sanitize 7.0.0 → 7.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c7ec07b16780ba818a5fdbb0570fb6c84245c60b2656388cab0b03b0d00bbc6a
-  data.tar.gz: 650c2a0c59fd4af1d305051e5488bcacee3f5a638a96960163f6677b838a9661
+  metadata.gz: 694fdddd1e40857325f7fac61ee5679e6a9fca926413c1b035062ab7449b92c7
+  data.tar.gz: 426f1b4ece2fe0514139b661ba77ca7b9a6196481a0759a3ac81a9f446996e3d
 SHA512:
-  metadata.gz: ec33f841766422dda2ee1d889d2e3f42f6b3b479c2cf557cad80de0311969a4e132e02a5a33dda296af2e2a5fec8791aa6ba8eacd6ea370428cc40ff3f08a720
-  data.tar.gz: f4cf669dba8e416c38fb4b9eae30b86e9c7816718e80cc32eac1f536f1e2023c59cb74df7e701af717a157e1fe1ccc902a89b26992488a85400e4dc0c089d07a
+  metadata.gz: 3e58a303bb8a1285fbc75ab93acfd896444dc125d3b9b13884868366720bc451e5c69409b9a852014394604bc932e0ffbeeb7c1b7192eb3cd0a673ec10a79df2
+  data.tar.gz: 8a4b8ca81da4bc4bb070941fab4b08f8e6d36a10487d0d90820e762155fe5717acfbc919c2676650d490cd7d9cac82f7a2f4ec21bc0f373f837938a23a670d6d

data/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 All notable changes to Sanitize are documented in this file. The format (since version 7.0.0) is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 7.0.1 (2026-10-21)
+
+### Security
+
+- CSS properties that contain a `{}` block anywhere in their value are now removed. Browsers that support [CSS nesting](https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_nesting) reparse an invalid declaration containing a `{}` block as a nested style rule, so a value like `color:hover{position:fixed}` could previously be used to smuggle disallowed properties and URLs past Sanitize in a stylesheet or `<style>` element. (GHSA-wgw9-qhqg-8hv5)
+
+- The contents of at-rules such as `@media` and `@supports` that appear in a list of declarations (inside a style rule, inside an at-rule like `@font-face`, or in CSS sanitized with `Sanitize::CSS.properties`) are now sanitized as declarations rather than as rules, matching how browsers that support CSS nesting parse them. Previously, a stylesheet like `p{@media all{position:fixed;a{}}}` could be used to smuggle disallowed properties and URLs past Sanitize, since Sanitize treated `position:fixed;a` as a style rule's selector. The same was true of CSS sanitized with `Sanitize::CSS.properties` if the result was later embedded in a style rule. Style rules nested inside these at-rules are now removed, just as style rules nested directly inside other style rules already were. (GHSA-wgw9-qhqg-8hv5)
+
+- CSS properties, style rules, and at-rules that contain blocks or functions nested more deeply than Crass's maximum nesting depth (25 levels by default) are now removed. (GHSA-wgw9-qhqg-8hv5)
+
+- Hardened CSS sanitization against tokenizer differentials involving bad URLs. CSS properties that contain a bad URL anywhere inside a simple block (such as `[...]` or `(...)`) are now removed, as are style rules whose selectors contain a bad URL and at-rules whose preludes contain a bad URL. URLs inside simple blocks are now also validated against the configured protocol allowlist. Previously, a bug in Crass (fixed in Crass 1.0.8) could be exploited to smuggle CSS declarations, rules, or at-rules past Sanitize by hiding them in a bad URL in one of these locations.
+
+- CSS style rules whose selectors contain a semicolon are now removed, as a defense in depth measure. A semicolon is never valid in a selector, but when a style rule appears where a browser that supports CSS nesting expects declarations, the browser treats everything before the semicolon as a declaration. This could be used to smuggle disallowed properties past `Sanitize::CSS.tree!` when it was given a list of declarations rather than a list of rules (though this isn't something Sanitize itself does).
+
+### Fixed
+
+- Removed an unused `require "cgi"` that caused a warning on Ruby 4.0, since the CGI library is no longer part of Ruby's standard library.
