Fix Rails/OutputSafety violations (#9244)

.rubocop_todo.yml

@@ -12,17 +12,6 @@ require:
 # Note that changes in the inspected code, or installation of new
 # versions of RuboCop, may require this file to be generated again.
 
-# Offense count: 16
-Rails/OutputSafety:
-  Exclude:
-    - 'app/helpers/application_helper.rb'
-    - 'app/helpers/comments_helper.rb'
-    - 'app/liquid_tags/github_tag/github_issue_tag.rb'
-    - 'app/liquid_tags/liquid_tag_base.rb'
-    - 'app/models/comment.rb'
-    - 'app/models/display_ad.rb'
-    - 'app/models/message.rb'
-
 # Offense count: 4
 # Configuration parameters: Include.
 # Include: app/models/**/*.rb

app/helpers/application_helper.rb

@@ -155,7 +155,7 @@ module ApplicationHelper
 
   def logo_svg
     if SiteConfig.logo_svg.present?
-      SiteConfig.logo_svg.html_safe
+      SiteConfig.logo_svg.html_safe # rubocop:disable Rails/OutputSafety
     else
       inline_svg_tag("devplain.svg", class: "logo", size: "20% * 20%", aria: true, title: "App logo")
     end

app/helpers/comments_helper.rb

@@ -35,10 +35,12 @@ module CommentsHelper
   private
 
   def nested_comments(tree:, commentable:, is_view_root: false)
-    tree.map do |comment, sub_comments|
+    comments = tree.map do |comment, sub_comments|
       render("comments/comment", comment: comment, commentable: commentable,
                                  is_view_root: is_view_root, is_childless: sub_comments.empty?,
                                  subtree_html: nested_comments(tree: sub_comments, commentable: commentable))
-    end.join.html_safe
+    end
+
+    safe_join(comments)
   end
 end

app/liquid_tags/github_tag/github_issue_tag.rb

@@ -17,7 +17,7 @@ class GithubTag
       @content_json = @content.issue_serialized
       @is_issue = @content_json[:title].present?
       @created_at = @content_json[:created_at]
-      @body = @content.processed_html.html_safe
+      @body = @content.processed_html.html_safe # rubocop:disable Rails/OutputSafety
     end
 
     def render
@@ -78,12 +78,6 @@ class GithubTag
       URI.parse(API_BASE_ENDPOINT).merge(path).to_s
     end
 
-    def finalize_html(input)
-      input.gsub(/(?!<code[^>]*?>)(@[a-zA-Z]{3,})(?![^<]*?<\/code>)/) do |target|
-        "<a class=\"github-user-link\" href=\"https://github.com/#{target.delete('@')}\">#{target}</a>"
-      end.html_safe
-    end
-
     def valid_link?(link)
       link_without_domain = link.gsub(/.*github\.com\//, "").split("/")
       validations = [

app/liquid_tags/liquid_tag_base.rb

@@ -15,14 +15,6 @@ class LiquidTagBase < Liquid::Tag
     )
   end
 
-  def finalize_html(input)
-    input.gsub(/ {2,}/, "").
-      gsub(/\n/m, " ").
-      gsub(/>\n{1,}</m, "><").
-      strip.
-      html_safe
-  end
-
   private
 
   def validate_contexts

app/models/comment.rb

@@ -123,7 +123,7 @@ class Comment < ApplicationRecord
   end
 
   def safe_processed_html
-    processed_html.html_safe
+    processed_html.html_safe # rubocop:disable Rails/OutputSafety
   end
 
   def root_exists?
@@ -177,7 +177,7 @@ class Comment < ApplicationRecord
         anchor.content = strip_url(anchor.content) unless anchor.to_s.include?("<img")
       end
     end
-    self.processed_html = doc.to_html.html_safe
+    self.processed_html = doc.to_html.html_safe # rubocop:disable Rails/OutputSafety
   end
 
   def calculate_score

app/models/display_ad.rb

@@ -32,7 +32,7 @@ class DisplayAd < ApplicationRecord
     # stripped_html = ActionController::Base.helpers.sanitize initial_html,
     #                                                         tags: %w[a em i b u br img h1 h2 h3 h4 div style],
     #                                                         attributes: %w[href target src height width style]
-    stripped_html = initial_html.html_safe
+    stripped_html = initial_html.html_safe # rubocop:disable Rails/OutputSafety
     html = stripped_html.delete("\n")
     self.processed_html = MarkdownParser.new(html).prefix_all_images(html, 350)
   end

app/models/message.rb

@@ -100,6 +100,7 @@ class Message < ApplicationRecord
 
   # rubocop:disable Layout/LineLength
   # rubocop:disable Metrics/BlockLength
+  # rubocop:disable Rails/OutputSafety
   def append_rich_links(html)
     doc = Nokogiri::HTML(html)
     doc.css("a").each do |anchor|
@@ -145,9 +146,11 @@ class Message < ApplicationRecord
     end
     html
   end
-  # rubocop:enable Metrics/BlockLength
   # rubocop:enable Layout/LineLength
+  # rubocop:enable Metrics/BlockLength
+  # rubocop:enable Rails/OutputSafety
 
+  # rubocop:disable Rails/OutputSafety
   def handle_slash_command(html)
     response = if html.to_s.strip == "<p>/call</p>"
                  "<a href='/video_chats/#{chat_channel_id}'
@@ -169,6 +172,7 @@ class Message < ApplicationRecord
     html = response if response
     html
   end
+  # rubocop:enable Rails/OutputSafety
 
   def cl_path(img_src)
     ActionController::Base.helpers.