diff -Nru ruby-rails-html-sanitizer-1.0.3/debian/changelog ruby-rails-html-sanitizer-1.0.4/debian/changelog
--- ruby-rails-html-sanitizer-1.0.3/debian/changelog	2016-03-05 03:25:14.000000000 +0000
+++ ruby-rails-html-sanitizer-1.0.4/debian/changelog	2018-03-23 12:42:07.000000000 +0000
@@ -1,3 +1,21 @@
+ruby-rails-html-sanitizer (1.0.4-1) unstable; urgency=medium
+
+  * New upstream release.
+  * debian/compat: Bump debhelper compatibility level to 11.
+  * debian/control:
+    - Bump required debhelper version to >= 11~.
+    - Bump Standards-Version to 4.1.3 (no changes needed).
+    - Use salsa.debian.org in Vcs-* fields.
+    - Add myself as Uploader.
+    - Require ruby-loofah >= 2.2.2~.
+  * debian/copyright:
+    - Use HTTPS in link to copyright format specification.
+    - Add missing Debian packaging authors.
+  * debian/patches: Drop patch to skip failing specs, fixed upstream.
+  * debian/watch: Use version 4 and HTTPS in link to gemwatch service.
+
+ -- Georg Faerber <georg@riseup.net>  Fri, 23 Mar 2018 13:42:07 +0100
+
 ruby-rails-html-sanitizer (1.0.3-2) unstable; urgency=medium
 
   * Team upload.
diff -Nru ruby-rails-html-sanitizer-1.0.3/debian/compat ruby-rails-html-sanitizer-1.0.4/debian/compat
--- ruby-rails-html-sanitizer-1.0.3/debian/compat	2016-03-05 03:25:14.000000000 +0000
+++ ruby-rails-html-sanitizer-1.0.4/debian/compat	2018-03-23 12:42:07.000000000 +0000
@@ -1 +1 @@
-9
+11
diff -Nru ruby-rails-html-sanitizer-1.0.3/debian/control ruby-rails-html-sanitizer-1.0.4/debian/control
--- ruby-rails-html-sanitizer-1.0.3/debian/control	2016-03-05 03:25:14.000000000 +0000
+++ ruby-rails-html-sanitizer-1.0.4/debian/control	2018-03-23 12:42:07.000000000 +0000
@@ -2,15 +2,16 @@
 Section: ruby
 Priority: optional
 Maintainer: Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@lists.alioth.debian.org>
-Uploaders: Balasankar C <balasankarc@autistici.org>
-Build-Depends: debhelper (>= 9~),
+Uploaders: Balasankar C <balasankarc@autistici.org>,
+           Georg Faerber <georg@riseup.net>
+Build-Depends: debhelper (>= 11~),
                gem2deb,
-               ruby-loofah,
+               ruby-loofah (>= 2.2.2~),
                ruby-minitest,
                ruby-rails
-Standards-Version: 3.9.7
-Vcs-Git: https://anonscm.debian.org/git/pkg-ruby-extras/ruby-rails-html-sanitizer.git
-Vcs-Browser: https://anonscm.debian.org/cgit/pkg-ruby-extras/ruby-rails-html-sanitizer.git
+Standards-Version: 4.1.3
+Vcs-Git: https://salsa.debian.org/ruby-team/ruby-rails-html-sanitizer.git
+Vcs-Browser: https://salsa.debian.org/ruby-team/ruby-rails-html-sanitizer
 Homepage: https://github.com/rafaelfranca/rails-html-sanitizer
 Testsuite: autopkgtest-pkg-ruby
 XS-Ruby-Versions: all
@@ -19,7 +20,7 @@
 Architecture: all
 XB-Ruby-Versions: ${ruby:Versions}
 Depends: ruby | ruby-interpreter,
-         ruby-loofah,
+         ruby-loofah (>= 2.2.2~),
          ${misc:Depends},
          ${shlibs:Depends}
 Description: HTML sanitization for Rails applications
diff -Nru ruby-rails-html-sanitizer-1.0.3/debian/copyright ruby-rails-html-sanitizer-1.0.4/debian/copyright
--- ruby-rails-html-sanitizer-1.0.3/debian/copyright	2016-03-05 03:25:14.000000000 +0000
+++ ruby-rails-html-sanitizer-1.0.4/debian/copyright	2018-03-23 12:42:07.000000000 +0000
@@ -1,4 +1,4 @@
-Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
 Upstream-Name: rails-html-sanitizer
 Source: https://github.com/rails/rails-html-sanitizer
 
