Remove usage of safe_html in renderings

app/views/application/_flash.html.slim

@@ -1,7 +1,8 @@
 #flash-container.container
   #flash.container.fixed_error_messages data-message-failure=t('shared.message_failure') data-websocket-failure=t('shared.websocket_failure')
     - %w[alert danger info notice success warning].each do |severity|
-      div.alert.flash class="alert-#{{'alert' => 'warning', 'notice' => 'success'}.fetch(severity, severity)} alert-dismissible fade show"
-        p.mb-0 id="flash-#{severity}" = flash[severity]&.html_safe
+      - flash_mapping = {'alert' => 'warning', 'notice' => 'success'}
+      div.alert.flash class="alert-#{flash_mapping.fetch(severity, severity)} alert-dismissible fade show"
+        p.mb-0 id="flash-#{severity}" == flash[severity]
         button type="button" class="close" data-dismiss="alert" aria-label="Close"
           span.text-white aria-hidden="true" ×

app/views/exercises/_editor_output.html.slim

@@ -17,8 +17,18 @@ div.h-100 id='output_sidebar_uncollapsed' class='d-none col-sm-12 enforce-bottom
                 .card-header.py-2
                   h5.card-title.m-0 == t('exercises.implement.test_file', filename: '', number: 0)
                 .card-body.bg-white.text-dark
-                  = row(label: 'exercises.implement.passed_tests', value: t('shared.out_of', maximum_value: 0, value: 0).html_safe)
-                  = row(label: 'activerecord.attributes.submission.score', value: t('shared.out_of', maximum_value: 0, value: 0).html_safe)
+                  = row(label: 'exercises.implement.passed_tests') do
+                    span.number
+                      | 0
+                    =<> t('shared.out_of')
+                    span.number
+                      | 0
+                  = row(label: 'activerecord.attributes.submission.score') do
+                    span.number
+                      | 0
+                    =<> t('shared.out_of')
+                    span.number
+                      | 0
                   = row(label: 'exercises.implement.feedback')
                   = row(label: 'exercises.implement.error_messages')
                   /= row(label: 'exercises.implement.output', value: link_to(t('shared.show'), '#'))
@@ -27,8 +37,18 @@ div.h-100 id='output_sidebar_uncollapsed' class='d-none col-sm-12 enforce-bottom
                 .card-header.py-2
                   h5.card-title.m-0 == t('exercises.implement.linter_file', filename: '', number: 0)
                 .card-body.bg-white.text-dark
-                  = row(label: 'exercises.implement.code_rating', value: t('shared.out_of', maximum_value: 0, value: 0).html_safe)
-                  = row(label: 'activerecord.attributes.submission.score', value: t('shared.out_of', maximum_value: 0, value: 0).html_safe)
+                  = row(label: 'exercises.implement.code_rating') do
+                    span.number
+                      | 0
+                    =<> t('shared.out_of')
+                    span.number
+                      | 0
+                  = row(label: 'activerecord.attributes.submission.score') do
+                    span.number
+                      | 0
+                    =<> t('shared.out_of')
+                    span.number
+                      | 0
                   = row(label: 'exercises.implement.feedback')
                   = row(label: 'exercises.implement.messages')
         #score data-maximum-score=@exercise.maximum_score data-score=@exercise.final_submission(@current_user).try(:score)

app/views/exercises/external_users/statistics.html.slim

@@ -1,4 +1,8 @@
-h1 = "#{@exercise} (external user #{link_to_if(policy(@external_user).show?, @external_user.displayname, @external_user)})".html_safe
+h1
+  => @exercise
+  ' (external user
+  = link_to_if(policy(@external_user).show?, @external_user.displayname, @external_user)
+  ' )
 - current_submission = @submissions.first
 - if current_submission
   - initial_files = current_submission.files.to_a

app/views/exercises/statistics.html.slim

@@ -12,13 +12,30 @@ h1 = @exercise
     = "#{@exercise.submissions.send(scope).count} (#{t('.users', count: @exercise.submissions.send(scope).distinct.count(:user_id))})"
 
 = row(label: '.finishing_rate') do
-  p == @exercise.finishers.count ? "#{t('shared.out_of', maximum_value: @exercise.users.distinct.count, value: @exercise.finishers.count)} #{t('exercises.statistics.external_users')}" : empty
+  p
+    - if @exercise.finishers.count
+      span.number
+        = @exercise.finishers.count
+      =<> t('shared.out_of')
+      span.number
+        = @exercise.users.distinct.count
+      =< t('exercises.statistics.external_users')
+    - else
+      = empty
   - finishers_count = @exercise.users.distinct.count
   - finishers_percentage = finishers_count == 0 ? 0 : (100.0 / finishers_count * @exercise.finishers.count).round(2)
   p = progress_bar(finishers_percentage)
 
 = row(label: '.average_score') do
-  p == @exercise.average_score ? t('shared.out_of', maximum_value: @exercise.maximum_score, value: @exercise.average_score.round(2)) : empty
+  p
+    - if @exercise.average_score
+      span.number
+        = @exercise.average_score.round(2)
+      =<> t('shared.out_of')
+      span.number
+        = @exercise.maximum_score
+    - else
+      = empty
   p = progress_bar(@exercise.average_percentage)
 
 - if policy(@exercise).detailed_statistics?

app/views/sessions/destroy_through_lti.html.slim

@@ -8,9 +8,19 @@ p
 h2 = t('shared.statistics')
 
 = row(label: '.score') do
-  /p == t('shared.out_of', maximum_value: @submission.exercise.maximum_score, value: @submission.score)
+  /p
+    span.number
+      = @submission.score
+    =<> t('shared.out_of')
+    span.number
+      = @submission.exercise.maximum_score
   p = progress_bar(@submission.percentage)
 /= row(label: '.final_submissions', value: @submission.exercise.submissions.final.distinct.count(:user_id, :user_type) - 1)
 /= row(label: '.average_score') do
-/  p == t('shared.out_of', maximum_value: @submission.exercise.maximum_score, value: @submission.exercise.average_score.round(2))
+/  p
+    span.number
+      = @submission.exercise.average_score.round(2)
+    =<> t('shared.out_of')
+    span.number
+      = @submission.exercise.maximum_score
 /  p = progress_bar(@submission.exercise.average_percentage)

config/locales/de.yml

@@ -813,7 +813,7 @@ de:
     object_created: '%{model} wurde erfolgreich erstellt.'
     object_destroyed: '%{model} wurde erfolgreich gelöscht.'
     object_updated: '%{model} wurde erfolgreich bearbeitet.'
-    out_of: '<span class="number">%{value}</span> von <span class="number">%{maximum_value}</span>'
+    out_of: 'von'
     reset_filters: Filter zurücksetzen
     resources: Ressourcen
     show: Anzeigen

config/locales/en.yml

@@ -813,7 +813,7 @@ en:
     object_created: '%{model} has successfully been created.'
     object_destroyed: '%{model} has successfully been deleted.'
     object_updated: '%{model} has successfully been updated.'
-    out_of: '<span class="number">%{value}</span> out of <span class="number">%{maximum_value}</span>'
+    out_of: 'out of'
     reset_filters: Reset filters
     resources: Resources
     show: Show