Correct me If I am wrong; only ```comment_message``` is not html_safe. ```h()``` method should do the trick:
```
+        t('report.comment_label', data: h(comment_message(Comment.find_by_id(id))))
```