title: Rails render behavior, passing and evaling a variable, is it safe?
body: <p>I have a view with a lot of equal items that only change the item name, to keep DRY I've refactored this into a partial. My question is, if I send the <code>type_oil</code>, a string variable to the partial, then eval it <code>eval("#{type_oil}_path")</code> will it be exposed in any way to the public? Could this be a security issue?</p>
  
  <p>views/controller_name/oils.html.haml</p>
  
  <pre><code>#oils-content
    -# oils_list is a list of strings
    - oils_list.each do |oil|
      = render "controller_name/oils_item" , type_oil: oil
  </code></pre>
  
  <p>views/controller_name/_oils_item.html.haml</p>
  
  <pre><code>.item
    %h2= t("oils.#{type_oil}.front_header")
    %p= t("oils.#{type_oil}.front_body")
    = link_to t("oils.#{type_oil}.link"),  eval("#{type_oil}_path")
  </code></pre>