_L2></a><a href="#C23_L3" id=C23_L3></a></span></code></pre></div>
<p>If you return a <code>SafeString</code> (a string that has been wrapped in a call
to <a href="https://api.emberjs.com/classes/Ember.String.html#method_htmlSafe"><code>htmlSafe</code></a>), Ember knows that you have vouched on its behalf that it
contains no malicious HTML.</p>
<p>However, note that in the above code we may have inadvertently
introduced an XSS vulnerability into our application! By blindly marking
the string as safe, a mali