sanitize 6.1.3 → 7.0.1

data/test/test_malicious_html.rb

@@ -1,339 +0,0 @@
-# encoding: utf-8
-require_relative 'common'
-
-# Miscellaneous attempts to sneak maliciously crafted HTML past Sanitize. Many
-# of these are courtesy of (or inspired by) the OWASP XSS Filter Evasion Cheat
-# Sheet.
-#
-# https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
-
-describe 'Malicious HTML' do
-  make_my_diffs_pretty!
-  parallelize_me!
-
-  before do
-    @s = Sanitize.new(Sanitize::Config::RELAXED)
-  end
-
-  describe 'comments' do
-    it 'should not allow script injection via conditional comments' do
-      _(@s.fragment(%[<!--[if gte IE 4]>\n<script>alert('XSS');</script>\n<![endif]-->])).
-        must_equal ''
-    end
-  end
-
-  describe 'interpolation (ERB, PHP, etc.)' do
-    it 'should escape ERB-style tags' do
-      _(@s.fragment('<% naughty_ruby_code %>')).
-        must_equal '&lt;% naughty_ruby_code %&gt;'
-
-      _(@s.fragment('<%= naughty_ruby_code %>')).
-        must_equal '&lt;%= naughty_ruby_code %&gt;'
-    end
-
-    it 'should remove PHP-style tags' do
-      _(@s.fragment('<? naughtyPHPCode(); ?>')).
-        must_equal ''
-
-      _(@s.fragment('<?= naughtyPHPCode(); ?>')).
-        must_equal ''
-    end
-  end
-
-  describe '<body>' do
-    it 'should not be possible to inject JS via a malformed event attribute' do
-      _(@s.document('<html><head></head><body onload!#$%&()*~+-_.,:;?@[/|\\]^`=alert("XSS")></body></html>')).
-        must_equal "<html><head></head><body></body></html>"
-    end
-  end
-
-  describe '<iframe>' do
-    it 'should not be possible to inject an iframe using an improperly closed tag' do
-      _(@s.fragment(%[<iframe src=http://ha.ckers.org/scriptlet.html <])).
-        must_equal ''
-    end
-  end
-
-  describe '<img>' do
-    it 'should not be possible to inject JS via an unquoted <img> src attribute' do
-      _(@s.fragment("<img src=javascript:alert('XSS')>")).must_equal '<img>'
-    end
-
-    it 'should not be possible to inject JS using grave accents as <img> src delimiters' do
-      _(@s.fragment("<img src=`javascript:alert('XSS')`>")).must_equal '<img>'
-    end
-
-    it 'should not be possible to inject <script> via a malformed <img> tag' do
-      _(@s.fragment('<img """><script>alert("XSS")</script>">')).
-        must_equal '<img>"&gt;'
-    end
-
-    it 'should not be possible to inject protocol-based JS' do
-      _(@s.fragment('<img src=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>')).
-        must_equal '<img>'
-
-      _(@s.fragment('<img src=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>')).
-        must_equal '<img>'
-
-      _(@s.fragment('<img src=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>')).
-        must_equal '<img>'
-
-      # Encoded tab character.
-      _(@s.fragment(%[<img src="jav&#x09;ascript:alert('XSS');">])).
-        must_equal '<img>'
-
-      # Encoded newline.
-      _(@s.fragment(%[<img src="jav&#x0A;ascript:alert('XSS');">])).
-        must_equal '<img>'
-
-      # Encoded carriage return.
-      _(@s.fragment(%[<img src="jav&#x0D;ascript:alert('XSS');">])).
-        must_equal '<img>'
-
-      # Null byte.
-      _(@s.fragment(%[<img src=java\0script:alert("XSS")>])).
-        must_equal '<img>'
-
-      # Spaces plus meta char.
-      _(@s.fragment(%[<img src=" &#14;  javascript:alert('XSS');">])).
-        must_equal '<img>'
-
-      # Mixed spaces and tabs.
-      _(@s.fragment(%[<img src="j\na v\tascript://alert('XSS');">])).
-        must_equal '<img>'
-    end
-
-    it 'should not be possible to inject protocol-based JS via whitespace' do
-      _(@s.fragment(%[<img src="jav\tascript:alert('XSS');">])).
-        must_equal '<img>'
-    end
-
-    it 'should not be possible to inject JS using a half-open <img> tag' do
-      _(@s.fragment(%[<img src="javascript:alert('XSS')"])).
