sanitize 7.0.0 → 7.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c7ec07b16780ba818a5fdbb0570fb6c84245c60b2656388cab0b03b0d00bbc6a
-  data.tar.gz: 650c2a0c59fd4af1d305051e5488bcacee3f5a638a96960163f6677b838a9661
+  metadata.gz: 9dcbdd9a00a2f80ddded816eb9b52215365ae34ec23e99f0d31b2a2b11757b49
+  data.tar.gz: 38be6ac4c8215e558b4b1f4c8ae2eb570f6225a6473964b52ffbcb49c2806779
 SHA512:
-  metadata.gz: ec33f841766422dda2ee1d889d2e3f42f6b3b479c2cf557cad80de0311969a4e132e02a5a33dda296af2e2a5fec8791aa6ba8eacd6ea370428cc40ff3f08a720
-  data.tar.gz: f4cf669dba8e416c38fb4b9eae30b86e9c7816718e80cc32eac1f536f1e2023c59cb74df7e701af717a157e1fe1ccc902a89b26992488a85400e4dc0c089d07a
+  metadata.gz: d802d1606fa2a8cb2056125d26092ef056146252c38ff55a086776c35eda10b70c63882f7b473656f4ea5cf18dfc9864e1e2bc6d257b204a1072568a5a65d440
+  data.tar.gz: 0f64bb78dd9c4b2dca863530c02a08559c36ed9ec761c0d3f3b1d81fef3b1eefe39e7632d0354eaf75b49b5e755c0e0191f92b6fb6a669255fd48bde2df332d7

data/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 All notable changes to Sanitize are documented in this file. The format (since version 7.0.0) is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 7.0.2 (2026-11-02)
+
+### Security
+
+- MathML and SVG elements whose `<math>` or `<svg>` ancestor has been removed are now also removed (keeping their contents, subject to `:remove_contents`), even if they're allowed by the config or have been allowlisted by a transformer. Previously, if Sanitize removed a `<math>` or `<svg>` element but kept its contents, its descendants were kept even though they'd been parsed as foreign elements, and browsers would reparse them as HTML elements. Since some elements are parsed very differently in foreign content than in HTML, this could allow arbitrary HTML to be injected. For example, the contents of a `<textarea>`, `<title>`, `<xmp>`, `<noembed>`, or `<noframes>` element inside a MathML or SVG element are parsed as markup rather than text, so an attribute value, comment, or raw text element inside it like `<svg><textarea><!--</textarea><img src=x onerror=alert(1)>-->` could close the element early once it was reparsed as HTML. Similarly, browsers that use legacy `<select>` parsing rules would parse the contents of a raw text element inside a `<select>` element like `<math><select><mi><xmp><input><img src=x onerror=alert(1)></xmp>` as markup. This only affected custom configs that don't remove the contents of `<math>` or `<svg>` elements and allow one of the affected elements. Sanitize's default and built-in configs aren't affected. Thanks to Mike Dalessio (@flavorjones) for reporting this issue. (GHSA-599p-54q3-ff89)
+
+- Elements and comments inside text content elements such as `<textarea>`, `<title>`, `<xmp>`, `<noembed>`, and `<noframes>` are now always removed, even if they're allowed by the config or have been allowlisted by a transformer. Only their text is kept, subject to `:remove_contents`. This provides defense in depth against the issue above. (GHSA-599p-54q3-ff89)
+
+- Sanitize now requires Nokogiri 1.19.7 or higher. Nokogiri versions since 1.19.5 escape `<` and `>` in serialized attribute values to match browser behavior, which provides defense in depth against the issue above. (GHSA-599p-54q3-ff89)
+
+- Elements inside `<select>`, `<option>`, and `<optgroup>` elements that browsers using legacy `<select>` parsing rules wouldn't allow there are now always removed (keeping their contents, subject to `:remove_contents`), even if they're allowed by the config or have been allowlisted by a transformer. Previously, if Sanitize removed a `<template>` element inside a `<select>` element but kept its contents, any raw text element inside the `<template>` element would end up inside the `<select>` element. Browsers that use legacy `<select>` parsing rules ignore the start tags of raw text elements inside a `<select>` element and parse their contents as markup, so input like `<select><template><xmp><input><img src=x onerror=alert(1)></xmp>` could be used to inject arbitrary HTML. This only affected custom configs that allow `<select>` and at least one raw text element such as `<style>`, `<xmp>`, `<noembed>`, `<noframes>`, or `<plaintext>`. Sanitize's default and built-in configs aren't affected. (GHSA-mg79-gw37-jxx7)
+
+### Changed
+
+- Ruby 3.2.0 is now the oldest supported Ruby version, since Nokogiri 1.19.x requires Ruby 3.2.0 or higher. Ruby 3.1 reached end of life in March 2025.
