As far as I understand, the brakeman warning was a false-positive as `content_tag` properly escapes untrusted HTML. Furthermore, the interpolated string values are built from the “username” part of accounts, which is restricted to a small subset of ASCII that precludes any XML entity or HTML code. This proposed change should be functionally equivalent to the current code, however it is slightly more robust, it's more idiomatic, and Brakeman will stop complaining about it.
		
			
				
	
	
		
			6 lines
		
	
	
	
		
			452 B
		
	
	
	
		
			Text
		
	
	
	
	
	
			
		
		
	
	
			6 lines
		
	
	
	
		
			452 B
		
	
	
	
		
			Text
		
	
	
	
	
	
| .speech-bubble.positive
 | |
|   .speech-bubble__bubble
 | |
|     = t("admin.action_logs.actions.#{action_log.action}_#{action_log.target_type.underscore}_html", name: content_tag(:span, action_log.account.username, class: 'username'), target: content_tag(:span, log_target(action_log), class: 'target'))
 | |
|   .speech-bubble__owner
 | |
|     = admin_account_link_to(action_log.account)
 | |
|     %time.formatted{ datetime: action_log.created_at.iso8601 }= l action_log.created_at
 |