@@ -8,7 +8,11 @@
 License: Expat
 
 Files: debian/*
-Copyright: 2015 Balasankar C <balasankarc@autistici.org>
+Copyright: 2018 Georg Faerber <georg@riseup.net>
+           2016 Christian Hofstaedtler <zeha@debian.org> 
+           2016 Cédric Boutillier <boutil@debian.org>
+           2016 Antonio Terceiro <terceiro@debian.org>
+           2015 Balasankar C <balasankarc@autistici.org>
 License: Expat
 Comment: the Debian packaging is licensed under the same terms as the original package.
 
diff -Nru ruby-rails-html-sanitizer-1.0.3/debian/patches/0001-Skip-some-tests-under-Debian.patch ruby-rails-html-sanitizer-1.0.4/debian/patches/0001-Skip-some-tests-under-Debian.patch
--- ruby-rails-html-sanitizer-1.0.3/debian/patches/0001-Skip-some-tests-under-Debian.patch	2016-03-05 03:25:14.000000000 +0000
+++ ruby-rails-html-sanitizer-1.0.4/debian/patches/0001-Skip-some-tests-under-Debian.patch	1970-01-01 00:00:00.000000000 +0000
@@ -1,51 +0,0 @@
-From: Antonio Terceiro <terceiro@debian.org>
-Date: Tue, 26 Jan 2016 19:54:52 -0200
-Subject: Skip some tests under Debian
-
-I suspect that those tests actually rely on the behavior of Nokogiri's
-patched libxml2, which is not used in Debian.
----
- test/sanitizer_test.rb | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/test/sanitizer_test.rb b/test/sanitizer_test.rb
-index f72b702..8123127 100644
---- a/test/sanitizer_test.rb
-+++ b/test/sanitizer_test.rb
-@@ -58,10 +58,12 @@ class SanitizersTest < Minitest::Test
-   end
- 
-   def test_strip_invalid_html
-+    skip "test skipped in the Debian build"
-     assert_equal "", full_sanitize("<<<bad html")
-   end
- 
-   def test_strip_nested_tags
-+    skip "test skipped in the Debian build"
-     expected = "Weia onclick='alert(document.cookie);'/&gt;rdos"
-     input = "Wei<<a>a onclick='alert(document.cookie);'</a>/>rdos"
-     assert_equal expected, full_sanitize(input)
-@@ -99,6 +101,7 @@ class SanitizersTest < Minitest::Test
-   end
- 
-   def test_strip_tags_with_many_open_quotes
-+    skip "test skipped in the Debian build"
-     assert_equal "", full_sanitize("<<<bad html>")
-   end
- 
-@@ -123,6 +126,7 @@ class SanitizersTest < Minitest::Test
-   end
- 
-   def test_strip_links_with_tags_in_tags
-+    skip "test skipped in the Debian build"
-     expected = "a href='hello'&gt;all <b>day</b> long/a&gt;"
-     input = "<<a>a href='hello'>all <b>day</b> long<</A>/a>"
-     assert_equal expected, link_sanitize(input)
-@@ -360,6 +364,7 @@ class SanitizersTest < Minitest::Test
-   end
- 
-   def test_should_sanitize_script_tag_with_multiple_open_brackets
-+    skip "test skipped in the Debian build"
-     assert_sanitized %(<<SCRIPT>alert("XSS");//<</SCRIPT>), "alert(\"XSS\");//"
-     assert_sanitized %(<iframe src=http://ha.ckers.org/scriptlet.html\n<a), ""
-   end
diff -Nru ruby-rails-html-sanitizer-1.0.3/debian/patches/series ruby-rails-html-sanitizer-1.0.4/debian/patches/series
--- ruby-rails-html-sanitizer-1.0.3/debian/patches/series	2016-03-05 03:25:14.000000000 +0000
