templates: use safe md5 for str template rendering

rhodecode/templates/base/base.mako

@@ -189,7 +189,7 b''
               ${val}
           %endif
           %if show_items:
-              <div class="collapsable-content" data-toggle="item-${h.md5_safe(val)[:6]}-details" style="display: none">
+              <div class="collapsable-content" data-toggle="item-${h.md5_safe(h.safe_str(val))[:6]}-details" style="display: none">
               % for item in show_items:
                   <dt></dt>
                   <dd>${item}</dd>
@@ -199,7 +199,7 b''
         </td>
         <td style="vertical-align: top">
           %if show_items:
-              <span class="btn-collapse" data-toggle="item-${h.md5_safe(val)[:6]}-details">${_('Show More')} </span>
+              <span class="btn-collapse" data-toggle="item-${h.md5_safe(h.safe_str(val))[:6]}-details">${_('Show More')} </span>
           %endif
         </td>
     </tr>

rhodecode/templates/codeblocks/diffs.mako

@@ -59,7 +59,7 b" return '%s_%s_%i' % (h.md5_safe(commit+f"
 )">
 
 <%
-    diffset_container_id = h.md5(diffset.target_ref)
+    diffset_container_id = h.md5_safe(diffset.target_ref)
     collapse_all = len(diffset.files) > collapse_when_files_over
     active_pattern_entries = h.get_active_pattern_entries(getattr(c, 'repo_name', None))
     from rhodecode.lib.diffs import NEW_FILENODE, DEL_FILENODE, \
@@ -909,7 +909,7 b' def get_comments_for(diff_type, comments'
 </%def>
 
 <%def name="render_diffset_menu(diffset, range_diff_on=None, commit=None, pull_request_menu=None)">
-    <% diffset_container_id = h.md5(diffset.target_ref) %>
+    <% diffset_container_id = h.md5_safe(diffset.target_ref) %>
 
     <div id="diff-file-sticky" class="diffset-menu clearinner">
         ## auto adjustable