Is it possible to enforce sanitization for all title attributes using #h or #html_safe?

[ndbroadbent]

I have a few tooltips that need to use HTML tags, so I use Bootstrap tooltips with the html: true option: https://getbootstrap.com/docs/4.3/components/tooltips/#options

I've run into a few XSS issues where I've forgotten to escape the title attributes in my Rails views.

Is there a way I can configure brakeman to make sure I'm properly sanitizing every title attribute in my views? Or is it possible to write my own custom check class?

I'm starting to wonder if the html: true option is just too dangerous, but I do need the HTML support in my tooltips.

[presidentbeef]

Hi @ndbroadbent can you give an example of what the code looks like?