sanitize 6.1.3 → 7.0.0

data/test/test_config.rb

@@ -1,7 +1,8 @@
-# encoding: utf-8
-require_relative 'common'
+# frozen_string_literal: true
 
-describe 'Config' do
+require_relative "common"
+
+describe "Config" do
   make_my_diffs_pretty!
   parallelize_me!
 
@@ -9,22 +10,22 @@ describe 'Config' do
     _(config).must_be :frozen?
 
     if Hash === config
-      config.each_value {|v| verify_deeply_frozen(v) }
+      config.each_value { |v| verify_deeply_frozen(v) }
     elsif Set === config || Array === config
-      config.each {|v| verify_deeply_frozen(v) }
+      config.each { |v| verify_deeply_frozen(v) }
     end
   end
 
-  it 'built-in configs should be deeply frozen' do
+  it "built-in configs should be deeply frozen" do
     verify_deeply_frozen Sanitize::Config::DEFAULT
     verify_deeply_frozen Sanitize::Config::BASIC
     verify_deeply_frozen Sanitize::Config::RELAXED
     verify_deeply_frozen Sanitize::Config::RESTRICTED
   end
 
-  describe '.freeze_config' do
-    it 'should deeply freeze and return a configuration Hash' do
-      a = {:one => {:one_one => [0, '1', :a], :one_two => false, :one_three => Set.new([:a, :b, :c])}}
+  describe ".freeze_config" do
+    it "should deeply freeze and return a configuration Hash" do
+      a = {one: {one_one: [0, "1", :a], one_two: false, one_three: Set.new([:a, :b, :c])}}
       b = Sanitize::Config.freeze_config(a)
 
       _(b).must_be_same_as a
@@ -32,11 +33,11 @@ describe 'Config' do
     end
   end
 
-  describe '.merge' do
-    it 'should deeply merge a configuration Hash' do
+  describe ".merge" do
+    it "should deeply merge a configuration Hash" do
       # Freeze to ensure that we get an error if either Hash is modified.
-      a = Sanitize::Config.freeze_config({:one => {:one_one => [0, '1', :a], :one_two => false, :one_three => Set.new([:a, :b, :c])}})
-      b = Sanitize::Config.freeze_config({:one => {:one_two => true, :one_three => 3}, :two => 2})
+      a = Sanitize::Config.freeze_config({one: {one_one: [0, "1", :a], one_two: false, one_three: Set.new([:a, :b, :c])}})
+      b = Sanitize::Config.freeze_config({one: {one_two: true, one_three: 3}, two: 2})
 
       c = Sanitize::Config.merge(a, b)
 
@@ -44,22 +45,22 @@ describe 'Config' do
       _(c).wont_be_same_as b
 
       _(c).must_equal(
-        :one => {
-          :one_one   => [0, '1', :a],
-          :one_two   => true,
-          :one_three => 3
+        one: {
+          one_one: [0, "1", :a],
+          one_two: true,
+          one_three: 3
         },
 
-        :two => 2
+        two: 2
       )
 
       _(c[:one]).wont_be_same_as a[:one]
       _(c[:one][:one_one]).wont_be_same_as a[:one][:one_one]
     end
 
-    it 'should raise an ArgumentError if either argument is not a Hash' do
-      _(proc { Sanitize::Config.merge('foo', {}) }).must_raise ArgumentError
-      _(proc { Sanitize::Config.merge({}, 'foo') }).must_raise ArgumentError
+    it "should raise an ArgumentError if either argument is not a Hash" do
+      _(proc { Sanitize::Config.merge("foo", {}) }).must_raise ArgumentError
+      _(proc { Sanitize::Config.merge({}, "foo") }).must_raise ArgumentError
     end
   end
 end

data/test/test_malicious_css.rb

@@ -1,5 +1,6 @@
-# encoding: utf-8
-require_relative 'common'
+# frozen_string_literal: true
+
+require_relative "common"
 
 # Miscellaneous attempts to sneak maliciously crafted CSS past Sanitize. Some of
 # these are courtesy of (or inspired by) the OWASP XSS Filter Evasion Cheat
@@ -7,7 +8,7 @@ require_relative 'common'
 #
 # https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
 
-describe 'Malicious CSS' do
+describe "Malicious CSS" do
   make_my_diffs_pretty!
   parallelize_me!
 