+++ ruby-rails-html-sanitizer-1.0.4/debian/patches/series	1970-01-01 00:00:00.000000000 +0000
@@ -1 +0,0 @@
-0001-Skip-some-tests-under-Debian.patch
diff -Nru ruby-rails-html-sanitizer-1.0.3/debian/watch ruby-rails-html-sanitizer-1.0.4/debian/watch
--- ruby-rails-html-sanitizer-1.0.3/debian/watch	2016-03-05 03:25:14.000000000 +0000
+++ ruby-rails-html-sanitizer-1.0.4/debian/watch	2018-03-23 12:42:07.000000000 +0000
@@ -1,2 +1,2 @@
-version=3
-http://pkg-ruby-extras.alioth.debian.org/cgi-bin/gemwatch/rails-html-sanitizer .*/rails-html-sanitizer-(.*).tar.gz
+version=4
+https://pkg-ruby-extras.alioth.debian.org/cgi-bin/gemwatch/rails-html-sanitizer .*/rails-html-sanitizer-(.*).tar.gz
diff -Nru ruby-rails-html-sanitizer-1.0.3/lib/rails/html/sanitizer/version.rb ruby-rails-html-sanitizer-1.0.4/lib/rails/html/sanitizer/version.rb
--- ruby-rails-html-sanitizer-1.0.3/lib/rails/html/sanitizer/version.rb	2016-01-26 21:36:21.000000000 +0000
+++ ruby-rails-html-sanitizer-1.0.4/lib/rails/html/sanitizer/version.rb	2018-03-22 23:01:36.000000000 +0000
@@ -1,7 +1,7 @@
 module Rails
   module Html
     class Sanitizer
-      VERSION = "1.0.3"
+      VERSION = "1.0.4"
     end
   end
 end
diff -Nru ruby-rails-html-sanitizer-1.0.3/lib/rails/html/sanitizer.rb ruby-rails-html-sanitizer-1.0.4/lib/rails/html/sanitizer.rb
--- ruby-rails-html-sanitizer-1.0.3/lib/rails/html/sanitizer.rb	2016-01-26 21:36:21.000000000 +0000
+++ ruby-rails-html-sanitizer-1.0.4/lib/rails/html/sanitizer.rb	2018-03-22 23:01:36.000000000 +0000
@@ -61,7 +61,7 @@
     # Sanitizes html and css from an extensive white list (see link further down).
     #
     # === Whitespace
-    # We can't make any guarentees about whitespace being kept or stripped.
+    # We can't make any guarantees about whitespace being kept or stripped.
     # Loofah uses Nokogiri, which wraps either a C or Java parser for the
     # respective Ruby implementation.
     # Those two parsers determine how whitespace is ultimately handled.
diff -Nru ruby-rails-html-sanitizer-1.0.3/lib/rails/html/scrubbers.rb ruby-rails-html-sanitizer-1.0.4/lib/rails/html/scrubbers.rb
--- ruby-rails-html-sanitizer-1.0.3/lib/rails/html/scrubbers.rb	2016-01-26 21:36:21.000000000 +0000
+++ ruby-rails-html-sanitizer-1.0.4/lib/rails/html/scrubbers.rb	2018-03-22 23:01:36.000000000 +0000
@@ -28,8 +28,9 @@
     # If not, attributes are removed based on Loofahs +HTML5::Scrub.scrub_attributes+.
     #
     # class CommentScrubber < Html::PermitScrubber
-    #   def allowed_node?(node)
-    #     !%w(form script comment blockquote).include?(node.name)
+    #   def initialize
+    #     super
+    #     self.tags = %w(form script comment blockquote)
     #   end
     #
     #   def skip_node?(node)
@@ -152,6 +153,8 @@
         end
 
         node.remove_attribute(attr_node.name) if attr_name == 'src' && attr_node.value !~ /[^[:space:]]/
+
+        Loofah::HTML5::Scrub.force_correct_attribute_escaping! node
       end
     end
 
