ViewComponent/view_component · error

WARNING: The #{self.class} component rendered HTML-unsafe ou

Error message

WARNING: The #{self.class} component rendered HTML-unsafe output. The output will be automatically escaped, but you may want to investigate.

What it means

Error "WARNING: The #{self.class} component rendered HTML-unsafe output. The output will be automatically escaped, but you may want to investigate." thrown in ViewComponent/view_component.

Source

Thrown at lib/view_component/template.rb:134

        super(component: component, details: details)

        @call_method_name = method_name
        @defined_on_self = defined_on_self
      end

      def type
        :inline_call
      end

      def compile_to_component
        @component.define_method(safe_method_name, @component.instance_method(@call_method_name))
      end

      def safe_method_name_call
        m = safe_method_name
        proc do
          __vc_maybe_escape_html(send(m)) do
            Kernel.warn("WARNING: The #{self.class} component rendered HTML-unsafe output. " \
                          "The output will be automatically escaped, but you may want to investigate.")
          end
        end
      end

      def defined_on_self?
        @defined_on_self
      end
    end

    def compile_to_component
      @component.silence_redefinition_of_method(call_method_name)

      # rubocop:disable Style/EvalWithLocation
      @component.class_eval <<~RUBY, @path, lineno
        def #{call_method_name}
          #{compiled_source}
        end

View on GitHub (pinned to 9f22c36fa7)

Solutions

1. Return an HTML-safe string from the template/call method: build output via the output buffer, `safe_join`, or `content_tag`, or mark it `.html_safe` only after escaping all untrusted input.
2. Escape interpolations with `ERB::Util.html_escape`/`h` before concatenating them into the returned string.

When it happens

Trigger: Thrown at lib/view_component/template.rb:134 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ViewComponent/view_component@9f22c36fa7 (2026-08-23). Data as JSON: /api/errors/f8ca16bdc45b4a5f. Report an issue: GitHub.