@@ -0,0 +1,13 @@
+describe BaseDecorator do
+  def escape(str)
+    # equivalent to what's used in templates
+    ERB::Util.html_escape(str)
+  end
+
+  describe '.combine_html' do
+    it "escapes content" do
+      output = BaseDecorator.combine_html(["<script>alert()</script>"])
+      expect(escape(output)).to eq("&lt;script&gt;alert()&lt;/script&gt;")
+    end
+  end
+end
Thanks for this test! It's unclear from the term `SafeBuffer` whether this was a buffer of safe entities or a buffer of entities which could be made safe. This test clears that up nicely.