diff -Nru ruby-rails-html-sanitizer-1.0.3/metadata.yml ruby-rails-html-sanitizer-1.0.4/metadata.yml
--- ruby-rails-html-sanitizer-1.0.3/metadata.yml	2016-01-26 21:36:21.000000000 +0000
+++ ruby-rails-html-sanitizer-1.0.4/metadata.yml	1970-01-01 00:00:00.000000000 +0000
@@ -1,126 +0,0 @@
---- !ruby/object:Gem::Specification
-name: rails-html-sanitizer
-version: !ruby/object:Gem::Version
-  version: 1.0.3
-platform: ruby
-authors:
-- Rafael Mendonça França
-- Kasper Timm Hansen
-autorequire: 
-bindir: bin
-cert_chain: []
-date: 2016-01-25 00:00:00.000000000 Z
-dependencies:
-- !ruby/object:Gem::Dependency
-  name: loofah
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
-- !ruby/object:Gem::Dependency
-  name: bundler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.3'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.3'
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: minitest
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rails-dom-testing
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-description: HTML sanitization for Rails applications
-email:
-- rafaelmfranca@gmail.com
-- kaspth@gmail.com
-executables: []
-extensions: []
-extra_rdoc_files: []
-files:
-- CHANGELOG.md
-- README.md
-- lib/rails-html-sanitizer.rb
-- lib/rails/html/sanitizer.rb
-- lib/rails/html/sanitizer/version.rb
-- lib/rails/html/scrubbers.rb
-- test/sanitizer_test.rb
-- test/scrubbers_test.rb
-homepage: https://github.com/rails/rails-html-sanitizer
-licenses:
-- MIT
-metadata: {}
-post_install_message: 
-rdoc_options: []
-require_paths:
-- lib
-required_ruby_version: !ruby/object:Gem::Requirement
-  requirements:
-  - - ">="
-    - !ruby/object:Gem::Version
-      version: '0'
-required_rubygems_version: !ruby/object:Gem::Requirement
-  requirements:
-  - - ">="
-    - !ruby/object:Gem::Version
-      version: '0'
-requirements: []
-rubyforge_project: 
-rubygems_version: 2.5.1
-signing_key: 
-specification_version: 4
-summary: This gem is responsible to sanitize HTML fragments in Rails applications.
-test_files:
-- test/sanitizer_test.rb
-- test/scrubbers_test.rb
diff -Nru ruby-rails-html-sanitizer-1.0.3/MIT-LICENSE ruby-rails-html-sanitizer-1.0.4/MIT-LICENSE
--- ruby-rails-html-sanitizer-1.0.3/MIT-LICENSE	1970-01-01 00:00:00.000000000 +0000
+++ ruby-rails-html-sanitizer-1.0.4/MIT-LICENSE	2018-03-22 23:01:36.000000000 +0000
@@ -0,0 +1,23 @@
+Copyright (c) 2013-2015 Rafael Mendonça França, Kasper Timm Hansen
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
diff -Nru ruby-rails-html-sanitizer-1.0.3/rails-html-sanitizer.gemspec ruby-rails-html-sanitizer-1.0.4/rails-html-sanitizer.gemspec
--- ruby-rails-html-sanitizer-1.0.3/rails-html-sanitizer.gemspec	1970-01-01 00:00:00.000000000 +0000
+++ ruby-rails-html-sanitizer-1.0.4/rails-html-sanitizer.gemspec	2018-03-22 23:01:37.000000000 +0000
@@ -0,0 +1,46 @@
+#########################################################
+# This file has been automatically generated by gem2tgz #
+#########################################################
+# -*- encoding: utf-8 -*-
+
+Gem::Specification.new do |s|
+  s.name = "rails-html-sanitizer"
+  s.version = "1.0.4"
+
+  s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
+  s.authors = ["Rafael Mendon\u{e7}a Fran\u{e7}a", "Kasper Timm Hansen"]
+  s.date = "2018-03-22"
+  s.description = "HTML sanitization for Rails applications"
+  s.email = ["rafaelmfranca@gmail.com", "kaspth@gmail.com"]
+  s.files = ["CHANGELOG.md", "MIT-LICENSE", "README.md", "lib/rails-html-sanitizer.rb", "lib/rails/html/sanitizer.rb", "lib/rails/html/sanitizer/version.rb", "lib/rails/html/scrubbers.rb", "test/sanitizer_test.rb", "test/scrubbers_test.rb"]
+  s.homepage = "https://github.com/rails/rails-html-sanitizer"
+  s.licenses = ["MIT"]
+  s.require_paths = ["lib"]
+  s.rubygems_version = "1.8.23"
+  s.summary = "This gem is responsible to sanitize HTML fragments in Rails applications."
+  s.test_files = ["test/sanitizer_test.rb", "test/scrubbers_test.rb"]
+
+  if s.respond_to? :specification_version then
+    s.specification_version = 4
+
+    if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
+      s.add_development_dependency(%q<bundler>, ["~> 1.3"])
+      s.add_runtime_dependency(%q<loofah>, [">= 2.2.2", "~> 2.2"])
+      s.add_development_dependency(%q<minitest>, [">= 0"])
+      s.add_development_dependency(%q<rails-dom-testing>, [">= 0"])
+      s.add_development_dependency(%q<rake>, [">= 0"])
+    else
+      s.add_dependency(%q<bundler>, ["~> 1.3"])
+      s.add_dependency(%q<loofah>, [">= 2.2.2", "~> 2.2"])
+      s.add_dependency(%q<minitest>, [">= 0"])
+      s.add_dependency(%q<rails-dom-testing>, [">= 0"])
+      s.add_dependency(%q<rake>, [">= 0"])
+    end
+  else
+    s.add_dependency(%q<bundler>, ["~> 1.3"])
+    s.add_dependency(%q<loofah>, [">= 2.2.2", "~> 2.2"])
+    s.add_dependency(%q<minitest>, [">= 0"])
+    s.add_dependency(%q<rails-dom-testing>, [">= 0"])
+    s.add_dependency(%q<rake>, [">= 0"])
+  end
+end
diff -Nru ruby-rails-html-sanitizer-1.0.3/README.md ruby-rails-html-sanitizer-1.0.4/README.md
--- ruby-rails-html-sanitizer-1.0.3/README.md	2016-01-26 21:36:21.000000000 +0000
+++ ruby-rails-html-sanitizer-1.0.4/README.md	2018-03-22 23:01:36.000000000 +0000
@@ -99,17 +99,15 @@
 
 ```ruby
 class CommentScrubber < Rails::Html::PermitScrubber
-  def allowed_node?(node)
-    !%w(form script comment blockquote).include?(node.name)
+  def initialize
+    super
+    self.tags = %w( form script comment blockquote )
+    self.attributes = %w( style )
   end
 
   def skip_node?(node)
     node.text?
   end
-
-  def scrub_attribute?(name)
-    name == "style"
-  end
 end
 ```
 
