does not return an HTML-safe string #3450 Field_set_tag doesn't escape the legend #3449 Label tag doesn't escape its input and points to the underlying problem.

Tag helpers in Rails (indirectly) use content_tag_string to output a string to render. In Rails 2.3.5, content_tag_string liberally marks its output as html safe.

def content_tag_string(name, content, options, escape = true)
  tag_options = tag_options(options, escape) if options
        "<#{name}#{tag_options}>#{content}</#{name}>".html_safe!
end

In particular, content_tag, which can be used to generate any HTML tag, passes its second argument, which could easily be user-supplied data, straight through to content_tag_string, where the output is marked as HTML safe.

content_tag(:p, "<script>alert('hello');</script>")

Content_tag is used in other tag helpers:

      def label_tag(name, text = nil, options = {})
        content_tag :label, text || name.to_s.humanize, { "for" => sanitize_to_id(name) }.update(options.stringify_keys)
      end