Why is html_safe OK here? It would appear to allow any build job to inject arbitrary javascript into the page.