False positive: `HAML::AttributeBuilder.build_class` incorrectly flagged as XSS

Background

Brakeman version: 8.0.6 Rails version: 8.1.3.1 Ruby version: 4.0.6

False Positive

Full warning from Brakeman:

Confidence: Weak
Category: Cross-Site Scripting
Check: CrossSiteScripting
Message: Unescaped model attribute
Code: ::Haml::AttributeBuilder.build_class(true, building_row_class((Unresolved Model).new))
File: app/views/buildings/_building.html.haml
Line: 3

Relevant code:

-# locals: (building:)

%tr{ class: building_row_class(building) }
  ...

Why might this be a false positive?

The Haml::AttributeBuilder escapes the content by default:

Haml::AttributeBuilder.build_class(true, "<script>alert('xss');</script>")
# => "&lt;script&gt;alert(&#39;xss&#39;);&lt;/script&gt;"

Curiously, calling a random method without the "Unresolved Model" and explicitly making it html_safe flies under the radar (as it should, since build_class escapes its content):

# app/views/buildings/_building.html.haml
%div{ class: raw(xss_vuln) }

# app/helpers/buildings_helper.rb
module BuildingsHelper
  def xss_vuln
    return Building.first.name
  end
end

Other than build_class, the Haml::AttributeBuilder also has methods build_aria and build_data, which might be worth looking into as well. However, I could not reproduce the issue for the latter two.

I think this false positive can be fixed by applying the same fix that was used for Haml::AttributeBuilder.build_id https://github.com/presidentbeef/brakeman/pull/1967/changes