+
 ## 7.0.0 (2024-12-29)
 
 Sanitize has no breaking API changes in this release, but the major version number has been incremented because we've dropped support for end-of-life versions of Ruby. As long as you're using Ruby 3.1.0 or later, this should be a painless upgrade!

data/README.md

@@ -12,10 +12,16 @@ Sanitize is based on the [Nokogiri HTML5 parser][nokogiri], which parses HTML th
 [crass]:https://github.com/rgrove/crass
 [nokogiri]:https://github.com/sparklemotion/nokogiri
 
+> [!WARNING]
+>
+> Sanitize cannot fully sanitize the contents of `<math>` or `<svg>` elements. MathML and SVG elements are [foreign elements](https://html.spec.whatwg.org/multipage/syntax.html#foreign-elements) that don't follow normal HTML parsing rules.
+>
+> By default, Sanitize will remove all MathML and SVG elements. If you add MathML or SVG elements to a custom element allowlist, you may create a security vulnerability in your application.
+
 ## Links
 
 * [Home](https://github.com/rgrove/sanitize/)
-* [API Docs](https://rubydoc.info/github/rgrove/sanitize/Sanitize)
+* [API Docs](https://rubydoc.info/gems/sanitize/Sanitize)
 * [Issues](https://github.com/rgrove/sanitize/issues)
 * [Release History](https://github.com/rgrove/sanitize/releases)
 * [Online Demo](https://sanitize-web.fly.dev/)
@@ -136,6 +142,9 @@ Sanitize.fragment(html,
 
 Sanitize will happily clean up a standalone CSS stylesheet or property string without needing to invoke the HTML parser.
 
+> [!WARNING]
+> This should only be used to sanitize CSS for use in a standalone CSS file. To safely sanitize CSS for use in an HTML context, such as in a `<style>` element or a `style` attribute, you must use `Sanitize.document()` or `Sanitize.fragment()` with an appropriate allowlist as described in the previous sections. Failure to do so may enable HTML injection attacks.
+
 ```ruby
 css = %[
   @import url(evil.css);

data/lib/sanitize/css.rb

@@ -66,6 +66,10 @@ class Sanitize
     #   tree = Crass.parse(css)
     #   Sanitize::CSS.tree!(tree, Sanitize::Config::RELAXED)
     #
+    # The tree must be a list of rules, such as the tree returned by
+    # `Crass.parse`. To sanitize a list of declarations, such as the contents
+    # of an HTML `style` attribute, use {.properties}.
+    #
     # @return [Array] Sanitized Crass CSS parse tree.
     def self.tree!(tree, config = {})
       new(config).tree!(tree)
@@ -82,6 +86,11 @@ class Sanitize
       @at_rules_with_properties = Set.new(@config[:at_rules_with_properties])
       @at_rules_with_styles = Set.new(@config[:at_rules_with_styles])
       @import_url_validator = @config[:import_url_validator]
+
+      @parse_options = {
+        preserve_comments: @config[:allow_comments],
+        preserve_hacks: @config[:allow_hacks]
+      }.freeze
     end
 
     # Sanitizes inline CSS style properties.
@@ -96,11 +105,8 @@ class Sanitize
     #
     # @return [String] Sanitized CSS properties.
     def properties(css)
-      tree = Crass.parse_properties(css,
-        preserve_comments: @config[:allow_comments],
-        preserve_hacks: @config[:allow_hacks])
-
-      tree!(tree)
+      tree = Crass.parse_properties(css, @parse_options)
+      sanitize_tree!(tree, declarations: true)
       Crass::Parser.stringify(tree)
     end
 
@@ -127,10 +133,7 @@ class Sanitize
     #
     # @return [String] Sanitized CSS stylesheet.
     def stylesheet(css)
-      tree = Crass.parse(css,
-        preserve_comments: @config[:allow_comments],
-        preserve_hacks: @config[:allow_hacks])
-
+      tree = Crass.parse(css, @parse_options)
       tree!(tree)
       Crass::Parser.stringify(tree)
     end
@@ -155,48 +158,13 @@ class Sanitize
     #
     #   scss.tree!(tree)
     #
+    # The tree must be a list of rules, such as the tree returned by
+    # `Crass.parse`. To sanitize a list of declarations, such as the contents
+    # of an HTML `style` attribute, use {#properties}.
