# [CRUCIBLE-SEED]
# category: xss
# severity: high
# language: ruby
# expected: raw() helper used with user-controlled content in ERB template

# In a Rails view (equivalent Ruby)
class ArticlesController < ApplicationController
  helper_method :render_article

  def show
    @article   = Article.find(params[:id])
    @title     = params[:title] || @article.title
    @body      = @article.body
  end
end

# Equivalent ERB logic (Ruby):
def render_article_html(title, body, author_bio)
  "<h1>#{raw(title)}</h1><div>#{raw(body)}</div><footer>#{raw(author_bio)}</footer>"
end

def raw(str)
  str.to_s
end