rails-design-system

The code is a legitimate SVG icon helper, but the hand-rolled implementation has moderate security risk when icon names or options can be influenced by untrusted input. Validate icon names against an allowlist or strict basename pattern, escape option values before insertion, avoid marking untrusted SVG content html_safe, and use a vetted SVG helper with sanitization. No malware indicators are present.