@@ -15,37 +16,37 @@ describe 'Malicious CSS' do
     @s = Sanitize::CSS.new(Sanitize::Config::RELAXED)
   end
 
-  it 'should not be possible to inject an expression by munging it with a comment' do
-    _(@s.properties(%[width:expr/*XSS*/ession(alert('XSS'))])).
-      must_equal ''
+  it "should not be possible to inject an expression by munging it with a comment" do
+    _(@s.properties(%[width:expr/*XSS*/ession(alert('XSS'))]))
+      .must_equal ""
 
-    _(@s.properties(%[width:ex/*XSS*//*/*/pression(alert("XSS"))])).
-      must_equal ''
+    _(@s.properties(%[width:ex/*XSS*//*/*/pression(alert("XSS"))]))
+      .must_equal ""
   end
 
-  it 'should not be possible to inject an expression by munging it with a newline' do
-    _(@s.properties(%[width:\nexpression(alert('XSS'));])).
-      must_equal ''
+  it "should not be possible to inject an expression by munging it with a newline" do
+    _(@s.properties(%[width:\nexpression(alert('XSS'));]))
+      .must_equal ""
   end
 
-  it 'should not allow the javascript protocol' do
-    _(@s.properties(%[background-image:url("javascript:alert('XSS')");])).
-      must_equal ''
+  it "should not allow the javascript protocol" do
+    _(@s.properties(%[background-image:url("javascript:alert('XSS')");]))
+      .must_equal ""
 
     _(Sanitize.fragment(%[<div style="background-image: url(&#1;javascript:alert('XSS'))">],
-      Sanitize::Config::RELAXED)).must_equal '<div></div>'
+      Sanitize::Config::RELAXED)).must_equal "<div></div>"
   end
 
-  it 'should not allow behaviors' do
-    _(@s.properties(%[behavior: url(xss.htc);])).must_equal ''
+  it "should not allow behaviors" do
+    _(@s.properties(%[behavior: url(xss.htc);])).must_equal ""
   end
 
-  describe 'sanitization bypass via CSS at-rule in HTML <style> element' do
+  describe "sanitization bypass via CSS at-rule in HTML <style> element" do
     before do
       @s = Sanitize.new(Sanitize::Config::RELAXED)
     end
 
-    it 'is not possible to prematurely end a <style> element' do
+    it "is not possible to prematurely end a <style> element" do
       assert_equal(
         %[<style>@media<\\/style><iframe srcdoc='<script>alert(document.domain)<\\/script>'>{}</style>],
         @s.fragment(%[<style>@media</sty/**/le><iframe srcdoc='<script>alert(document.domain)</script>'></style>])

data/test/test_malicious_html.rb

@@ -1,5 +1,6 @@
-# encoding: utf-8
-require_relative 'common'
+# frozen_string_literal: true
+
+require_relative "common"
 
 # Miscellaneous attempts to sneak maliciously crafted HTML past Sanitize. Many
 # of these are courtesy of (or inspired by) the OWASP XSS Filter Evasion Cheat
@@ -7,7 +8,7 @@ require_relative 'common'
 #
 # https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
 
-describe 'Malicious HTML' do
+describe "Malicious HTML" do
   make_my_diffs_pretty!
   parallelize_me!
 