+    #
     # @return [Array] Sanitized Crass CSS parse tree.
     def tree!(tree)
-      preceded_by_property = false
-
-      tree.map! do |node|
-        next nil if node.nil?
-
-        case node[:node]
-        when :at_rule
-          preceded_by_property = false
-          next at_rule!(node)
-
-        when :comment
-          next node if @config[:allow_comments]
-
-        when :property
-          prop = property!(node)
-          preceded_by_property = !prop.nil?
-          next prop
-
-        when :semicolon
-          # Only preserve the semicolon if it was preceded by an allowlisted
-          # property. Otherwise, omit it in order to prevent redundant
-          # semicolons.
-          if preceded_by_property
-            preceded_by_property = false
-            next node
-          end
-
-        when :style_rule
-          preceded_by_property = false
-          tree!(node[:children])
-          next node
-
-        when :whitespace
-          next node
-        end
-
-        nil
-      end
-
-      tree
+      sanitize_tree!(tree, declarations: false)
     end
 
     # -- Protected Instance Methods --------------------------------------------
@@ -204,22 +172,33 @@ class Sanitize
 
     # Sanitizes a CSS at-rule node. Returns the sanitized node, or `nil` if the
     # current config doesn't allow this at-rule.
-    def at_rule!(rule)
+    #
+    # If _declarations_ is `true`, the at-rule appears in a list of
+    # declarations (such as the contents of a style rule) rather than in a list
+    # of rules.
+    def at_rule!(rule, declarations:)
       name = rule[:name].downcase
 
+      return nil if contains_invalid_node?(rule[:prelude])
+
       if @at_rules_with_styles.include?(name)
-        styles = Crass::Parser.parse_rules(rule[:block],
-          preserve_comments: @config[:allow_comments],
-          preserve_hacks: @config[:allow_hacks])
+        # Browsers that support CSS nesting parse the block of an at-rule like
+        # `@media` that appears in a list of declarations as more declarations
+        # rather than as rules, so it must be sanitized as declarations.
+        # Otherwise a declaration like `position:fixed;a{}` would be parsed as
+        # a style rule with the selector `position:fixed;a` and would bypass
+        # the property allowlist.
+        styles = if declarations
+          Crass::Parser.parse_properties(rule[:block], @parse_options)
+        else
+          Crass::Parser.parse_rules(rule[:block], @parse_options)
+        end
 
-        rule[:block] = tree!(styles)
+        rule[:block] = sanitize_tree!(styles, declarations: declarations)
 
       elsif @at_rules_with_properties.include?(name)
-        props = Crass::Parser.parse_properties(rule[:block],
-          preserve_comments: @config[:allow_comments],
-          preserve_hacks: @config[:allow_hacks])
-
-        rule[:block] = tree!(props)
+        props = Crass::Parser.parse_properties(rule[:block], @parse_options)
+        rule[:block] = sanitize_tree!(props, declarations: true)
 
       elsif @at_rules.include?(name)
         return nil if name == "import" && !import_url_allowed?(rule)
@@ -231,6 +210,31 @@ class Sanitize
       rule
     end
 
+    # Returns `true` if the given array of Crass nodes contains an invalid node
+    # (see {#invalid_node?}) at any depth.
+    def contains_invalid_node?(nodes)
+      contains_node?(nodes) { |node| invalid_node?(node) }
+    end
+
+    # Returns `true` if the given array of Crass nodes contains a node at any
+    # depth for which the given block returns a truthy value.
+    def contains_node?(nodes)
+      return false unless Array === nodes
+
+      stack = nodes.dup
+
+      until stack.empty?
+        node = stack.pop
+        next unless Hash === node
+        return true if yield(node)
+
+        value = node[:value]
+        stack.concat(value) if Array === value
+      end
+
+      false
+    end
+
     # Returns `true` if the given CSS function name is an image-related function
     # that may contain image URLs that need to be validated.
     def image_function?(name)
@@ -250,6 +254,22 @@ class Sanitize
       @import_url_validator.call(import_url)
     end
 
+    # Returns `true` if the given Crass node is a `:bad_url` or `:error` node.
+    #
+    # A bad URL is invalid CSS that a browser will discard, but a parser that
+    # disagrees with the browser about where a bad URL ends could be tricked
+    # into hiding CSS inside it.
