WARNING: The #{self.class} component was provided an HTML-un

Error message

WARNING: The #{self.class} component was provided an HTML-unsafe postamble. The postamble will be automatically escaped, but you may want to investigate.

What it means

Error "WARNING: The #{self.class} component was provided an HTML-unsafe postamble. The postamble will be automatically escaped, but you may want to investigate." thrown in ViewComponent/view_component.

Source

Thrown at lib/view_component/base.rb:456

      return text if text.blank?

      if text.html_safe?
        text
      else
        yield
        html_escape(text)
      end
    end

    def __vc_safe_output_preamble
      __vc_maybe_escape_html(output_preamble) do
        Kernel.warn("WARNING: The #{self.class} component was provided an HTML-unsafe preamble. The preamble will be automatically escaped, but you may want to investigate.")
      end
    end

    def __vc_safe_output_postamble
      __vc_maybe_escape_html(output_postamble) do
        Kernel.warn("WARNING: The #{self.class} component was provided an HTML-unsafe postamble. The postamble will be automatically escaped, but you may want to investigate.")
      end
    end

    def __vc_safe_around_render_output(output)
      __vc_maybe_escape_html(output) do
        Kernel.warn("WARNING: The #{self.class} component's around_render returned an HTML-unsafe string. The output will be automatically escaped, but you may want to investigate.")
      end
    end

    # Resets every render-scoped instance variable derived from the calling view
    # context so a reused instance cannot leak controller/helper/request/format
    # state from a previous render. Slot state (`@__vc_set_slots`,
    # `@__vc_content_set_by_with_content`) is intentionally preserved because it
    # is populated by callers _before_ `render_in` runs (e.g. via `with_*`
    # slot setters or `with_content`).
    RENDER_STATE_IVARS = %i[
      @__vc_controller
      @__vc_helpers

View on GitHub (pinned to 9f22c36fa7)

Solutions

Mark the postamble string HTML-safe with `.html_safe` only if it contains no untrusted/user-supplied data.
Otherwise sanitize or escape the postamble content before appending it to the output buffer.

When it happens

Trigger: Thrown at lib/view_component/base.rb:456 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ViewComponent/view_component@9f22c36fa7 (2026-08-23). Data as JSON: /api/errors/54620770f2f66e77. Report an issue: GitHub.