-        must_equal ''
-    end
-  end
-
-  describe '<script>' do
-    it 'should not be possible to inject <script> using a malformed non-alphanumeric tag name' do
-      _(@s.fragment(%[<script/xss src="http://ha.ckers.org/xss.js">alert(1)</script>])).
-        must_equal ''
-    end
-
-    it 'should not be possible to inject <script> via extraneous open brackets' do
-      _(@s.fragment(%[<<script>alert("XSS");//<</script>])).
-        must_equal '&lt;'
-    end
-  end
-
-  # libxml2 >= 2.9.2 doesn't escape comments within some attributes, in an
-  # attempt to preserve server-side includes. This can result in XSS since an
-  # unescaped double quote can allow an attacker to inject a non-allowlisted
-  # attribute. Sanitize works around this by implementing its own escaping for
-  # affected attributes.
-  #
-  # The relevant libxml2 code is here:
-  # <https://github.com/GNOME/libxml2/commit/960f0e275616cadc29671a218d7fb9b69eb35588>
-  describe 'unsafe libxml2 server-side includes in attributes' do
-    using_unpatched_libxml2 = Nokogiri::VersionInfo.instance.libxml2_using_system?
-
-    tag_configs = [
-      {
-        tag_name: 'a',
-        escaped_attrs: %w[ action href src name ],
-        unescaped_attrs: []
-      },
-
-      {
-        tag_name: 'div',
-        escaped_attrs: %w[ action href src ],
-        unescaped_attrs: %w[ name ]
-      }
-    ]
-
-    before do
-      @s = Sanitize.new({
-        elements: %w[ a div ],
-
-        attributes: {
-          all: %w[ action href src name ]
-        }
-      })
-    end
-
-    tag_configs.each do |tag_config|
-      tag_name = tag_config[:tag_name]
-
-      tag_config[:escaped_attrs].each do |attr_name|
-        input = %[<#{tag_name} #{attr_name}='examp<!--" onmouseover=alert(1)>-->le.com'>foo</#{tag_name}>]
-
-        it 'should escape unsafe characters in attributes' do
-          skip "behavior should only exist in nokogiri's patched libxml" if using_unpatched_libxml2
-
-          # This uses Nokogumbo's HTML-compliant serializer rather than
-          # libxml2's.
-          _(@s.fragment(input)).
-            must_equal(%[<#{tag_name} #{attr_name}="examp<!--%22%20onmouseover=alert(1)>-->le.com">foo</#{tag_name}>])
-
-          # This uses the not-quite-standards-compliant libxml2 serializer via
-          # Nokogiri, so the output may be a little different as of Nokogiri
-          # 1.10.2 when using Nokogiri's vendored libxml2 due to this patch:
-          # https://github.com/sparklemotion/nokogiri/commit/4852e43cb6039e26d8c51af78621e539cbf46c5d
-          fragment = Nokogiri::HTML.fragment(input)
-          @s.node!(fragment)
-          _(fragment.to_html).
-            must_equal(%[<#{tag_name} #{attr_name}="examp&lt;!--%22%20onmouseover=alert(1)&gt;--&gt;le.com">foo</#{tag_name}>])
-        end
-
-        it 'should round-trip to the same output' do
-          output = @s.fragment(input)
-          _(@s.fragment(output)).must_equal(output)
-        end
-      end
-
-      tag_config[:unescaped_attrs].each do |attr_name|
-        input = %[<#{tag_name} #{attr_name}='examp<!--" onmouseover=alert(1)>-->le.com'>foo</#{tag_name}>]
-
-        it 'should not escape characters unnecessarily' do
-          skip "behavior should only exist in nokogiri's patched libxml" if using_unpatched_libxml2
-
-          # This uses Nokogumbo's HTML-compliant serializer rather than
-          # libxml2's.
-          _(@s.fragment(input)).
-            must_equal(%[<#{tag_name} #{attr_name}="examp<!--&quot; onmouseover=alert(1)>-->le.com">foo</#{tag_name}>])
-
-          # This uses the not-quite-standards-compliant libxml2 serializer via
-          # Nokogiri, so the output may be a little different as of Nokogiri
-          # 1.10.2 when using Nokogiri's vendored libxml2 due to this patch:
-          # https://github.com/sparklemotion/nokogiri/commit/4852e43cb6039e26d8c51af78621e539cbf46c5d
-          fragment = Nokogiri::HTML.fragment(input)
-          @s.node!(fragment)
-          _(fragment.to_html).
