HTML safety: give a deprecation warning if an array of option tags is…

… passed to select tag. Be sure to join the tag yourself and mark them .html_safe

actionpack/lib/action_view/helpers/form_tag_helper.rb

@@ -93,6 +93,10 @@ def form_tag(url_for_options = {}, options = {}, *parameters_for_url, &block)
       #   # => <select disabled="disabled" id="destination" name="destination"><option>NYC</option>
       #   #    <option>Paris</option><option>Rome</option></select>
       def select_tag(name, option_tags = nil, options = {})
+        if Array === option_tags
+          ActiveSupport::Deprecation.warn 'Passing an array of option_tags to select_tag implicitly joins them without marking them as HTML-safe. Pass option_tags.join.html_safe instead.', caller
+        end
+
         html_name = (options[:multiple] == true && !name.to_s.ends_with?("[]")) ? "#{name}[]" : name
         if blank = options.delete(:include_blank)
           if blank.kind_of?(String)

actionpack/test/template/form_tag_helper_test.rb

@@ -158,6 +158,12 @@ def test_select_tag_with_include_blank_with_string
     assert_dom_equal expected, actual
   end
 
+  def test_select_tag_with_array_options
+    assert_deprecated /array/ do
+      select_tag "people", ["<option>david</option>"]
+    end
+  end
+
   def test_text_area_tag_size_string
     actual = text_area_tag "body", "hello world", "size" => "20x40"
     expected = %(<textarea cols="20" id="body" name="body" rows="40">hello world</textarea>)