+
+## 7.0.1 (2026-10-21)
+
+### Security
+
+- CSS properties that contain a `{}` block anywhere in their value are now removed. Browsers that support [CSS nesting](https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_nesting) reparse an invalid declaration containing a `{}` block as a nested style rule, so a value like `color:hover{position:fixed}` could previously be used to smuggle disallowed properties and URLs past Sanitize in a stylesheet or `<style>` element. (GHSA-wgw9-qhqg-8hv5)
+
+- The contents of at-rules such as `@media` and `@supports` that appear in a list of declarations (inside a style rule, inside an at-rule like `@font-face`, or in CSS sanitized with `Sanitize::CSS.properties`) are now sanitized as declarations rather than as rules, matching how browsers that support CSS nesting parse them. Previously, a stylesheet like `p{@media all{position:fixed;a{}}}` could be used to smuggle disallowed properties and URLs past Sanitize, since Sanitize treated `position:fixed;a` as a style rule's selector. The same was true of CSS sanitized with `Sanitize::CSS.properties` if the result was later embedded in a style rule. Style rules nested inside these at-rules are now removed, just as style rules nested directly inside other style rules already were. (GHSA-wgw9-qhqg-8hv5)
+
+- CSS properties, style rules, and at-rules that contain blocks or functions nested more deeply than Crass's maximum nesting depth (25 levels by default) are now removed. (GHSA-wgw9-qhqg-8hv5)
+
+- Hardened CSS sanitization against tokenizer differentials involving bad URLs. CSS properties that contain a bad URL anywhere inside a simple block (such as `[...]` or `(...)`) are now removed, as are style rules whose selectors contain a bad URL and at-rules whose preludes contain a bad URL. URLs inside simple blocks are now also validated against the configured protocol allowlist. Previously, a bug in Crass (fixed in Crass 1.0.8) could be exploited to smuggle CSS declarations, rules, or at-rules past Sanitize by hiding them in a bad URL in one of these locations.
+
+- CSS style rules whose selectors contain a semicolon are now removed, as a defense in depth measure. A semicolon is never valid in a selector, but when a style rule appears where a browser that supports CSS nesting expects declarations, the browser treats everything before the semicolon as a declaration. This could be used to smuggle disallowed properties past `Sanitize::CSS.tree!` when it was given a list of declarations rather than a list of rules (though this isn't something Sanitize itself does).
+
+### Fixed
+
+- Removed an unused `require "cgi"` that caused a warning on Ruby 4.0, since the CGI library is no longer part of Ruby's standard library.
+
 ## 7.0.0 (2024-12-29)
 
 Sanitize has no breaking API changes in this release, but the major version number has been incremented because we've dropped support for end-of-life versions of Ruby. As long as you're using Ruby 3.1.0 or later, this should be a painless upgrade!

