content_tag no longer considered dangerous

[oreoshake]

Background

Brakeman version: 5.1.2
Rails version: 6.1.7.3
Ruby version: 2.7.5

Link to Rails application code: #1778

False Positive

Full warning from Brakeman:

Confidence: High
Category: Cross-Site Scripting
Check: ContentTag
Message: Unescaped parameter value in `content_tag`
Code: content_tag(:tr, foo(mf), params[:foo] => params[:bar])

Relevant code:

helper.content_tag :p, "<script>alert(1)</script>", "<script>&'\"" => "<script>&'\""

Why might this be a false positive?

The return value seems to gsub out the control characters for _ in attribute names now.

=> "<p _script____=\"&lt;script&gt;&amp;&#39;&quot;\">&lt;script&gt;alert(1)&lt;/script&gt;</p>"

I haven't really tracked down when this changed. I thought I did, but no.

[presidentbeef]

I think it was

rails/rails@5c7dae5

released in Rails 6.1.6