+    #
+    # An `:error` node is CSS that Crass couldn't or wouldn't parse, such as a
+    # block nested more deeply than Crass's maximum nesting depth. Its contents
+    # are never inspected, but they're preserved verbatim when the tree is
+    # stringified, so a browser would still see them.
+    #
+    # It's safest to reject any construct that contains either one.
+    def invalid_node?(node)
+      node[:node] == :bad_url || node[:node] == :error
+    end
+
     # Sanitizes a CSS property node. Returns the sanitized node, or `nil` if the
     # current config doesn't allow this property.
     def property!(prop)
@@ -266,6 +286,9 @@ class Sanitize
       combined_value = +""
 
       nodes.each do |child|
+        # Reject properties that contain an invalid node at any depth.
+        return nil if invalid_node?(child)
+
         value = child[:value]
 
         case child[:node]
@@ -299,14 +322,86 @@ class Sanitize
         when :url
           return nil unless valid_url?(child)
 
-        when :bad_url
-          return nil
+        when :simple_block
+          # Reject properties that contain a `{}` block at any depth.
+          #
+          # A `{}` block isn't valid in a standard property value, and browsers
+          # that support CSS nesting will reparse an invalid declaration that
+          # contains one as a nested style rule (e.g.
+          # `color:hover{position:fixed}` becomes the rule
+          # `color:hover { position: fixed }`), which would allow disallowed
+          # properties to be smuggled past the sanitizer.
+          return nil if child[:start] == "{"
+
+          nodes.concat(value) if Array === value
         end
       end
 
       prop
     end
 
+    # Sanitizes the given Crass CSS parse tree and all its children, modifying
+    # it in place. See {#tree!}.
+    #
+    # If _declarations_ is `true`, the tree is a list of declarations (such as
+    # the contents of a style rule) rather than a list of rules.
+    def sanitize_tree!(tree, declarations:)
+      preceded_by_property = false
+
+      tree.map! do |node|
+        next nil if node.nil?
+
+        case node[:node]
+        when :at_rule
+          preceded_by_property = false
+          next at_rule!(node, declarations: declarations)
+
+        when :comment
+          next node if @config[:allow_comments]
+
+        when :property
+          prop = property!(node)
+          preceded_by_property = !prop.nil?
+          next prop
+
+        when :semicolon
+          # Only preserve the semicolon if it was preceded by an allowlisted
+          # property. Otherwise, omit it in order to prevent redundant
+          # semicolons.
+          if preceded_by_property
+            preceded_by_property = false
+            next node
+          end
+
+        when :style_rule
+          preceded_by_property = false
+
+          # Reject style rules whose selectors contain an invalid node (see
+          # {#invalid_node?}) or a semicolon at any depth.
+          #
+          # A semicolon is never valid in a selector, but if a style rule
+          # appears where a browser expects declarations (such as the contents
+          # of an `@media` rule in a list of declarations), the browser will
+          # treat everything before the semicolon as a declaration. For
+          # example, `position:fixed;a{}` would be treated as the declaration
+          # `position:fixed` followed by the style rule `a{}`.
+          next nil if contains_node?(node.dig(:selector, :tokens)) { |token|
+            invalid_node?(token) || token[:node] == :semicolon
+          }
+
+          sanitize_tree!(node[:children], declarations: true)
+          next node
+
+        when :whitespace
+          next node
+        end
+
+        nil
+      end
+
+      tree
+    end
+
     # Returns `true` if the given node (which may be of type `:url` or
     # `:function`, since the CSS syntax can produce both) uses an allowlisted
     # protocol.

data/lib/sanitize/transformers/clean_element.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "cgi"
 require "set"
 
 class Sanitize

data/lib/sanitize/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 class Sanitize
-  VERSION = "7.0.0"
+  VERSION = "7.0.1"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: sanitize
 version: !ruby/object:Gem::Version
-  version: 7.0.0
+  version: 7.0.1
 platform: ruby
 authors:
 - Ryan Grove
 bindir: bin
 cert_chain: []
-date: 2024-12-30 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: crass
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.0.2
+        version: 1.0.8
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.0.2
+        version: 1.0.8
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -40,7 +40,7 @@ dependencies:
 description: |
   Sanitize is an allowlist-based HTML and CSS sanitizer. It removes all HTML
   and/or CSS from a string except the elements, attributes, and properties you
-  choose to allow.'