-            must_equal(%[<#{tag_name} #{attr_name}='examp&lt;!--" onmouseover=alert(1)&gt;--&gt;le.com'>foo</#{tag_name}>])
-        end
-
-        it 'should round-trip to the same output' do
-          output = @s.fragment(input)
-          _(@s.fragment(output)).must_equal(output)
-        end
-      end
-    end
-  end
-
-  # https://github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8m
-  describe 'foreign content bypass in relaxed config' do
-    it 'prevents a sanitization bypass via carefully crafted foreign content' do
-      %w[iframe noembed noframes noscript plaintext script style xmp].each do |tag_name|
-        _(@s.fragment(%[<math><#{tag_name}>/*&lt;/#{tag_name}&gt;&lt;img src onerror=alert(1)>*/])).
-          must_equal ''
-
-        _(@s.fragment(%[<svg><#{tag_name}>/*&lt;/#{tag_name}&gt;&lt;img src onerror=alert(1)>*/])).
-          must_equal ''
-      end
-    end
-  end
-
-  # These tests cover an unsupported and unsafe custom config that allows MathML
-  # and SVG elements, which Sanitize's docs specifically say multiple times in
-  # big prominent warnings that you SHOULD NOT DO because Sanitize doesn't
-  # support MathML or SVG.
-  #
-  # Do not use the custom configs you see in these tests! If you do, you may be
-  # creating XSS vulnerabilities in your application.
-  describe 'foreign content bypass in unsafe custom config that allows MathML or SVG' do
-    unescaped_content_elements = %w[
-      noembed
-      noframes
-      plaintext
-      script
-      xmp
-    ]
-
-    removed_content_elements = %w[
-      iframe
-    ]
-
-    removed_elements = %w[
-      noscript
-      style
-    ]
-
-    before do
-      @s = Sanitize.new(
-        Sanitize::Config.merge(
-          Sanitize::Config::RELAXED,
-          elements: Sanitize::Config::RELAXED[:elements] +
-            unescaped_content_elements +
-            removed_content_elements +
-            %w[math svg]
-        )
-      )
-    end
-
-    unescaped_content_elements.each do |name|
-      it "forcibly escapes text content inside `<#{name}>` in a MathML namespace" do
-        assert_equal(
-          "<math><#{name}>&lt;img src=x onerror=alert(1)&gt;</#{name}></math>",
-          @s.fragment("<math><#{name}>&lt;img src=x onerror=alert(1)&gt;</#{name}>")
-        )
-      end
-
-      it "forcibly escapes text content inside `<#{name}>` in an SVG namespace" do
-        assert_equal(
-          "<svg><#{name}>&lt;img src=x onerror=alert(1)&gt;</#{name}></svg>",
-          @s.fragment("<svg><#{name}>&lt;img src=x onerror=alert(1)&gt;</#{name}>")
-        )
-      end
-    end
-
-    removed_content_elements.each do |name|
-      it "removes text content inside `<#{name}>` in a MathML namespace" do
-        assert_equal(
-          "<math><#{name}></#{name}></math>",
-          @s.fragment("<math><#{name}>&lt;img src=x onerror=alert(1)&gt;</#{name}>")
-        )
-      end
-
-      it "removes text content inside `<#{name}>` in an SVG namespace" do
-        assert_equal(
-          "<svg><#{name}></#{name}></svg>",
-          @s.fragment("<svg><#{name}>&lt;img src=x onerror=alert(1)&gt;</#{name}>")
-        )
-      end
-    end
-
-    removed_elements.each do |name|
-      it "removes `<#{name}>` elements in a MathML namespace" do
-        assert_equal(
-          '<math></math>',
-          @s.fragment("<math><#{name}>&lt;img src=x onerror=alert(1)&gt;</#{name}>")
-        )
-      end
-
-      it "removes `<#{name}>` elements in an SVG namespace" do
-        assert_equal(
-          '<svg></svg>',
-          @s.fragment("<svg><#{name}>&lt;img src=x onerror=alert(1)&gt;</#{name}>")
-        )
-      end
-    end
-  end
-
-  describe 'sanitization bypass by exploiting scripting-disabled <noscript> behavior' do
-    before do
-      @s = Sanitize.new(
-        Sanitize::Config.merge(
-          Sanitize::Config::RELAXED,
-          elements: Sanitize::Config::RELAXED[:elements] + ['noscript']
-        )
-      )
-    end
-
-    it 'is prevented by removing `<noscript>` elements regardless of the allowlist' do
-      assert_equal(
-        '',
-        @s.fragment(%[<noscript><div id='</noscript>&lt;img src=x onerror=alert(1)&gt; '>])
-      )
-    end
-  end
-end

data/test/test_parser.rb

@@ -1,75 +0,0 @@
-# encoding: utf-8
-require_relative 'common'
-
-describe 'Parser' do
-  make_my_diffs_pretty!
