Redmine

Starting with Nokogiri 1.19.5, the following test fails:

Failure:
Redmine::WikiFormatting::CommonMark::SanitizationFilterTest#test_should_sanitize_html_strings [test/unit/lib/redmine/wiki_formatting/common_mark/sanitization_filter_test.rb:156]:
--- expected
+++ actual
@@ -1 +1 @@
-"Lorem <a href=\"pants\" title=\"foo>ipsum <a href=\"><strong>dolor</strong></a> sit<br>amet " 
+"Lorem <a href=\"pants\" title=\"foo&gt;ipsum &lt;a href=\"><strong>dolor</strong></a> sit<br>amet " 

The failure occurs because updating Nokogiri to 1.19.5 or later changes the sanitized output. Since Nokogiri 1.19.5, < and > in attribute values are escaped as < and >, following whatwg/html#6362 (see sparklemotion/nokogiri#3741). This is an intended change in Nokogiri and does not affect how the HTML is displayed.

The attached patch updates the expected value in the test to match the new output. It changes test code only. Because the updated expected value does not match the output of Nokogiri 1.19.4 and earlier, the patch requires Nokogiri 1.19.5 or later and should be applied together with #44704, which updates the Nokogiri requirement.