data/README.md

@@ -12,10 +12,16 @@ Sanitize is based on the [Nokogiri HTML5 parser][nokogiri], which parses HTML th
 [crass]:https://github.com/rgrove/crass
 [nokogiri]:https://github.com/sparklemotion/nokogiri
 
+> [!WARNING]
+>
+> Sanitize cannot fully sanitize the contents of `<math>` or `<svg>` elements. MathML and SVG elements are [foreign elements](https://html.spec.whatwg.org/multipage/syntax.html#foreign-elements) that don't follow normal HTML parsing rules.
+>
+> By default, Sanitize will remove all MathML and SVG elements. If you add MathML or SVG elements to a custom element allowlist, you may create a security vulnerability in your application.
+
 ## Links
 
 * [Home](https://github.com/rgrove/sanitize/)
-* [API Docs](https://rubydoc.info/github/rgrove/sanitize/Sanitize)
+* [API Docs](https://rubydoc.info/gems/sanitize/Sanitize)
 * [Issues](https://github.com/rgrove/sanitize/issues)
 * [Release History](https://github.com/rgrove/sanitize/releases)
 * [Online Demo](https://sanitize-web.fly.dev/)
@@ -136,6 +142,9 @@ Sanitize.fragment(html,
 
 Sanitize will happily clean up a standalone CSS stylesheet or property string without needing to invoke the HTML parser.
 
+> [!WARNING]
+> This should only be used to sanitize CSS for use in a standalone CSS file. To safely sanitize CSS for use in an HTML context, such as in a `<style>` element or a `style` attribute, you must use `Sanitize.document()` or `Sanitize.fragment()` with an appropriate allowlist as described in the previous sections. Failure to do so may enable HTML injection attacks.
+
 ```ruby
 css = %[
   @import url(evil.css);

data/lib/sanitize/config.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require "set"
-
 class Sanitize
   module Config
     # Deeply freezes and returns the given configuration Hash.

data/lib/sanitize/css.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require "crass"
-require "set"
 
 class Sanitize
   class CSS
@@ -66,6 +65,10 @@ class Sanitize
     #   tree = Crass.parse(css)
     #   Sanitize::CSS.tree!(tree, Sanitize::Config::RELAXED)
     #
+    # The tree must be a list of rules, such as the tree returned by
+    # `Crass.parse`. To sanitize a list of declarations, such as the contents
+    # of an HTML `style` attribute, use {.properties}.
+    #
     # @return [Array] Sanitized Crass CSS parse tree.
     def self.tree!(tree, config = {})
       new(config).tree!(tree)
@@ -82,6 +85,11 @@ class Sanitize
       @at_rules_with_properties = Set.new(@config[:at_rules_with_properties])
       @at_rules_with_styles = Set.new(@config[:at_rules_with_styles])
       @import_url_validator = @config[:import_url_validator]
+
+      @parse_options = {
+        preserve_comments: @config[:allow_comments],
+        preserve_hacks: @config[:allow_hacks]
+      }.freeze
     end
 
     # Sanitizes inline CSS style properties.
@@ -96,11 +104,8 @@ class Sanitize
     #
     # @return [String] Sanitized CSS properties.
     def properties(css)
-      tree = Crass.parse_properties(css,
-        preserve_comments: @config[:allow_comments],
-        preserve_hacks: @config[:allow_hacks])
-
-      tree!(tree)
+      tree = Crass.parse_properties(css, @parse_options)
+      sanitize_tree!(tree, declarations: true)
       Crass::Parser.stringify(tree)
     end
 
@@ -127,10 +132,7 @@ class Sanitize
     #
     # @return [String] Sanitized CSS stylesheet.
     def stylesheet(css)
-      tree = Crass.parse(css,
-        preserve_comments: @config[:allow_comments],
-        preserve_hacks: @config[:allow_hacks])
-
+      tree = Crass.parse(css, @parse_options)
       tree!(tree)
       Crass::Parser.stringify(tree)
     end
@@ -155,48 +157,13 @@ class Sanitize
     #
     #   scss.tree!(tree)
     #
+    # The tree must be a list of rules, such as the tree returned by
+    # `Crass.parse`. To sanitize a list of declarations, such as the contents
+    # of an HTML `style` attribute, use {#properties}.