-  parallelize_me!
-
-  it 'should translate valid entities into characters' do
-    _(Sanitize.fragment("'é&")).must_equal("'é&")
-  end
-
-  it 'should translate orphaned ampersands into entities' do
-    _(Sanitize.fragment('at&t')).must_equal('at&t')
-  end
-
-  it 'should not add newlines after tags when serializing a fragment' do
-    _(Sanitize.fragment("<div>foo\n\n<p>bar</p><div>\nbaz</div></div><div>quux</div>", :elements => ['div', 'p']))
-      .must_equal "<div>foo\n\n<p>bar</p><div>\nbaz</div></div><div>quux</div>"
-  end
-
-  it 'should not have the Nokogiri 1.4.2+ unterminated script/style element bug' do
-    _(Sanitize.fragment('foo <script>bar')).must_equal 'foo '
-    _(Sanitize.fragment('foo <style>bar')).must_equal 'foo '
-  end
-
-  it 'ambiguous non-tag brackets like "1 > 2 and 2 < 1" should be parsed correctly' do
-    _(Sanitize.fragment('1 > 2 and 2 < 1')).must_equal '1 &gt; 2 and 2 &lt; 1'
-    _(Sanitize.fragment('OMG HAPPY BIRTHDAY! *<:-D')).must_equal 'OMG HAPPY BIRTHDAY! *&lt;:-D'
-  end
-
-  describe 'when siblings are added after a node during traversal' do
-    it 'the added siblings should be traversed' do
-      html = %[
-        <div id="one">
-            <div id="one_one">
-                <div id="one_one_one"></div>
-            </div>
-            <div id="one_two"></div>
-        </div>
-        <div id="two">
-            <div id="two_one"><div id="two_one_one"></div></div>
-            <div id="two_two"></div>
-        </div>
-        <div id="three"></div>
-      ]
-
-      siblings = []
-
-      Sanitize.fragment(html, :transformers => ->(env) {
-          name = env[:node].name
-
-          if name == 'div'
-            env[:node].add_next_sibling('<b id="added_' + env[:node]['id'] + '">')
-          elsif name == 'b'
-            siblings << env[:node][:id]
-          end
-
-          return {:node_allowlist => [env[:node]]}
-      })
-
-      # All siblings should be traversed, and in the order added.
-      _(siblings).must_equal [
-        "added_one_one_one",
-        "added_one_one",
-        "added_one_two",
-        "added_one",
-        "added_two_one_one",
-        "added_two_one",
-        "added_two_two",
-        "added_two",
-        "added_three"
-      ]
-    end
-  end
-end

data/test/test_sanitize.rb

@@ -1,197 +0,0 @@
-# encoding: utf-8
-require_relative 'common'
-
-describe 'Sanitize' do
-  describe 'initializer' do
-    it 'should not modify a transformers array in the given config' do
-      transformers = [
-        lambda {}
-      ]
-
-      Sanitize.new({ :transformers => transformers })
-      _(transformers.length).must_equal(1)
-    end
-  end
-
-  describe 'instance methods' do
-    before do
-      @s = Sanitize.new
-    end
-
-    describe '#document' do
-      before do
-        @s = Sanitize.new(:elements => ['html'])
-      end
-
-      it 'should sanitize an HTML document' do
-        _(@s.document('<!doctype html><html><b>Lo<!-- comment -->rem</b> <a href="pants" title="foo">ipsum</a> <a href="http://foo.com/"><strong>dolor</strong></a> sit<br/>amet <script>alert("hello world");</script></html>'))
-          .must_equal "<html>Lorem ipsum dolor sit amet </html>"
-      end
-
-      it 'should not modify the input string' do
-        input = '<!DOCTYPE html><b>foo</b>'
-        @s.document(input)
-        _(input).must_equal('<!DOCTYPE html><b>foo</b>')
-      end
-
-      it 'should not choke on frozen documents' do
