Usually when we render a link, we're doing so via `link_to` or some other method that escapes the `href` attribute by default:

```ruby
1.9.3p484 :016 > link_to 'Properly escaped, no worries', Addressable::URI.parse('<script>alert("XSS!")</script>').path
 => "<a href=\"&lt;script&gt;alert(&quot;XSS!&quot;)&lt;/script&gt;\">Properly escaped, no worries</a>"
```

In practice, I don't think we're saying that any of the following types of string that we store that can become a rendered link (if I've missed any, and I will have, please comment below) are ever `#html_safe`:

* [`Mapping#old_url`](https://github.com/alphagov/transition/blob/915851517ae9e3ea174f099f1404067c7c8cb527/app/models/mappings_batch_entry.rb#L11)
* `Mapping#path`
* Suggested URL
* Archive URL

If we were saying `#html_safe`, that would be a problem. 

> **NB**: My assertion breaks here. We are indeed saying that in a [couple](https://github.com/alphagov/transition/blob/master/app/helpers/sites_helper.rb#L47) of [places](https://github.com/alphagov/transition/blob/master/app/helpers/sites_helper.rb#L61). Although the input for both of those places is coming from config files rather than raw user input, we should fix those places ASAP. I've created a [security bug](https://www.pivotaltracker.com/story/show/72349016) for these.

The rest of the places that I've checked and that look safe by default are:

* In transition, when we show a mapping in a [table](https://github.com/alphagov/transition/blob/915851517ae9e3ea174f099f1404067c7c8cb527/app/views/mappings/_mappings_table.html.erb#L55)
* In transition, when we show a mapping's old URL in its [single edit form](https://github.com/alphagov/transition/blob/915851517ae9e3ea174f099f1404067c7c8cb527/app/views/mappings/_form.html.erb#L19)
* In bouncer, when we show [archived and suggested](https://github.com/alphagov/bouncer/blob/master/templates/410.erb#L29-L37) URLs - this is in Rack, not Rails, but @jamiecobbett has wrapped it in [escaped-by-default Erubis](https://github.com/alphagov/bouncer/blob/master/lib/status_renderer.rb#L14)