diff --git a/Gemfile.lock b/Gemfile.lock
index 4f5eb6b58f9..e52d40fe86e 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -208,13 +208,14 @@ GEM
     omniauth-twitter (1.3.0)
       omniauth-oauth (~> 1.1)
       rack
-    onebox (1.7.3)
+    onebox (1.7.4)
       fast_blank (>= 1.0.0)
       htmlentities (~> 4.3.4)
       moneta (~> 0.8)
       multi_json (~> 1.11)
       mustache
       nokogiri (~> 1.6.6)
+      sanitize
     openid-redis-store (0.0.2)
       redis
       ruby-openid
diff --git a/spec/components/onebox/engine/discourse_local_onebox_spec.rb b/spec/components/onebox/engine/discourse_local_onebox_spec.rb
index 3a6d0862ce6..752eebc6e83 100644
--- a/spec/components/onebox/engine/discourse_local_onebox_spec.rb
+++ b/spec/components/onebox/engine/discourse_local_onebox_spec.rb
@@ -10,19 +10,19 @@ describe Onebox::Engine::DiscourseLocalOnebox do
 
     it "returns a link if post isn't found" do
       url = "#{Discourse.base_url}/t/not-exist/3/2"
-      expect(Onebox.preview(url).to_s).to eq("<a href='#{url}'>#{url}</a>")
+      expect(Onebox.preview(url).to_s).to eq(%|<a href="#{url}">#{url}</a>|)
     end
 
     it "returns a link if not allowed to see the post" do
       url = "#{Discourse.base_url}#{post2.url}"
       Guardian.any_instance.expects(:can_see_post?).returns(false)
-      expect(Onebox.preview(url).to_s).to eq("<a href='#{url}'>#{url}</a>")
+      expect(Onebox.preview(url).to_s).to eq(%|<a href="#{url}">#{url}</a>|)
     end
 
     it "returns a link if post is hidden" do
       hidden_post = Fabricate(:post, topic: post.topic, post_number: 2, hidden: true, hidden_reason_id: Post.hidden_reasons[:flag_threshold_reached])
       url = "#{Discourse.base_url}#{hidden_post.url}"
-      expect(Onebox.preview(url).to_s).to eq("<a href='#{url}'>#{url}</a>")
+      expect(Onebox.preview(url).to_s).to eq(%|<a href="#{url}">#{url}</a>|)
     end
 
     it "returns some onebox goodness if post exists and can be seen" do
@@ -43,13 +43,13 @@ describe Onebox::Engine::DiscourseLocalOnebox do
 
     it "returns a link if topic isn't found" do
       url = "#{Discourse.base_url}/t/not-found/123"
-      expect(Onebox.preview(url).to_s).to eq("<a href='#{url}'>#{url}</a>")
+      expect(Onebox.preview(url).to_s).to eq(%|<a href="#{url}">#{url}</a>|)
     end
 
     it "returns a link if not allowed to see the topic" do
       url = topic.url
       Guardian.any_instance.expects(:can_see_topic?).returns(false)
-      expect(Onebox.preview(url).to_s).to eq("<a href='#{url}'>#{url}</a>")
+      expect(Onebox.preview(url).to_s).to eq(%|<a href="#{url}">#{url}</a>|)
     end
 
     it "replaces emoji in the title" do
@@ -78,13 +78,15 @@ describe Onebox::Engine::DiscourseLocalOnebox do
     it "returns some onebox goodness for audio file" do
       url = "#{Discourse.base_url}#{path}.MP3"
       html = Onebox.preview(url).to_s
-      expect(html).to eq("<audio controls><source src='#{url}'><a href='#{url}'>#{url}</a></audio>")
+      # </source> will be removed by the browser
+      # need to fix https://github.com/rubys/nokogumbo/issues/14
+      expect(html).to eq(%|<audio controls=""><source src="#{url}"></source><a href="#{url}">#{url}</a></audio>|)
     end
 
     it "returns some onebox goodness for video file" do
       url = "#{Discourse.base_url}#{path}.mov"
       html = Onebox.preview(url).to_s
-      expect(html).to eq("<video width='100%' height='100%' controls><source src='#{url}'><a href='#{url}'>#{url}</a></video>")
+      expect(html).to eq(%|<video width="100%" height="100%" controls=""><source src="#{url}"></source><a href="#{url}">#{url}</a></video>|)
     end
   end