+    #
     # @return [Array] Sanitized Crass CSS parse tree.
     def tree!(tree)
-      preceded_by_property = false
-
-      tree.map! do |node|
-        next nil if node.nil?
-
-        case node[:node]
-        when :at_rule
-          preceded_by_property = false
-          next at_rule!(node)
-
-        when :comment
-          next node if @config[:allow_comments]
-
-        when :property
-          prop = property!(node)
-          preceded_by_property = !prop.nil?
-          next prop
-
-        when :semicolon
-          # Only preserve the semicolon if it was preceded by an allowlisted
-          # property. Otherwise, omit it in order to prevent redundant
-          # semicolons.
-          if preceded_by_property
-            preceded_by_property = false
-            next node
-          end
-
-        when :style_rule
-          preceded_by_property = false
-          tree!(node[:children])
-          next node
-
-        when :whitespace
-          next node
-        end
-
-        nil
-      end
-
-      tree
+      sanitize_tree!(tree, declarations: false)
     end
 
     # -- Protected Instance Methods --------------------------------------------
@@ -204,22 +171,33 @@ class Sanitize
 
     # Sanitizes a CSS at-rule node. Returns the sanitized node, or `nil` if the
     # current config doesn't allow this at-rule.
-    def at_rule!(rule)
+    #
+    # If _declarations_ is `true`, the at-rule appears in a list of
+    # declarations (such as the contents of a style rule) rather than in a list
+    # of rules.
+    def at_rule!(rule, declarations:)
       name = rule[:name].downcase
 
+      return nil if contains_invalid_node?(rule[:prelude])
+
       if @at_rules_with_styles.include?(name)
-        styles = Crass::Parser.parse_rules(rule[:block],
-          preserve_comments: @config[:allow_comments],
-          preserve_hacks: @config[:allow_hacks])
+        # Browsers that support CSS nesting parse the block of an at-rule like
+        # `@media` that appears in a list of declarations as more declarations
+        # rather than as rules, so it must be sanitized as declarations.
+        # Otherwise a declaration like `position:fixed;a{}` would be parsed as
+        # a style rule with the selector `position:fixed;a` and would bypass
+        # the property allowlist.
+        styles = if declarations
+          Crass::Parser.parse_properties(rule[:block], @parse_options)
+        else
+          Crass::Parser.parse_rules(rule[:block], @parse_options)
+        end
 
-        rule[:block] = tree!(styles)
+        rule[:block] = sanitize_tree!(styles, declarations: declarations)
 
       elsif @at_rules_with_properties.include?(name)
-        props = Crass::Parser.parse_properties(rule[:block],
-          preserve_comments: @config[:allow_comments],
-          preserve_hacks: @config[:allow_hacks])
-
-        rule[:block] = tree!(props)
+        props = Crass::Parser.parse_properties(rule[:block], @parse_options)
+        rule[:block] = sanitize_tree!(props, declarations: true)
 
       elsif @at_rules.include?(name)
         return nil if name == "import" && !import_url_allowed?(rule)
@@ -231,6 +209,31 @@ class Sanitize
       rule
     end
 
+    # Returns `true` if the given array of Crass nodes contains an invalid node
+    # (see {#invalid_node?}) at any depth.
+    def contains_invalid_node?(nodes)
+      contains_node?(nodes) { |node| invalid_node?(node) }
+    end
+
+    # Returns `true` if the given array of Crass nodes contains a node at any
+    # depth for which the given block returns a truthy value.
+    def contains_node?(nodes)
+      return false unless Array === nodes
+
+      stack = nodes.dup
+
+      until stack.empty?
