    it 'should escape the content of removed `plaintext` elements' do
      Sanitize.fragment('<plaintext>hello! <script>alert(0)</script>')
        .must_equal 'hello! &lt;script&gt;alert(0)&lt;/script&gt;'
    end
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.