@@ -15,114 +16,114 @@ describe 'Malicious HTML' do
     @s = Sanitize.new(Sanitize::Config::RELAXED)
   end
 
-  describe 'comments' do
-    it 'should not allow script injection via conditional comments' do
-      _(@s.fragment(%[<!--[if gte IE 4]>\n<script>alert('XSS');</script>\n<![endif]-->])).
-        must_equal ''
+  describe "comments" do
+    it "should not allow script injection via conditional comments" do
+      _(@s.fragment(%[<!--[if gte IE 4]>\n<script>alert('XSS');</script>\n<![endif]-->]))
+        .must_equal ""
     end
   end
 
-  describe 'interpolation (ERB, PHP, etc.)' do
-    it 'should escape ERB-style tags' do
-      _(@s.fragment('<% naughty_ruby_code %>')).
-        must_equal '&lt;% naughty_ruby_code %&gt;'
+  describe "interpolation (ERB, PHP, etc.)" do
+    it "should escape ERB-style tags" do
+      _(@s.fragment("<% naughty_ruby_code %>"))
+        .must_equal "&lt;% naughty_ruby_code %&gt;"
 
-      _(@s.fragment('<%= naughty_ruby_code %>')).
-        must_equal '&lt;%= naughty_ruby_code %&gt;'
+      _(@s.fragment("<%= naughty_ruby_code %>"))
+        .must_equal "&lt;%= naughty_ruby_code %&gt;"
     end
 
-    it 'should remove PHP-style tags' do
-      _(@s.fragment('<? naughtyPHPCode(); ?>')).
-        must_equal ''
+    it "should remove PHP-style tags" do
+      _(@s.fragment("<? naughtyPHPCode(); ?>"))
+        .must_equal ""
 
-      _(@s.fragment('<?= naughtyPHPCode(); ?>')).
-        must_equal ''
+      _(@s.fragment("<?= naughtyPHPCode(); ?>"))
+        .must_equal ""
     end
   end
 
-  describe '<body>' do
-    it 'should not be possible to inject JS via a malformed event attribute' do
-      _(@s.document('<html><head></head><body onload!#$%&()*~+-_.,:;?@[/|\\]^`=alert("XSS")></body></html>')).
-        must_equal "<html><head></head><body></body></html>"
+  describe "<body>" do
+    it "should not be possible to inject JS via a malformed event attribute" do
+      _(@s.document('<html><head></head><body onload!#$%&()*~+-_.,:;?@[/|\\]^`=alert("XSS")></body></html>'))
+        .must_equal "<html><head></head><body></body></html>"
     end
   end
 
-  describe '<iframe>' do
-    it 'should not be possible to inject an iframe using an improperly closed tag' do
-      _(@s.fragment(%[<iframe src=http://ha.ckers.org/scriptlet.html <])).
-        must_equal ''
+  describe "<iframe>" do
+    it "should not be possible to inject an iframe using an improperly closed tag" do
+      _(@s.fragment(%(<iframe src=http://ha.ckers.org/scriptlet.html <)))
+        .must_equal ""
     end
   end
 
-  describe '<img>' do
-    it 'should not be possible to inject JS via an unquoted <img> src attribute' do
-      _(@s.fragment("<img src=javascript:alert('XSS')>")).must_equal '<img>'
+  describe "<img>" do
+    it "should not be possible to inject JS via an unquoted <img> src attribute" do
+      _(@s.fragment("<img src=javascript:alert('XSS')>")).must_equal "<img>"
     end
 
-    it 'should not be possible to inject JS using grave accents as <img> src delimiters' do
-      _(@s.fragment("<img src=`javascript:alert('XSS')`>")).must_equal '<img>'
+    it "should not be possible to inject JS using grave accents as <img> src delimiters" do
+      _(@s.fragment("<img src=`javascript:alert('XSS')`>")).must_equal "<img>"
     end
 
-    it 'should not be possible to inject <script> via a malformed <img> tag' do
-      _(@s.fragment('<img """><script>alert("XSS")</script>">')).
-        must_equal '<img>"&gt;'
+    it "should not be possible to inject <script> via a malformed <img> tag" do
+      _(@s.fragment('<img """><script>alert("XSS")</script>">'))
+        .must_equal '<img>"&gt;'
     end
 
-    it 'should not be possible to inject protocol-based JS' do
-      _(@s.fragment('<img src=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>')).
-        must_equal '<img>'
+    it "should not be possible to inject protocol-based JS" do
+      _(@s.fragment("<img src=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>"))
+        .must_equal "<img>"
 
