  def test_html5_data_attributes_without_hyphenation
    assert_equal("<div data-author_id='123' data-biz='baz' data-foo='bar'></div>\n",
      render("%div{:data => {:author_id => 123, :foo => 'bar', :biz => 'baz'}}",
        :hyphenate_data_attrs => false))

    assert_equal("<div data-one_plus_one='2'></div>\n",
      render("%div{:data => {:one_plus_one => 1+1}}",
        :hyphenate_data_attrs => false))

    assert_equal("<div data-foo='Here&#x0027;s a \"quoteful\" string.'></div>\n",
      render(%{%div{:data => {:foo => %{Here's a "quoteful" string.}}}},
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.