+        node = stack.pop
+        next unless Hash === node
+        return true if yield(node)
+
+        value = node[:value]
+        stack.concat(value) if Array === value
+      end
+
+      false
+    end
+
     # Returns `true` if the given CSS function name is an image-related function
     # that may contain image URLs that need to be validated.
     def image_function?(name)
@@ -250,6 +253,22 @@ class Sanitize
       @import_url_validator.call(import_url)
     end
 
+    # Returns `true` if the given Crass node is a `:bad_url` or `:error` node.
+    #
+    # A bad URL is invalid CSS that a browser will discard, but a parser that
+    # disagrees with the browser about where a bad URL ends could be tricked
+    # into hiding CSS inside it.
+    #
+    # An `:error` node is CSS that Crass couldn't or wouldn't parse, such as a
+    # block nested more deeply than Crass's maximum nesting depth. Its contents
+    # are never inspected, but they're preserved verbatim when the tree is
+    # stringified, so a browser would still see them.
+    #
+    # It's safest to reject any construct that contains either one.
+    def invalid_node?(node)
+      node[:node] == :bad_url || node[:node] == :error
+    end
+
     # Sanitizes a CSS property node. Returns the sanitized node, or `nil` if the
     # current config doesn't allow this property.
     def property!(prop)
@@ -266,6 +285,9 @@ class Sanitize
       combined_value = +""
 
       nodes.each do |child|
+        # Reject properties that contain an invalid node at any depth.
+        return nil if invalid_node?(child)
+
         value = child[:value]
 
         case child[:node]
@@ -299,14 +321,86 @@ class Sanitize
         when :url
           return nil unless valid_url?(child)
 
-        when :bad_url
-          return nil
+        when :simple_block
+          # Reject properties that contain a `{}` block at any depth.
+          #
+          # A `{}` block isn't valid in a standard property value, and browsers
+          # that support CSS nesting will reparse an invalid declaration that
+          # contains one as a nested style rule (e.g.
+          # `color:hover{position:fixed}` becomes the rule
+          # `color:hover { position: fixed }`), which would allow disallowed
+          # properties to be smuggled past the sanitizer.
+          return nil if child[:start] == "{"
+
+          nodes.concat(value) if Array === value
         end
       end
 
       prop
     end
 
+    # Sanitizes the given Crass CSS parse tree and all its children, modifying
+    # it in place. See {#tree!}.
+    #
+    # If _declarations_ is `true`, the tree is a list of declarations (such as
+    # the contents of a style rule) rather than a list of rules.
+    def sanitize_tree!(tree, declarations:)
+      preceded_by_property = false
+
+      tree.map! do |node|
+        next nil if node.nil?
+
+        case node[:node]
+        when :at_rule
+          preceded_by_property = false
+          next at_rule!(node, declarations: declarations)
+
+        when :comment
+          next node if @config[:allow_comments]
+
+        when :property
+          prop = property!(node)
+          preceded_by_property = !prop.nil?
+          next prop
+
+        when :semicolon
+          # Only preserve the semicolon if it was preceded by an allowlisted
+          # property. Otherwise, omit it in order to prevent redundant
+          # semicolons.
+          if preceded_by_property
+            preceded_by_property = false
+            next node
+          end
+
+        when :style_rule
+          preceded_by_property = false
+
+          # Reject style rules whose selectors contain an invalid node (see
+          # {#invalid_node?}) or a semicolon at any depth.
+          #
+          # A semicolon is never valid in a selector, but if a style rule
+          # appears where a browser expects declarations (such as the contents
+          # of an `@media` rule in a list of declarations), the browser will
+          # treat everything before the semicolon as a declaration. For
+          # example, `position:fixed;a{}` would be treated as the declaration
+          # `position:fixed` followed by the style rule `a{}`.
+          next nil if contains_node?(node.dig(:selector, :tokens)) { |token|
+            invalid_node?(token) || token[:node] == :semicolon
+          }
+
+          sanitize_tree!(node[:children], declarations: true)
+          next node
+
+        when :whitespace
+          next node
+        end
+
+        nil
+      end
+
+      tree
+    end
+
     # Returns `true` if the given node (which may be of type `:url` or
     # `:function`, since the CSS syntax can produce both) uses an allowlisted
     # protocol.

data/lib/sanitize/transformers/clean_comment.rb

@@ -2,12 +2,48 @@
 
 class Sanitize
   module Transformers
+    # Names of elements whose content is parsed as text rather than markup when
+    # they're in the HTML namespace.