diff -Nru ruby-rails-html-sanitizer-1.0.3/test/sanitizer_test.rb ruby-rails-html-sanitizer-1.0.4/test/sanitizer_test.rb
--- ruby-rails-html-sanitizer-1.0.3/test/sanitizer_test.rb	2016-01-26 21:36:21.000000000 +0000
+++ ruby-rails-html-sanitizer-1.0.4/test/sanitizer_test.rb	2018-03-22 23:01:36.000000000 +0000
@@ -33,7 +33,7 @@
     assert_equal %(<h1>hello </h1>), xpath_sanitize(html, xpaths: %w(.//script))
   end
 
-  def test_remove_xpaths_removes_all_occurences_of_xpath
+  def test_remove_xpaths_removes_all_occurrences_of_xpath
     html = %(<section><header><script>code!</script></header><p>hello <script>code!</script></p></section>)
     assert_equal %(<section><header></header><p>hello </p></section>), xpath_sanitize(html, xpaths: %w(.//script))
   end
@@ -58,11 +58,11 @@
   end
 
   def test_strip_invalid_html
-    assert_equal "", full_sanitize("<<<bad html")
+    assert_equal "&lt;&lt;", full_sanitize("<<<bad html")
   end
 
   def test_strip_nested_tags
-    expected = "Weia onclick='alert(document.cookie);'/&gt;rdos"
+    expected = "Wei&lt;a onclick='alert(document.cookie);'/&gt;rdos"
     input = "Wei<<a>a onclick='alert(document.cookie);'</a>/>rdos"
     assert_equal expected, full_sanitize(input)
   end
@@ -74,7 +74,7 @@
     assert_equal expected, full_sanitize(input)
   end
 
-  def test_strip_comments
+  def test_remove_unclosed_tags
     assert_equal "This is ", full_sanitize("This is <-- not\n a comment here.")
   end
 
