title: How to secure link_to @variable cross site scripting vulnerabilities
body: <p>I've just started using the brakeman gem to explore my rails app for security vulnerabilities.</p>
  
  <p>I've managed to get everything tidy except for several cross site scripting warnings.</p>
  
  <p>These all share the following in common:</p>
  
  <ul>
  <li>They're all link_to tags</li>
  <li>They all have instance variables in the class, alt or title
  attributes</li>
  <li>The instance variables all represent an active record query that
  includes associated models</li>
  <li>The instance variables are all "commentable". This describes a polymorphic association for user generated comments, similar in approach to the revised version of <a href="http://railscasts.com/episodes/154-polymorphic-association" rel="noreferrer">this Railscast</a>.</li>
  </ul>
  
  <p>e.g</p>
  
  <pre><code>&lt;%= link_to "Click" , :class=&gt; @model.association.attribute, :alt=&gt; @model.association.attribute, :title=&gt; @model.association.attribute, @model.association %&gt;
  </code></pre>
  
  <p>where </p>
  
  <pre><code>@model = @commentable = Model.includes(:association1, association2: {:nested-association1, :nested-association2}).find(params[:id])
  </code></pre>
  
  <p>Is this something I need to be concerned about/ take action for? I thought Rails 3.2 escapes these by default. </p>
  
  <p>I'd welcome advice to help me understand this issue better, and identify what steps I should take, if any.</p>