+    #
+    # An element with one of these names can contain markup if it's in a foreign
+    # namespace like MathML or SVG. If Sanitize removes the foreign ancestor but
+    # keeps the element, its serialized contents will be reparsed as text inside
+    # an HTML element, so a closing tag inside a comment or an unescaped raw
+    # text element could break out of the element and inject arbitrary markup.
+    # To prevent this, Sanitize removes all elements and comments inside these
+    # elements, leaving only text.
+    TEXT_CONTENT_ELEMENTS = Set.new(%w[
+      iframe
+      noembed
+      noframes
+      noscript
+      plaintext
+      script
+      style
+      textarea
+      title
+      xmp
+    ]).freeze
+
     CleanComment = lambda do |env|
       node = env[:node]
 
-      if node.type == Nokogiri::XML::Node::COMMENT_NODE
-        node.unlink unless env[:is_allowlisted]
+      return unless node.type == Nokogiri::XML::Node::COMMENT_NODE
+
+      # Comments inside text content elements are always removed, even if
+      # they're allowlisted, since they can never be serialized safely.
+      parent = node.parent
+
+      while parent&.element?
+        if TEXT_CONTENT_ELEMENTS.include?(parent.name.downcase)
+          node.unlink
+          return
+        end
+
+        parent = parent.parent
       end
+
+      node.unlink unless env[:config][:allow_comments] || env[:is_allowlisted]
     end
   end
 end

data/lib/sanitize/transformers/clean_element.rb

@@ -1,11 +1,15 @@
 # frozen_string_literal: true
 
-require "cgi"
-require "set"
-
 class Sanitize
   module Transformers
     class CleanElement
+      # Maps the namespace URI of each foreign element type supported by HTML to
+      # the name of its root element.
+      FOREIGN_NAMESPACE_ROOTS = {
+        "http://www.w3.org/1998/Math/MathML" => "math",
+        "http://www.w3.org/2000/svg" => "svg"
+      }.freeze
+
       # Matches a valid HTML5 data attribute name. The unicode ranges included
       # here are a conservative subset of the full range of characters that are
       # technically allowed, with the intent of matching the most common
@@ -21,6 +25,14 @@ class Sanitize
       # https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes
       REGEX_DATA_ATTR = /\Adata-(?!xml)[a-z_][\w.\u00E0-\u00F6\u00F8-\u017F\u01DD-\u02AF-]*\z/u
 
+      # Maps `<select>` and related elements to the names of the elements that
+      # browsers using legacy `<select>` parsing rules allow as their children.
+      SELECT_CONTENT_MODEL = {
+        "optgroup" => Set["option"].freeze,
+        "option" => Set.new.freeze,
+        "select" => Set["hr", "optgroup", "option"].freeze
+      }.freeze
+
       # Elements whose content is treated as unescaped text by HTML parsers.
       UNESCAPED_TEXT_ELEMENTS = Set.new(%w[
         iframe
@@ -91,9 +103,18 @@ class Sanitize
 
       def call(env)
         node = env[:node]
-        return if node.type != Nokogiri::XML::Node::ELEMENT_NODE || env[:is_allowlisted]
+        return if node.type != Nokogiri::XML::Node::ELEMENT_NODE
 
         name = env[:node_name]
+        parent = node.parent
+
+        # Some elements are always removed, even if they're allowlisted, since
+        # browsers would parse them differently than Nokogiri did.