@@ -87,7 +87,9 @@
   end
 
   def test_strip_blank_string
-    [nil, '', '   '].each { |blank| assert_equal blank, full_sanitize(blank) }
+    assert_nil full_sanitize(nil)
+    assert_equal "", full_sanitize("")
+    assert_equal "   ", full_sanitize("   ")
   end
 
   def test_strip_tags_with_plaintext
@@ -98,8 +100,8 @@
     assert_equal "This is a test.", full_sanitize("<p>This <u>is<u> a <a href='test.html'><strong>test</strong></a>.</p>")
   end
 
-  def test_strip_tags_with_many_open_quotes
-    assert_equal "", full_sanitize("<<<bad html>")
+  def test_escape_tags_with_many_open_quotes
+    assert_equal "&lt;&lt;", full_sanitize("<<<bad html>")
   end
 
   def test_strip_tags_with_sentence
@@ -123,7 +125,7 @@
   end
 
   def test_strip_links_with_tags_in_tags
-    expected = "a href='hello'&gt;all <b>day</b> long/a&gt;"
+    expected = "&lt;a href='hello'&gt;all <b>day</b> long&lt;/a&gt;"
     input = "<<a>a href='hello'>all <b>day</b> long<</A>/a>"
     assert_equal expected, link_sanitize(input)
   end
@@ -360,7 +362,7 @@
   end
 
   def test_should_sanitize_script_tag_with_multiple_open_brackets
-    assert_sanitized %(<<SCRIPT>alert("XSS");//<</SCRIPT>), "alert(\"XSS\");//"
+    assert_sanitized %(<<SCRIPT>alert("XSS");//<</SCRIPT>), "&lt;alert(\"XSS\");//&lt;"
     assert_sanitized %(<iframe src=http://ha.ckers.org/scriptlet.html\n<a), ""
   end
 
@@ -383,13 +385,13 @@
 
   def test_should_sanitize_illegal_style_properties
     raw      = %(display:block; position:absolute; left:0; top:0; width:100%; height:100%; z-index:1; background-color:black; background-image:url(http://www.ragingplatypus.com/i/cam-full.jpg); background-x:center; background-y:center; background-repeat:repeat;)
-    expected = %(display: block; width: 100%; height: 100%; background-color: black; background-x: center; background-y: center;)
+    expected = %(display:block;width:100%;height:100%;background-color:black;background-x:center;background-y:center;)
     assert_equal expected, sanitize_css(raw)
   end
 
   def test_should_sanitize_with_trailing_space
     raw = "display:block; "
-    expected = "display: block;"
+    expected = "display:block;"
     assert_equal expected, sanitize_css(raw)
   end
 
@@ -482,6 +484,38 @@
     assert_equal %(<a data-foo="foo">foo</a>), white_list_sanitize(text, attributes: ['data-foo'])
   end
 
+  def test_uri_escaping_of_href_attr_in_a_tag_in_white_list_sanitizer
+    html = %{<a href='examp<!--" unsafeattr=foo()>-->le.com'>test</a>}
+
+    text = white_list_sanitize(html)
+
+    assert_equal %{<a href="examp<!--%22%20unsafeattr=foo()>-->le.com">test</a>}, text
+  end
+
+  def test_uri_escaping_of_src_attr_in_a_tag_in_white_list_sanitizer
+    html = %{<a src='examp<!--" unsafeattr=foo()>-->le.com'>test</a>}
+
+    text = white_list_sanitize(html)
+
+    assert_equal %{<a src="examp<!--%22%20unsafeattr=foo()>-->le.com">test</a>}, text
+  end
+
+  def test_uri_escaping_of_name_attr_in_a_tag_in_white_list_sanitizer
+    html = %{<a name='examp<!--" unsafeattr=foo()>-->le.com'>test</a>}
+
+    text = white_list_sanitize(html)
+
+    assert_equal %{<a name="examp<!--%22%20unsafeattr=foo()>-->le.com">test</a>}, text
+  end
+
+  def test_uri_escaping_of_name_action_in_a_tag_in_white_list_sanitizer
+    html = %{<a action='examp<!--" unsafeattr=foo()>-->le.com'>test</a>}
+
+    text = white_list_sanitize(html, attributes: ['action'])
+
+    assert_equal %{<a action="examp<!--%22%20unsafeattr=foo()>-->le.com">test</a>}, text
+  end
+
 protected
 
   def xpath_sanitize(input, options = {})