+  choose to allow.
 email: ryan@wonko.com
 executables: []
 extensions: []
@@ -62,18 +62,6 @@ files:
 - lib/sanitize/transformers/clean_doctype.rb
 - lib/sanitize/transformers/clean_element.rb
 - lib/sanitize/version.rb
-- test/common.rb
-- test/test_clean_comment.rb
-- test/test_clean_css.rb
-- test/test_clean_doctype.rb
-- test/test_clean_element.rb
-- test/test_config.rb
-- test/test_malicious_css.rb
-- test/test_malicious_html.rb
-- test/test_parser.rb
-- test/test_sanitize.rb
-- test/test_sanitize_css.rb
-- test/test_transformers.rb
 homepage: https://github.com/rgrove/sanitize/
 licenses:
 - MIT
@@ -95,7 +83,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Allowlist-based HTML and CSS sanitizer.
 test_files: []

data/test/common.rb

@@ -1,4 +0,0 @@
-# frozen_string_literal: true
-
-require "minitest/autorun"
-require "sanitize"

data/test/test_clean_comment.rb

@@ -1,48 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "common"
-
-describe "Sanitize::Transformers::CleanComment" do
-  make_my_diffs_pretty!
-  parallelize_me!
-
-  describe "when :allow_comments is false" do
-    before do
-      @s = Sanitize.new(allow_comments: false, elements: ["div"])
-    end
-
-    it "should remove comments" do
-      _(@s.fragment("foo <!-- comment --> bar")).must_equal "foo  bar"
-      _(@s.fragment("foo <!-- ")).must_equal "foo "
-      _(@s.fragment("foo <!-- - -> bar")).must_equal "foo "
-      _(@s.fragment("foo <!--\n\n\n\n-->bar")).must_equal "foo bar"
-      _(@s.fragment("foo <!-- <!-- <!-- --> --> -->bar")).must_equal "foo  --&gt; --&gt;bar"
-      _(@s.fragment("foo <div <!-- comment -->>bar</div>")).must_equal "foo <div>&gt;bar</div>"
-
-      # Special case: the comment markup is inside a <script>, which makes it
-      # text content and not an actual HTML comment.
-      _(@s.fragment("<script><!-- comment --></script>")).must_equal ""
-
-      _(Sanitize.fragment("<script><!-- comment --></script>", allow_comments: false, elements: ["script"]))
-        .must_equal "<script><!-- comment --></script>"
-    end
-  end
-
-  describe "when :allow_comments is true" do
-    before do
-      @s = Sanitize.new(allow_comments: true, elements: ["div"])
-    end
-
-    it "should allow comments" do
-      _(@s.fragment("foo <!-- comment --> bar")).must_equal "foo <!-- comment --> bar"
-      _(@s.fragment("foo <!-- ")).must_equal "foo <!-- -->"
-      _(@s.fragment("foo <!-- - -> bar")).must_equal "foo <!-- - -> bar-->"
-      _(@s.fragment("foo <!--\n\n\n\n-->bar")).must_equal "foo <!--\n\n\n\n-->bar"
-      _(@s.fragment("foo <!-- <!-- <!-- --> --> -->bar")).must_equal "foo <!-- <!-- <!-- --> --&gt; --&gt;bar"
-      _(@s.fragment("foo <div <!-- comment -->>bar</div>")).must_equal "foo <div>&gt;bar</div>"
-
-      _(Sanitize.fragment("<script><!-- comment --></script>", allow_comments: true, elements: ["script"]))
-        .must_equal "<script><!-- comment --></script>"
-    end
-  end
-end

data/test/test_clean_css.rb

@@ -1,68 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "common"
-
-describe "Sanitize::Transformers::CSS::CleanAttribute" do
-  make_my_diffs_pretty!
-  parallelize_me!
-
-  before do
-    @s = Sanitize.new(Sanitize::Config::RELAXED)
-  end
-
-  it "should sanitize CSS properties in style attributes" do
-    _(@s.fragment(%[
-      <div style="color: #fff; width: expression(alert(1)); /* <-- evil! */"></div>
-    ].strip)).must_equal %(
-      <div style="color: #fff;  /* <-- evil! */"></div>
-    ).strip
-  end
-
-  it "should remove the style attribute if the sanitized CSS is empty" do
-    _(@s.fragment('<div style="width: expression(alert(1))"></div>'))
-      .must_equal "<div></div>"
-  end
-end
-
-describe "Sanitize::Transformers::CSS::CleanElement" do
-  make_my_diffs_pretty!
