Fix build: should we escape < & >?

Author: Juanito Fatas

Gemfile

@@ -3,5 +3,16 @@ source 'https://rubygems.org'
 # Specify your gem's dependencies in html-sanitizer.gemspec
 gemspec
 
-gem "nokogiri", RUBY_VERSION < "2.1" ? "~> 1.6.0" : ">= 1.7"
+nokogiri_version = begin
+  case
+  when RUBY_VERSION < "2.1"
+    "~> 1.6.0"
+  when RUBY_VERSION < "2.3"
+    "~> 1.9.1"
+  else
+    ">= 1.10.0"
+  end
+end
+
+gem "nokogiri", nokogiri_version
 gem "activesupport", RUBY_VERSION < "2.2.2" ? "~> 4.2.0" : ">= 5"

test/sanitizer_test.rb

@@ -489,31 +489,31 @@ def test_uri_escaping_of_href_attr_in_a_tag_in_white_list_sanitizer
 
     text = white_list_sanitize(html)
 
-    assert_equal %{<a href="examp<!--%22%20unsafeattr=foo()>-->le.com">test</a>}, text
+    assert_equal %{<a href=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>}, text
   end
 
   def test_uri_escaping_of_src_attr_in_a_tag_in_white_list_sanitizer
     html = %{<a src='examp<!--" unsafeattr=foo()>-->le.com'>test</a>}
 
     text = white_list_sanitize(html)
 
-    assert_equal %{<a src="examp<!--%22%20unsafeattr=foo()>-->le.com">test</a>}, text
+    assert_equal %{<a src=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>}, text
   end
 
   def test_uri_escaping_of_name_attr_in_a_tag_in_white_list_sanitizer
     html = %{<a name='examp<!--" unsafeattr=foo()>-->le.com'>test</a>}
 
     text = white_list_sanitize(html)
 
-    assert_equal %{<a name="examp<!--%22%20unsafeattr=foo()>-->le.com">test</a>}, text
+    assert_equal %{<a name=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>}, text
   end
 
   def test_uri_escaping_of_name_action_in_a_tag_in_white_list_sanitizer
     html = %{<a action='examp<!--" unsafeattr=foo()>-->le.com'>test</a>}
 
     text = white_list_sanitize(html, attributes: ['action'])
 
-    assert_equal %{<a action="examp<!--%22%20unsafeattr=foo()>-->le.com">test</a>}, text
+    assert_equal %{<a action=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>}, text
   end
 
 protected