-        _(@s.document('<!doctype html><html><b>foo</b>'.freeze)).must_equal "<html>foo</html>"
-      end
-
-      it 'should normalize newlines' do
-        _(@s.document("a\r\n\n\r\r\r\nz")).must_equal "<html>a\n\n\n\n\nz</html>"
-      end
-
-      it 'should strip control characters (except ASCII whitespace)' do
-        sample_control_chars = "\u0001\u0008\u000b\u000e\u001f\u007f\u009f"
-        whitespace = "\t\n\f\u0020"
-        _(@s.document("a#{sample_control_chars}#{whitespace}z")).must_equal "<html>a#{whitespace}z</html>"
-      end
-
-      it 'should strip non-characters' do
-        sample_non_chars = "\ufdd0\ufdef\ufffe\uffff\u{1fffe}\u{1ffff}\u{2fffe}\u{2ffff}\u{3fffe}\u{3ffff}\u{4fffe}\u{4ffff}\u{5fffe}\u{5ffff}\u{6fffe}\u{6ffff}\u{7fffe}\u{7ffff}\u{8fffe}\u{8ffff}\u{9fffe}\u{9ffff}\u{afffe}\u{affff}\u{bfffe}\u{bffff}\u{cfffe}\u{cffff}\u{dfffe}\u{dffff}\u{efffe}\u{effff}\u{ffffe}\u{fffff}\u{10fffe}\u{10ffff}"
-        _(@s.document("a#{sample_non_chars}z")).must_equal "<html>az</html>"
-      end
-
-      describe 'when html body exceeds Nokogiri::Gumbo::DEFAULT_MAX_TREE_DEPTH' do
-        let(:content) do
-          content = nest_html_content('<b>foo</b>', Nokogiri::Gumbo::DEFAULT_MAX_TREE_DEPTH)
-          "<html>#{content}</html>"
-        end
-
-        it 'raises an ArgumentError exception' do
-          assert_raises ArgumentError do
-            @s.document(content)
-          end
-        end
-
-        describe 'and :max_tree_depth of -1 is supplied in :parser_options' do
-          before do
-            @s = Sanitize.new(elements: ['html'], parser_options: { max_tree_depth: -1 })
-          end
-
-          it 'does not raise an ArgumentError exception' do
-            _(@s.document(content)).must_equal '<html>foo</html>'
-          end
-        end
-      end
-    end
-
-    describe '#fragment' do
-      it 'should sanitize an HTML fragment' do
-        _(@s.fragment('<b>Lo<!-- comment -->rem</b> <a href="pants" title="foo">ipsum</a> <a href="http://foo.com/"><strong>dolor</strong></a> sit<br/>amet <script>alert("hello world");</script>'))
-          .must_equal 'Lorem ipsum dolor sit amet '
-      end
-
-      it 'should not modify the input string' do
-        input = '<b>foo</b>'
-        @s.fragment(input)
-        _(input).must_equal '<b>foo</b>'
-      end
-
-      it 'should not choke on fragments containing <html> or <body>' do
-        _(@s.fragment('<html><b>foo</b></html>')).must_equal 'foo'
-        _(@s.fragment('<body><b>foo</b></body>')).must_equal 'foo'
-        _(@s.fragment('<html><body><b>foo</b></body></html>')).must_equal 'foo'
-        _(@s.fragment('<!DOCTYPE html><html><body><b>foo</b></body></html>')).must_equal 'foo'
-      end
-
-      it 'should not choke on frozen fragments' do
-        _(@s.fragment('<b>foo</b>'.freeze)).must_equal 'foo'
-      end
-
-      it 'should normalize newlines' do
-        _(@s.fragment("a\r\n\n\r\r\r\nz")).must_equal "a\n\n\n\n\nz"
-      end
-
-      it 'should strip control characters (except ASCII whitespace)' do
-        sample_control_chars = "\u0001\u0008\u000b\u000e\u001f\u007f\u009f"
-        whitespace = "\t\n\f\u0020"
-        _(@s.fragment("a#{sample_control_chars}#{whitespace}z")).must_equal "a#{whitespace}z"
-      end
-
-      it 'should strip non-characters' do
