Rails escaped the input. The XSS fired anyway.

A while back I was building a plain UTM-tracking feature on a large Rails + Vue app. Nothing exotic:...