+        force_remove = orphaned_foreign_element?(node, name, parent) ||
+          invalid_select_descendant?(name, parent) ||
+          text_content_element?(parent)
+
+        return if env[:is_allowlisted] && !force_remove
 
         # Delete any element that isn't in the config allowlist, unless the node
         # has already been deleted from the document.
@@ -101,7 +122,7 @@ class Sanitize
         # It's important that we not try to reparent the children of a node that
         # has already been deleted, since that seems to trigger a memory leak in
         # Nokogiri.
-        unless @elements.include?(name) || node.parent.nil?
+        if (force_remove || !@elements.include?(name)) && !parent.nil?
           # Elements like br, div, p, etc. need to be replaced with whitespace
           # in order to preserve readability.
           if @whitespace_elements.include?(name)
@@ -246,6 +267,55 @@ class Sanitize
           node.unlink
         end
       end
+
+      private
+
+      # Returns `true` if _parent_ is an HTML `<select>`, `<option>`, or
+      # `<optgroup>` element and _name_ isn't an element that browsers allow
+      # inside it.
+      #
+      # Browsers that use legacy `<select>` parsing rules ignore the start tags
+      # of most elements inside a `<select>` element, including raw text
+      # elements like `<style>` and `<xmp>`, so these elements' contents would
+      # be parsed as markup. Nokogiri parses these elements the same way, but
+      # they can still end up inside a `<select>` element via a `<template>`
+      # element or foreign content that Sanitize removes. Since traversal is
+      # top-down, removing these elements ensures that only allowed elements
+      # and text remain inside `<select>` elements.
+      def invalid_select_descendant?(name, parent)
+        return false unless parent&.element? && SELECT_CONTENT_MODEL.key?(parent.name.downcase)
+        return false if FOREIGN_NAMESPACE_ROOTS.key?(parent.namespace&.href)
+
+        !SELECT_CONTENT_MODEL[parent.name.downcase].include?(name)
+      end
+
+      # Returns `true` if _node_ is a MathML or SVG element other than a
+      # `<math>` or `<svg>` element and its parent isn't a MathML or SVG element.
+      #
+      # This happens when Sanitize removes a `<math>` or `<svg>` element but
+      # keeps its contents. Nokogiri parsed these descendants as foreign
+      # elements, but browsers would reparse them as HTML elements, which may
+      # be parsed very differently. For example, the contents of a foreign
+      # `<textarea>` element are parsed as markup rather than as text. Since
+      # traversal is top-down, removing these elements ensures that no foreign
+      # element is kept without a foreign root.
+      def orphaned_foreign_element?(node, name, parent)
+        root_name = FOREIGN_NAMESPACE_ROOTS[node.namespace&.href]
+        return false if root_name.nil? || name == root_name
+
+        !(parent&.element? && FOREIGN_NAMESPACE_ROOTS.key?(parent.namespace&.href))
+      end
+
+      # Returns `true` if _parent_ is a text content element, such as
+      # `<textarea>` or `<xmp>`.
+      #
+      # Browsers parse the contents of these elements as text when they're in
+      # the HTML namespace, so any element inside one must have been parsed in
+      # a foreign namespace. Since traversal is top-down, removing these
+      # elements ensures that only text remains inside text content elements.
+      def text_content_element?(parent)
+        !!parent&.element? && TEXT_CONTENT_ELEMENTS.include?(parent.name.downcase)
+      end
     end
   end
 end

data/lib/sanitize/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 class Sanitize
-  VERSION = "7.0.0"
+  VERSION = "7.0.2"
 end

data/lib/sanitize.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require "nokogiri"
-require "set"
 
 require_relative "sanitize/version"
 require_relative "sanitize/config"
@@ -97,7 +96,7 @@ class Sanitize
     # Default transformers always run at the end of the chain, after any custom
     # transformers.
     @transformers << Transformers::CleanElement.new(@config)
-    @transformers << Transformers::CleanComment unless @config[:allow_comments]
+    @transformers << Transformers::CleanComment
 
     if @config[:elements].include?("style")
       scss = Sanitize::CSS.new(config)