ViewComponent/view_component · error

WARNING: The #{self.class} component was provided an HTML-un

Error message

WARNING: The #{self.class} component was provided an HTML-unsafe preamble. The preamble will be automatically escaped, but you may want to investigate.

What it means

Error "WARNING: The #{self.class} component was provided an HTML-unsafe preamble. The preamble will be automatically escaped, but you may want to investigate." thrown in ViewComponent/view_component.

Source

Thrown at lib/view_component/base.rb:450

    def __vc_content_set_by_with_content_defined?
      defined?(@__vc_content_set_by_with_content)
    end

    def __vc_maybe_escape_html(text)
      return text if @current_template && !@current_template.html?
      return text if text.blank?

      if text.html_safe?
        text
      else
        yield
        html_escape(text)
      end
    end

    def __vc_safe_output_preamble
      __vc_maybe_escape_html(output_preamble) do
        Kernel.warn("WARNING: The #{self.class} component was provided an HTML-unsafe preamble. The preamble will be automatically escaped, but you may want to investigate.")
      end
    end

    def __vc_safe_output_postamble
      __vc_maybe_escape_html(output_postamble) do
        Kernel.warn("WARNING: The #{self.class} component was provided an HTML-unsafe postamble. The postamble will be automatically escaped, but you may want to investigate.")
      end
    end

    def __vc_safe_around_render_output(output)
      __vc_maybe_escape_html(output) do
        Kernel.warn("WARNING: The #{self.class} component's around_render returned an HTML-unsafe string. The output will be automatically escaped, but you may want to investigate.")
      end
    end

    # Resets every render-scoped instance variable derived from the calling view
    # context so a reused instance cannot leak controller/helper/request/format
    # state from a previous render. Slot state (`@__vc_set_slots`,

View on GitHub (pinned to 9f22c36fa7)

Solutions

1. Mark the preamble string HTML-safe with `.html_safe` only after verifying it contains no untrusted/user-supplied data.
2. Otherwise sanitize the preamble (e.g. with Rails' `sanitize` helper) or escape interpolations with `ERB::Util.html_escape` before returning it.

When it happens

Trigger: Thrown at lib/view_component/base.rb:450 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ViewComponent/view_component@9f22c36fa7 (2026-08-23). Data as JSON: /api/errors/a310b1d62ec390c4. Report an issue: GitHub.