Why is rails code embedded in text attribute printing as text? - ruby-on-rails

Question

I have a model Post with a text attribute Body, and I want to be able to insert images into the text, using HTML tags, so an example Body value would look like this:
post.body = "this is text <img src='file.png'/> that was an image"
and then post.body.html_safe prints as text and an image. But this doesn't work on production, because the file name gets a unique hash during assets precompilation, so the only way to get the file's path is to use image_url. But when
post.body == "this is text <img src='#{image_url("file.png")}'"
the image's path is just literally "#{image_url("file.png")}" in plain text. I'm really confused about this because when I set the post.body in the view, it suddenly works, even though it's set to the same value. The only difference is where the value is set.
Here's a demonstration of what I mean:
Scenario 1
A post is created with a click and then edited with a form:
create button:
<%= link_to "new post", create_post_path %>
edit view:
<%= form_for(#post, url: update_post_path(#post)) do |f| %>
<%= f.text_field :title %>
<%= f.text_area :body %>
<%= f.submit "save" %>
<% end %>
controller:
class PostsController < ApplicationController
def create
#post = Post.create
redirect_to edit_post_path(#post)
end
def edit
#post = Post.find(params[:id])
end
def update
#post = Post.find(params[:id])
#post.update_attributes(post_params)
#post.save
redirect_to root_path
end
private
def post_params
params.require(:post).permit(:title, :body)
end
end
The saved blog view:
<% Post.each do |post| %>
<%= post.body.html_safe %>
<% end %>
The picture is missing and this is the text in the source code:
<img src='#{image_url("file.png")}' />
Scenario 2
Same thing as in Scenario 1
The saved blog view:
" %>
Picture prints normally and in the source code the img src is the full path of the file.
What's the difference between these two scenarios??? I'm so confused. I feel like it has something to do with Rails security measures when the post_params are being used but I have no idea.

Answer 1

Scenario 1
When you do:
Post.each do |post|
post.body.html_safe
end
ERB will not inspect the post.body content to interpret Ruby code. Code into the #{...} syntax in a string is only interpreted when you declare a string in ruby code, not when it is present in a string coming from database from example.
Formulated another way, when ERB sees post.body, it only understands "output the content of the string", but it will not parse the string searching for ruby code inside #{}.
The scenario 2 works because it has nothing to do with scenario 1. Scenario 2 isn't about ERB outputting a string. In scenario 2, the line post.body = "<img src='#{image_url("file.png")}' />" is interpreted by the Ruby parser, which will search for #{} in the string being defined, and will execute the code inside those.
Wrong solution
The first solution that comes to mind would be to parse manually the post.body content so it interprets Ruby code inside #{}, but that would be a huge security vulnerability if some untrusted people edit the posts, as they could write any Ruby code in the post and get it executed.
In the same style, you could use ERB <%= ... %> instead of Ruby's #{ ... }. Example: ERB.new("My name is <%= name %>").result.
Better solution
Don't save Ruby code within the post.body. You could save only the image filename in the src, and before rendering the post, apply some preprocessing to replace the filename with the full path. You will need a Ruby library to parse the post html and find all the img tags. One such library is Nokogiri.