• text should be escaped

  ui_bibz/lib/ui_bibz/helpers/ui/ux_helper.rb

  Line 45 in 87c2b56

  "#{ui_glyph glyph_args} #{text}".html_safe

• table_title probably needs to be escaped. That or the + operator should be used which correctly handle safe and unsafe strings:

  ui_bibz/lib/ui_bibz/ui/ux/tables/extensions/searchable.rb

  Line 42 in 87c2b56

  "#{table_glyph}#{table_title}".html_safe

• content[:label] is probable not safe

  ui_bibz/lib/ui_bibz/inputs/ui_bibz_form/ui_bibz_form_builder.rb

  Line 28 in 1d914e0

  concat content_tag(:label, "#{abbr_html} #{content[:label]}".html_safe, class: label_classes) if content[:label]

• label est unsafe, c'est un XSS, garanti

  ui_bibz/lib/ui_bibz/ui/core/icons/glyph.rb

  Line 64 in 87c2b56

  [content_tag(:i, '', html_options), label].compact.join(' ').html_safe

• title est probablement unsafe selon les cas

  ui_bibz/lib/ui_bibz/ui/ux/tables/extensions/sortable.rb

  Line 27 in 11f8188

  link_to title.html_safe, url_for(url_options_o), { class: cls }

• certains items ne sont probablement pas safe (je suppose que sinon tous auraient la méthode render)

  ui_bibz/lib/ui_bibz/ui/core/forms/buttons/button_group.rb

  Line 60 in 87c2b56

  content_tag :div, @items.map { |item| item.respond_to?(:render) ? item.try(:render) : item }.join.html_safe, html_options

probably needs further investigation:

• ui_bibz/lib/ui_bibz/ui/core/boxes/components/card_body.rb

  Line 50 in e916b95

  content_tag :div, @items.join.html_safe, html_options

• ui_bibz/lib/ui_bibz/ui/core/boxes/components/card_body.rb

  Line 53 in e916b95

  content_tag :div, @items.join.html_safe, html_options

• What's in content?

  ui_bibz/lib/ui_bibz/ui/core/boxes/components/body/card_body_text.rb

  Line 38 in 87c2b56

  content_tag :p, content.html_safe, html_options

• What's in @header and @footer?

  ui_bibz/lib/ui_bibz/ui/core/boxes/components/card_col.rb

  Line 62 in d37858a

  [@header, @items.join, @footer].compact.join.html_safe

  ui_bibz/lib/ui_bibz/ui/core/boxes/card.rb

  Line 108 in e916b95

  [@header, @items.join, @footer].compact.join.html_safe

  ui_bibz/lib/ui_bibz/ui/ux/containers/panel.rb

  Line 98 in 87c2b56

  [@header, @items.join, @footer].compact.join.html_safe

• What's in @actions?

  ui_bibz/lib/ui_bibz/ui/ux/tables/extensions/actionable.rb

  Line 40 in 87c2b56

  d.html l.to_s.html_safe

probably not as problematic, but I believe these html_safe are not needed :

• ui_bibz/lib/ui_bibz/ui/core/notifications/popover.rb

  Line 75 in 87c2b56

  'data-bs-content' => @content.html_safe

• ui_bibz/lib/ui_bibz/ui/core/notifications/popover.rb

  Line 82 in 87c2b56

  options[data_attribute].is_a?(String) ? options[data_attribute].html_safe : options[data_attribute]

• ui_bibz/lib/ui_bibz/ui/core/notifications/tooltip.rb

  Line 75 in 87c2b56

  'data-bs-title' => @content.html_safe

• ui_bibz/lib/ui_bibz/ui/core/notifications/tooltip.rb

  Line 82 in 87c2b56

  options[data_attribute].is_a?(String) ? options[data_attribute].html_safe : options[data_attribute]