[security] multiple html_safe XSS problem

[dandai]

for example

https://github.com/xdite/bootstrap-helper/blob/master/lib/bootstrap_helper/breadcrumb.rb#L25

@breadcrumbs.push("#{title}".html_safe)

better to be

@breadcrumbs.push("#{title.html_safe}")

thanks!

[xdite]

can you send a pull request ? Thanks!