-      _(@s.fragment('<img src=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>')).
-        must_equal '<img>'
+      _(@s.fragment("<img src=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>"))
+        .must_equal "<img>"
 
-      _(@s.fragment('<img src=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>')).
-        must_equal '<img>'
+      _(@s.fragment("<img src=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>"))
+        .must_equal "<img>"
 
       # Encoded tab character.
-      _(@s.fragment(%[<img src="jav&#x09;ascript:alert('XSS');">])).
-        must_equal '<img>'
+      _(@s.fragment(%[<img src="jav&#x09;ascript:alert('XSS');">]))
+        .must_equal "<img>"
 
       # Encoded newline.
-      _(@s.fragment(%[<img src="jav&#x0A;ascript:alert('XSS');">])).
-        must_equal '<img>'
+      _(@s.fragment(%[<img src="jav&#x0A;ascript:alert('XSS');">]))
+        .must_equal "<img>"
 
       # Encoded carriage return.
-      _(@s.fragment(%[<img src="jav&#x0D;ascript:alert('XSS');">])).
-        must_equal '<img>'
+      _(@s.fragment(%[<img src="jav&#x0D;ascript:alert('XSS');">]))
+        .must_equal "<img>"
 
       # Null byte.
-      _(@s.fragment(%[<img src=java\0script:alert("XSS")>])).
-        must_equal '<img>'
+      _(@s.fragment(%[<img src=java\0script:alert("XSS")>]))
+        .must_equal "<img>"
 
       # Spaces plus meta char.
-      _(@s.fragment(%[<img src=" &#14;  javascript:alert('XSS');">])).
-        must_equal '<img>'
+      _(@s.fragment(%[<img src=" &#14;  javascript:alert('XSS');">]))
+        .must_equal "<img>"
 
       # Mixed spaces and tabs.
-      _(@s.fragment(%[<img src="j\na v\tascript://alert('XSS');">])).
-        must_equal '<img>'
+      _(@s.fragment(%[<img src="j\na v\tascript://alert('XSS');">]))
+        .must_equal "<img>"
     end
 
-    it 'should not be possible to inject protocol-based JS via whitespace' do
-      _(@s.fragment(%[<img src="jav\tascript:alert('XSS');">])).
-        must_equal '<img>'
+    it "should not be possible to inject protocol-based JS via whitespace" do
+      _(@s.fragment(%[<img src="jav\tascript:alert('XSS');">]))
+        .must_equal "<img>"
     end
 
-    it 'should not be possible to inject JS using a half-open <img> tag' do
-      _(@s.fragment(%[<img src="javascript:alert('XSS')"])).
-        must_equal ''
+    it "should not be possible to inject JS using a half-open <img> tag" do
+      _(@s.fragment(%[<img src="javascript:alert('XSS')"]))
+        .must_equal ""
     end
   end
 
-  describe '<script>' do
-    it 'should not be possible to inject <script> using a malformed non-alphanumeric tag name' do
-      _(@s.fragment(%[<script/xss src="http://ha.ckers.org/xss.js">alert(1)</script>])).
-        must_equal ''
+  describe "<script>" do
+    it "should not be possible to inject <script> using a malformed non-alphanumeric tag name" do
+      _(@s.fragment(%[<script/xss src="http://ha.ckers.org/xss.js">alert(1)</script>]))
+        .must_equal ""
     end
 
-    it 'should not be possible to inject <script> via extraneous open brackets' do
-      _(@s.fragment(%[<<script>alert("XSS");//<</script>])).
-        must_equal '&lt;'
+    it "should not be possible to inject <script> via extraneous open brackets" do
+      _(@s.fragment(%[<<script>alert("XSS");//<</script>]))
+        .must_equal "&lt;"
     end
   end
 
