More sanitization

Author: fbacall

app/helpers/application_helper.rb

@@ -245,7 +245,7 @@ def signup_js
 
   def twitter_link(username)
     link_to("http://twitter.com/#{username}", target: '_blank', rel: 'noopener') do
-      "<i class='fa fa-twitter'></i> @#{username}".html_safe
+      content_tag(:i, nil, class: 'fa fa-twitter') + "@#{username}"
     end
   end
 
@@ -256,7 +256,8 @@ def info_button(title, opts = {}, &block)
     content_tag(:a, tabindex: 0, class: classes,
                     data: { toggle: 'popover', placement: 'bottom',
                             title:, html: true, content: capture(&block) }) do
-      "<i class='icon icon-md information-icon'></i> <span class='hidden-xs'>#{title_text}</span>".html_safe
+      content_tag(:i, nil, class: 'icon icon-md information-icon') +
+        content_tag(:span, title_text, class: 'hidden-xs')
     end
   end
 
@@ -301,7 +302,7 @@ def tab(text, icon, href, disabled: { check: false }, active: false, count: nil,
       text << " (#{count})" if count
 
       link_to("##{href}", options) do
-        %(<i class="#{icon}" aria-hidden="true"></i> #{text}).html_safe
+        content_tag(:i, nil, class: icon, 'aria-hidden': 'true') + ' ' + text
       end
     end
   end
@@ -333,9 +334,9 @@ def format_for_dropdown(collection)
 
   def title_with_privacy(resource)
     html = resource.title
-    html += " #{icon_for(:private, nil, class: 'muted')}" unless resource.public
+    html = safe_join([html + ' ', icon_for(:private, nil, class: 'muted')]) unless resource.public
 
-    html.html_safe
+    html
   end
 
   ActionView::Helpers::FormBuilder.class_eval do
@@ -463,7 +464,7 @@ def star_button(resource)
 
   def external_link_button(text, url, options = {})
     options.reverse_merge!({ class: 'btn btn-primary' })
-    text = (text + ' <i class="icon icon-md arrow-top-right-white-icon"></i>').html_safe
+    text = safe_join([text, '<i class="icon icon-md arrow-top-right-white-icon"></i>'.html_safe])
     external_link(text, url, options)
   end