From 07236016bcc78a82205093b3e067bf4a1bb07d88 Mon Sep 17 00:00:00 2001
From: "Pia B." <pia.bregulla@web.de>
Date: Wed, 3 Jun 2026 12:12:37 +0200
Subject: [PATCH] Merge commit from fork

* add guard clause to check for node attributes

* check for encoding attribute specifically

* check for encoding attribute specifically

* change spec
---
 lib/sanitize_ext/sanitize_config.rb | 4 +++-
 spec/lib/sanitize/config_spec.rb    | 8 ++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/lib/sanitize_ext/sanitize_config.rb b/lib/sanitize_ext/sanitize_config.rb
index f30eec476c..3c3d697eda 100644
--- a/lib/sanitize_ext/sanitize_config.rb
+++ b/lib/sanitize_ext/sanitize_config.rb
@@ -83,8 +83,10 @@ class Sanitize
       # next, we find the plain-text description
       is_annotation_with_encoding = lambda do |encoding, node|
         return false unless node.name == 'annotation'
+        encoding_attr = node.attributes['encoding']
+        return false if encoding_attr.nil?
 
-        node.attributes['encoding'].value == encoding
+        encoding_attr.value == encoding
       end
 
       annotation = semantics.children.find(&is_annotation_with_encoding.curry['application/x-tex'])
diff --git a/spec/lib/sanitize/config_spec.rb b/spec/lib/sanitize/config_spec.rb
index b4c849c427..7baa1423b7 100644
--- a/spec/lib/sanitize/config_spec.rb
+++ b/spec/lib/sanitize/config_spec.rb
@@ -38,6 +38,14 @@ RSpec.describe Sanitize::Config do
       expect(Sanitize.fragment('<a href="foo://bar">Test&lt;a href="https://example.com"&gt;test&lt;/a&gt;</a>', subject)).to eq 'Test&lt;a href="https://example.com"&gt;test&lt;/a&gt;'
     end
 
+    it 'removes math when unparsable due to missing attributes' do
+      expect(Sanitize.fragment('<math><semantics><annotation>x</annotation></semantics></math>', subject)).to eq ''
+    end
+
+    it 'removes math when unparsable due to missing encoding attribute' do
+      expect(Sanitize.fragment('<math><semantics><annotation class="foo">x</annotation></semantics></math>', subject)).to eq ''
+    end
+
     it 'keeps a with href' do
       expect(Sanitize.fragment('<a href="http://example.com">Test</a>', subject)).to eq '<a href="http://example.com" rel="nofollow noopener" target="_blank">Test</a>'
     end