@@ -134,29 +135,29 @@ describe 'Malicious HTML' do
   #
   # The relevant libxml2 code is here:
   # <https://github.com/GNOME/libxml2/commit/960f0e275616cadc29671a218d7fb9b69eb35588>
-  describe 'unsafe libxml2 server-side includes in attributes' do
+  describe "unsafe libxml2 server-side includes in attributes" do
     using_unpatched_libxml2 = Nokogiri::VersionInfo.instance.libxml2_using_system?
 
     tag_configs = [
       {
-        tag_name: 'a',
-        escaped_attrs: %w[ action href src name ],
+        tag_name: "a",
+        escaped_attrs: %w[action href src name],
         unescaped_attrs: []
       },
 
       {
-        tag_name: 'div',
-        escaped_attrs: %w[ action href src ],
-        unescaped_attrs: %w[ name ]
+        tag_name: "div",
+        escaped_attrs: %w[action href src],
+        unescaped_attrs: %w[name]
       }
     ]
 
     before do
       @s = Sanitize.new({
-        elements: %w[ a div ],
+        elements: %w[a div],
 
         attributes: {
-          all: %w[ action href src name ]
+          all: %w[action href src name]
         }
       })
     end
@@ -167,13 +168,13 @@ describe 'Malicious HTML' do
       tag_config[:escaped_attrs].each do |attr_name|
         input = %[<#{tag_name} #{attr_name}='examp<!--" onmouseover=alert(1)>-->le.com'>foo</#{tag_name}>]
 
-        it 'should escape unsafe characters in attributes' do
+        it "should escape unsafe characters in attributes" do
           skip "behavior should only exist in nokogiri's patched libxml" if using_unpatched_libxml2
 
           # This uses Nokogumbo's HTML-compliant serializer rather than
           # libxml2's.
-          _(@s.fragment(input)).
-            must_equal(%[<#{tag_name} #{attr_name}="examp<!--%22%20onmouseover=alert(1)>-->le.com">foo</#{tag_name}>])
+          _(@s.fragment(input))
+            .must_equal(%[<#{tag_name} #{attr_name}="examp<!--%22%20onmouseover=alert(1)>-->le.com">foo</#{tag_name}>])
 
           # This uses the not-quite-standards-compliant libxml2 serializer via
           # Nokogiri, so the output may be a little different as of Nokogiri
@@ -181,11 +182,11 @@ describe 'Malicious HTML' do
           # https://github.com/sparklemotion/nokogiri/commit/4852e43cb6039e26d8c51af78621e539cbf46c5d
           fragment = Nokogiri::HTML.fragment(input)
           @s.node!(fragment)
-          _(fragment.to_html).
-            must_equal(%[<#{tag_name} #{attr_name}="examp&lt;!--%22%20onmouseover=alert(1)&gt;--&gt;le.com">foo</#{tag_name}>])
+          _(fragment.to_html)
+            .must_equal(%[<#{tag_name} #{attr_name}="examp&lt;!--%22%20onmouseover=alert(1)&gt;--&gt;le.com">foo</#{tag_name}>])
         end
 
-        it 'should round-trip to the same output' do
+        it "should round-trip to the same output" do
           output = @s.fragment(input)
           _(@s.fragment(output)).must_equal(output)
         end
@@ -194,13 +195,13 @@ describe 'Malicious HTML' do
       tag_config[:unescaped_attrs].each do |attr_name|
         input = %[<#{tag_name} #{attr_name}='examp<!--" onmouseover=alert(1)>-->le.com'>foo</#{tag_name}>]
 
-        it 'should not escape characters unnecessarily' do
+        it "should not escape characters unnecessarily" do
           skip "behavior should only exist in nokogiri's patched libxml" if using_unpatched_libxml2
 
           # This uses Nokogumbo's HTML-compliant serializer rather than
           # libxml2's.
-          _(@s.fragment(input)).
-            must_equal(%[<#{tag_name} #{attr_name}="examp<!--&quot; onmouseover=alert(1)>-->le.com">foo</#{tag_name}>])
+          _(@s.fragment(input))
+            .must_equal(%[<#{tag_name} #{attr_name}="examp<!--&quot; onmouseover=alert(1)>-->le.com">foo</#{tag_name}>])
 
