how do I avoid html_safe when using gsub to insert links?

Question

a simplified example would be this:

def expand_links(message)
  message = strip_tags(message)
  message = message.gsub('[register]') { link_to('register', new_user_path) }
  message = message.gsub('[login]') { link_to('login', new_sessions_path) }
  message.html_safe
end

I'm using strip_tags but to be sure there isn't a chance of XSS.

so what would be the proper way to do this without strip_tags and html_safe?

Answer 1

here is what I did from @iceman's suggestion:

  def expand_links(message)
    message = strip_tags(message)
    message = message.gsub('[register]') { link_to('register', new_user_path) }
    message = message.gsub('[login]') { link_to('login', new_sessions_path) }
    sanitize(message, tags: ['a'], attributes: ['href'])
  end

(BTW sanitize doesn't work with symbols)

https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html