# [CRUCIBLE-SEED]
# category: xss
# severity: high
# language: ruby
# expected: render html: with user content — unescaped XSS

class CommentsController < ApplicationController
  def show
    @comment = Comment.find(params[:id])
    render html: @comment.body.html_safe
  end

  def preview
    content = params[:content]
    render html: content.html_safe
  end
end