Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values

Summary

### Impact

During a security audit conducted with Claude Opus 4.6 and GPT-5.3-Codex, we identified three specific ways to bypass the XSS (cross-site-scripting) protection built into Phlex.

1. The first bypass could happen if user-provided attributes with string keys were splatted into HTML tag, e.g. `div(**user_attributes)`. 2. The second bypass could happen if user-provided tag names were passed to the `tag` method, e.g. `tag(some_tag_name_from_user)`. 3. The third bypass could happen if user’s links were passed to `href` attributes, e.g. `a(href: user_provided_link)`.

All three of these patterns are meant to be safe and all have now been patched.

### Patches

Phlex has patched all three issues and introduced new tests that run against Safari, Firefox and Chrome.

The patched versions are:

- [2.4.1](https://rubygems.org/gems/phlex/versions/2.4.1) - [2.3.2](https://rubygems.org/gems/phlex/versions/2.3.2) - [2.2.2](https://rubygems.org/gems/phlex/versions/2.2.2) - [2.1.3](https://rubygems.org/gems/phlex/versions/2.1.3) - [2.0.2](https://rubygems.org/gems/phlex/versions/2.0.3) - [1.11.1](https://rubygems.org/gems/phlex/versions/1.11.1)

Phlex has also patched the [`main`](https://github.com/yippee-fun/phlex) branch in GitHub.

### Workarounds If a project uses a secure CSP (content security policy) or if the application doesn’t use any of the above patterns, it is not at risk.