-  parallelize_me!
-
-  before do
-    @s = Sanitize.new(Sanitize::Config::RELAXED)
-  end
-
-  it "should sanitize CSS stylesheets in <style> elements" do
-    html = %[
-      <style>@import url(evil.css);
-      /* Yay CSS! */
-      .foo { color: #fff; }
-      #bar { background: url(yay.jpg); bogus: wtf; }
-      .evil { width: expression(xss()); }
-
-      @media screen (max-width:480px) {
-        .foo { width: 400px; }
-        #bar:not(.baz) { height: 100px; }
-      }
-      </style>
-    ].strip
-
-    _(@s.fragment(html)).must_equal %[
-      <style>
-      /* Yay CSS! */
-      .foo { color: #fff; }
-      #bar { background: url(yay.jpg);  }
-      .evil {  }
-
-      @media screen (max-width:480px) {
-        .foo { width: 400px; }
-        #bar:not(.baz) { height: 100px; }
-      }
-      </style>
-    ].strip
-  end
-
-  it "should remove the <style> element if the sanitized CSS is empty" do
-    _(@s.fragment("<style></style>")).must_equal ""
-  end
-end

data/test/test_clean_doctype.rb

@@ -1,72 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "common"
-
-describe "Sanitize::Transformers::CleanDoctype" do
-  make_my_diffs_pretty!
-  parallelize_me!
-
-  describe "when :allow_doctype is false" do
-    before do
-      @s = Sanitize.new(allow_doctype: false, elements: ["html"])
-    end
-
-    it "should remove doctype declarations" do
-      _(@s.document("<!DOCTYPE html><html>foo</html>")).must_equal "<html>foo</html>"
-      _(@s.fragment("<!DOCTYPE html>foo")).must_equal "foo"
-    end
-
-    it "should not allow doctype definitions in fragments" do
-      _(@s.fragment("<!DOCTYPE html><html>foo</html>"))
-        .must_equal "foo"
-
-      _(@s.fragment('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"><html>foo</html>'))
-        .must_equal "foo"
-
-      _(@s.fragment("<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\"\n    \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"><html>foo</html>"))
-        .must_equal "foo"
-    end
-  end
-
-  describe "when :allow_doctype is true" do
-    before do
-      @s = Sanitize.new(allow_doctype: true, elements: ["html"])
-    end
-
-    it "should allow doctype declarations in documents" do
-      _(@s.document("<!DOCTYPE html><html>foo</html>"))
-        .must_equal "<!DOCTYPE html><html>foo</html>"
-
-      _(@s.document('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"><html>foo</html>'))
-        .must_equal "<!DOCTYPE html><html>foo</html>"
-
-      _(@s.document("<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\"\n    \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"><html>foo</html>"))
-        .must_equal "<!DOCTYPE html><html>foo</html>"
-    end
-
-    it "should not allow obviously invalid doctype declarations in documents" do
-      _(@s.document("<!DOCTYPE blah blah blah><html>foo</html>"))
-        .must_equal "<!DOCTYPE html><html>foo</html>"
-
-      _(@s.document("<!DOCTYPE blah><html>foo</html>"))
-        .must_equal "<!DOCTYPE html><html>foo</html>"
-
-      _(@s.document('<!DOCTYPE html BLAH "-//W3C//DTD HTML 4.01//EN"><html>foo</html>'))
-        .must_equal "<!DOCTYPE html><html>foo</html>"
-
-      _(@s.document("<!whatever><html>foo</html>"))
-        .must_equal "<html>foo</html>"
-    end
-
-    it "should not allow doctype definitions in fragments" do
-      _(@s.fragment("<!DOCTYPE html><html>foo</html>"))
-        .must_equal "foo"
-
-      _(@s.fragment('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"><html>foo</html>'))
-        .must_equal "foo"
-
-      _(@s.fragment("<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\"\n    \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"><html>foo</html>"))
-        .must_equal "foo"
-    end
-  end
-end