           # This uses the not-quite-standards-compliant libxml2 serializer via
           # Nokogiri, so the output may be a little different as of Nokogiri
@@ -208,11 +209,11 @@ describe 'Malicious HTML' do
           # https://github.com/sparklemotion/nokogiri/commit/4852e43cb6039e26d8c51af78621e539cbf46c5d
           fragment = Nokogiri::HTML.fragment(input)
           @s.node!(fragment)
-          _(fragment.to_html).
-            must_equal(%[<#{tag_name} #{attr_name}='examp&lt;!--" onmouseover=alert(1)&gt;--&gt;le.com'>foo</#{tag_name}>])
+          _(fragment.to_html)
+            .must_equal(%[<#{tag_name} #{attr_name}='examp&lt;!--" onmouseover=alert(1)&gt;--&gt;le.com'>foo</#{tag_name}>])
         end
 
-        it 'should round-trip to the same output' do
+        it "should round-trip to the same output" do
           output = @s.fragment(input)
           _(@s.fragment(output)).must_equal(output)
         end
@@ -221,14 +222,14 @@ describe 'Malicious HTML' do
   end
 
   # https://github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8m
-  describe 'foreign content bypass in relaxed config' do
-    it 'prevents a sanitization bypass via carefully crafted foreign content' do
+  describe "foreign content bypass in relaxed config" do
+    it "prevents a sanitization bypass via carefully crafted foreign content" do
       %w[iframe noembed noframes noscript plaintext script style xmp].each do |tag_name|
-        _(@s.fragment(%[<math><#{tag_name}>/*&lt;/#{tag_name}&gt;&lt;img src onerror=alert(1)>*/])).
-          must_equal ''
+        _(@s.fragment(%[<math><#{tag_name}>/*&lt;/#{tag_name}&gt;&lt;img src onerror=alert(1)>*/]))
+          .must_equal ""
 
-        _(@s.fragment(%[<svg><#{tag_name}>/*&lt;/#{tag_name}&gt;&lt;img src onerror=alert(1)>*/])).
-          must_equal ''
+        _(@s.fragment(%[<svg><#{tag_name}>/*&lt;/#{tag_name}&gt;&lt;img src onerror=alert(1)>*/]))
+          .must_equal ""
       end
     end
   end
@@ -240,7 +241,7 @@ describe 'Malicious HTML' do
   #
   # Do not use the custom configs you see in these tests! If you do, you may be
   # creating XSS vulnerabilities in your application.
-  describe 'foreign content bypass in unsafe custom config that allows MathML or SVG' do
+  describe "foreign content bypass in unsafe custom config that allows MathML or SVG" do
     unescaped_content_elements = %w[
       noembed
       noframes
@@ -305,33 +306,33 @@ describe 'Malicious HTML' do
     removed_elements.each do |name|
       it "removes `<#{name}>` elements in a MathML namespace" do
         assert_equal(
-          '<math></math>',
+          "<math></math>",
           @s.fragment("<math><#{name}>&lt;img src=x onerror=alert(1)&gt;</#{name}>")
         )
       end
 
       it "removes `<#{name}>` elements in an SVG namespace" do
         assert_equal(
-          '<svg></svg>',
+          "<svg></svg>",
           @s.fragment("<svg><#{name}>&lt;img src=x onerror=alert(1)&gt;</#{name}>")
         )
       end
     end
   end
 
-  describe 'sanitization bypass by exploiting scripting-disabled <noscript> behavior' do
+  describe "sanitization bypass by exploiting scripting-disabled <noscript> behavior" do
     before do
       @s = Sanitize.new(
         Sanitize::Config.merge(
           Sanitize::Config::RELAXED,
-          elements: Sanitize::Config::RELAXED[:elements] + ['noscript']
+          elements: Sanitize::Config::RELAXED[:elements] + ["noscript"]
         )
       )
     end
 
-    it 'is prevented by removing `<noscript>` elements regardless of the allowlist' do
+    it "is prevented by removing `<noscript>` elements regardless of the allowlist" do
       assert_equal(
-        '',
+        "",
         @s.fragment(%[<noscript><div id='</noscript>&lt;img src=x onerror=alert(1)&gt; '>])
       )
     end

data/test/test_parser.rb

@@ -1,36 +1,37 @@
-# encoding: utf-8
-require_relative 'common'
+# frozen_string_literal: true
 
-describe 'Parser' do
+require_relative "common"
+
+describe "Parser" do
   make_my_diffs_pretty!
   parallelize_me!
 