-        sample_non_chars = "\ufdd0\ufdef\ufffe\uffff\u{1fffe}\u{1ffff}\u{2fffe}\u{2ffff}\u{3fffe}\u{3ffff}\u{4fffe}\u{4ffff}\u{5fffe}\u{5ffff}\u{6fffe}\u{6ffff}\u{7fffe}\u{7ffff}\u{8fffe}\u{8ffff}\u{9fffe}\u{9ffff}\u{afffe}\u{affff}\u{bfffe}\u{bffff}\u{cfffe}\u{cffff}\u{dfffe}\u{dffff}\u{efffe}\u{effff}\u{ffffe}\u{fffff}\u{10fffe}\u{10ffff}"
-        _(@s.fragment("a#{sample_non_chars}z")).must_equal "az"
-      end
-
-      describe 'when html body exceeds Nokogiri::Gumbo::DEFAULT_MAX_TREE_DEPTH' do
-        let(:content) do
-          content = nest_html_content('<b>foo</b>', Nokogiri::Gumbo::DEFAULT_MAX_TREE_DEPTH)
-          "<body>#{content}</body>"
-        end
-
-        it 'raises an ArgumentError exception' do
-          assert_raises ArgumentError do
-            @s.fragment(content)
-          end
-        end
-
-        describe 'and :max_tree_depth of -1 is supplied in :parser_options' do
-          before do
-            @s = Sanitize.new(parser_options: { max_tree_depth: -1 })
-          end
-
-          it 'does not raise an ArgumentError exception' do
-            _(@s.fragment(content)).must_equal 'foo'
-          end
-        end
-      end
-    end
-
-    describe '#node!' do
-      it 'should sanitize a Nokogiri::XML::Node' do
-        doc  = Nokogiri::HTML5.parse('<b>Lo<!-- comment -->rem</b> <a href="pants" title="foo">ipsum</a> <a href="http://foo.com/"><strong>dolor</strong></a> sit<br/>amet <script>alert("hello world");</script>')
-        frag = doc.fragment
-
-        doc.xpath('/html/body/node()').each {|node| frag << node }
-
-        @s.node!(frag)
-        _(frag.to_html).must_equal 'Lorem ipsum dolor sit amet '
-      end
-
-      describe "when the given node is a document and <html> isn't allowlisted" do
-        it 'should raise a Sanitize::Error' do
-          doc = Nokogiri::HTML5.parse('foo')
-          _(proc { @s.node!(doc) }).must_raise Sanitize::Error
-        end
-      end
-    end
-  end
-
-  describe 'class methods' do
-    describe '.document' do
-      it 'should sanitize an HTML document with the given config' do
-        html = '<!doctype html><html><b>Lo<!-- comment -->rem</b> <a href="pants" title="foo">ipsum</a> <a href="http://foo.com/"><strong>dolor</strong></a> sit<br/>amet <script>alert("hello world");</script></html>'
-        _(Sanitize.document(html, :elements => ['html']))
-          .must_equal "<html>Lorem ipsum dolor sit amet </html>"
-      end
-    end
-
-    describe '.fragment' do
-      it 'should sanitize an HTML fragment with the given config' do
-        html = '<b>Lo<!-- comment -->rem</b> <a href="pants" title="foo">ipsum</a> <a href="http://foo.com/"><strong>dolor</strong></a> sit<br/>amet <script>alert("hello world");</script>'
-        _(Sanitize.fragment(html, :elements => ['strong']))
-          .must_equal 'Lorem ipsum <strong>dolor</strong> sit amet '
-      end
-    end
-
-    describe '.node!' do
-      it 'should sanitize a Nokogiri::XML::Node with the given config' do
-        doc = Nokogiri::HTML5.parse('<b>Lo<!-- comment -->rem</b> <a href="pants" title="foo">ipsum</a> <a href="http://foo.com/"><strong>dolor</strong></a> sit<br/>amet <script>alert("hello world");</script>')
-        frag = doc.fragment
-
-        doc.xpath('/html/body/node()').each {|node| frag << node }
-
-        Sanitize.node!(frag, :elements => ['strong'])
-        _(frag.to_html).must_equal 'Lorem ipsum <strong>dolor</strong> sit amet '
-      end
-    end
-  end
-
-  private
-
-  def nest_html_content(html_content, depth)
-    "#{'<span>' * depth}#{html_content}#{'</span>' * depth}"
-  end
-end