Unsafe default translations should not be marked html_safe

Previously default translation keys that didn't end in `_html`, but came
after a missing key that ended in `_html` were being returned as
html_safe. Now they are not. Fixes #18257

actionview/CHANGELOG.md

@@ -1,3 +1,8 @@
+*   Default translations that have a lower precidence than an html safe default,
+    but are not themselves safe, should not be marked as html_safe.
+
+    *Justin Coyne*
+
 *   Make possible to use blocks with short version of `render "partial"` helper.
 
     *Nikolay Shebanov*

actionview/lib/action_view/helpers/translation_helper.rb

@@ -37,7 +37,8 @@ module ActionView
       # you know what kind of output to expect when you call translate in a template.
       def translate(key, options = {})
         options = options.dup
-        options[:default] = wrap_translate_defaults(options[:default]) if options[:default]
+        remaining_defaults = Array(options.delete(:default))
+        options[:default] = remaining_defaults.shift if remaining_defaults.first.kind_of? String
 
         # If the user has specified rescue_format then pass it all through, otherwise use
         # raise and do the work ourselves
@@ -62,10 +63,14 @@ module ActionView
           I18n.translate(scope_key_by_partial(key), options)
         end
       rescue I18n::MissingTranslationData => e
-        raise e if raise_error
+        if remaining_defaults.present?
+          translate remaining_defaults.shift, options.merge(default: remaining_defaults)
+        else
+          raise e if raise_error
 
-        keys = I18n.normalize_keys(e.locale, e.key, e.options[:scope])
-        content_tag('span', keys.last.to_s.titleize, :class => 'translation_missing', :title => "translation missing: #{keys.join('.')}")
+          keys = I18n.normalize_keys(e.locale, e.key, e.options[:scope])
+          content_tag('span', keys.last.to_s.titleize, :class => 'translation_missing', :title => "translation missing: #{keys.join('.')}")
+        end
       end
       alias :t :translate
 
@@ -94,21 +99,6 @@ module ActionView
         def html_safe_translation_key?(key)
           key.to_s =~ /(\b|_|\.)html$/
         end
-
-        def wrap_translate_defaults(defaults)
-          new_defaults = []
-          defaults     = Array(defaults)
-          while key = defaults.shift
-            if key.is_a?(Symbol)
-              new_defaults << lambda { |_, options| translate key, options.merge(:default => defaults) }
-              break
-            else
-              new_defaults << key
-            end
-          end
-
-          new_defaults
-        end
     end
   end
 end

actionview/test/template/translation_helper_test.rb

@@ -145,6 +145,12 @@ class TranslationHelperTest < ActiveSupport::TestCase
     assert_equal true, translation.html_safe?
   end
 
+  def test_translate_with_last_default_not_named_html
+    translation = translate(:'translations.missing', :default => [:'translations.missing_html', :'translations.foo'])
+    assert_equal 'Foo', translation
+    assert_equal false, translation.html_safe?
+  end
+
   def test_translate_with_string_default
     translation = translate(:'translations.missing', default: 'A Generic String')
     assert_equal 'A Generic String', translation