-  it 'should translate valid entities into characters' do
+  it "should translate valid entities into characters" do
     _(Sanitize.fragment("'é&")).must_equal("'é&")
   end
 
-  it 'should translate orphaned ampersands into entities' do
-    _(Sanitize.fragment('at&t')).must_equal('at&t')
+  it "should translate orphaned ampersands into entities" do
+    _(Sanitize.fragment("at&t")).must_equal("at&t")
   end
 
-  it 'should not add newlines after tags when serializing a fragment' do
-    _(Sanitize.fragment("<div>foo\n\n<p>bar</p><div>\nbaz</div></div><div>quux</div>", :elements => ['div', 'p']))
+  it "should not add newlines after tags when serializing a fragment" do
+    _(Sanitize.fragment("<div>foo\n\n<p>bar</p><div>\nbaz</div></div><div>quux</div>", elements: ["div", "p"]))
       .must_equal "<div>foo\n\n<p>bar</p><div>\nbaz</div></div><div>quux</div>"
   end
 
-  it 'should not have the Nokogiri 1.4.2+ unterminated script/style element bug' do
-    _(Sanitize.fragment('foo <script>bar')).must_equal 'foo '
-    _(Sanitize.fragment('foo <style>bar')).must_equal 'foo '
+  it "should not have the Nokogiri 1.4.2+ unterminated script/style element bug" do
+    _(Sanitize.fragment("foo <script>bar")).must_equal "foo "
+    _(Sanitize.fragment("foo <style>bar")).must_equal "foo "
   end
 
   it 'ambiguous non-tag brackets like "1 > 2 and 2 < 1" should be parsed correctly' do
-    _(Sanitize.fragment('1 > 2 and 2 < 1')).must_equal '1 &gt; 2 and 2 &lt; 1'
-    _(Sanitize.fragment('OMG HAPPY BIRTHDAY! *<:-D')).must_equal 'OMG HAPPY BIRTHDAY! *&lt;:-D'
+    _(Sanitize.fragment("1 > 2 and 2 < 1")).must_equal "1 &gt; 2 and 2 &lt; 1"
+    _(Sanitize.fragment("OMG HAPPY BIRTHDAY! *<:-D")).must_equal "OMG HAPPY BIRTHDAY! *&lt;:-D"
   end
 
-  describe 'when siblings are added after a node during traversal' do
-    it 'the added siblings should be traversed' do
-      html = %[
+  describe "when siblings are added after a node during traversal" do
+    it "the added siblings should be traversed" do
+      html = %(
         <div id="one">
             <div id="one_one">
                 <div id="one_one_one"></div>
@@ -42,20 +43,20 @@ describe 'Parser' do
             <div id="two_two"></div>
         </div>
         <div id="three"></div>
-      ]
+      )
 
       siblings = []
 
-      Sanitize.fragment(html, :transformers => ->(env) {
-          name = env[:node].name
+      Sanitize.fragment(html, transformers: ->(env) {
+        name = env[:node].name
 
-          if name == 'div'
-            env[:node].add_next_sibling('<b id="added_' + env[:node]['id'] + '">')
-          elsif name == 'b'
-            siblings << env[:node][:id]
-          end
+        if name == "div"
+          env[:node].add_next_sibling('<b id="added_' + env[:node]["id"] + '">')
+        elsif name == "b"
+          siblings << env[:node][:id]
+        end
 
-          return {:node_allowlist => [env[:node]]}
+        {node_allowlist: [env[:node]]}
       })
 
       # All siblings should be traversed, and in the order added.