MediaWiki  1.28.0
Sanitizer.php
Go to the documentation of this file.
1 <?php
31 class Sanitizer {
37  '/&([A-Za-z0-9\x80-\xff]+);
38  |&\#([0-9]+);
39  |&\#[xX]([0-9A-Fa-f]+);
40  |(&)/x';
41 
46  const ELEMENT_BITS_REGEX = '!^(/?)([A-Za-z][^\t\n\v />\0]*+)([^>]*?)(/?>)([^<]*)$!';
47 
56  const EVIL_URI_PATTERN = '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i';
57  const XMLNS_ATTRIBUTE_PATTERN = "/^xmlns:[:A-Z_a-z-.0-9]+$/";
58 
64  private static $htmlEntities = [
65  'Aacute' => 193,
66  'aacute' => 225,
67  'Acirc' => 194,
68  'acirc' => 226,
69  'acute' => 180,
70  'AElig' => 198,
71  'aelig' => 230,
72  'Agrave' => 192,
73  'agrave' => 224,
74  'alefsym' => 8501,
75  'Alpha' => 913,
76  'alpha' => 945,
77  'amp' => 38,
78  'and' => 8743,
79  'ang' => 8736,
80  'apos' => 39, // New in XHTML & HTML 5; avoid in output for compatibility with IE.
81  'Aring' => 197,
82  'aring' => 229,
83  'asymp' => 8776,
84  'Atilde' => 195,
85  'atilde' => 227,
86  'Auml' => 196,
87  'auml' => 228,
88  'bdquo' => 8222,
89  'Beta' => 914,
90  'beta' => 946,
91  'brvbar' => 166,
92  'bull' => 8226,
93  'cap' => 8745,
94  'Ccedil' => 199,
95  'ccedil' => 231,
96  'cedil' => 184,
97  'cent' => 162,
98  'Chi' => 935,
99  'chi' => 967,
100  'circ' => 710,
101  'clubs' => 9827,
102  'cong' => 8773,
103  'copy' => 169,
104  'crarr' => 8629,
105  'cup' => 8746,
106  'curren' => 164,
107  'dagger' => 8224,
108  'Dagger' => 8225,
109  'darr' => 8595,
110  'dArr' => 8659,
111  'deg' => 176,
112  'Delta' => 916,
113  'delta' => 948,
114  'diams' => 9830,
115  'divide' => 247,
116  'Eacute' => 201,
117  'eacute' => 233,
118  'Ecirc' => 202,
119  'ecirc' => 234,
120  'Egrave' => 200,
121  'egrave' => 232,
122  'empty' => 8709,
123  'emsp' => 8195,
124  'ensp' => 8194,
125  'Epsilon' => 917,
126  'epsilon' => 949,
127  'equiv' => 8801,
128  'Eta' => 919,
129  'eta' => 951,
130  'ETH' => 208,
131  'eth' => 240,
132  'Euml' => 203,
133  'euml' => 235,
134  'euro' => 8364,
135  'exist' => 8707,
136  'fnof' => 402,
137  'forall' => 8704,
138  'frac12' => 189,
139  'frac14' => 188,
140  'frac34' => 190,
141  'frasl' => 8260,
142  'Gamma' => 915,
143  'gamma' => 947,
144  'ge' => 8805,
145  'gt' => 62,
146  'harr' => 8596,
147  'hArr' => 8660,
148  'hearts' => 9829,
149  'hellip' => 8230,
150  'Iacute' => 205,
151  'iacute' => 237,
152  'Icirc' => 206,
153  'icirc' => 238,
154  'iexcl' => 161,
155  'Igrave' => 204,
156  'igrave' => 236,
157  'image' => 8465,
158  'infin' => 8734,
159  'int' => 8747,
160  'Iota' => 921,
161  'iota' => 953,
162  'iquest' => 191,
163  'isin' => 8712,
164  'Iuml' => 207,
165  'iuml' => 239,
166  'Kappa' => 922,
167  'kappa' => 954,
168  'Lambda' => 923,
169  'lambda' => 955,
170  'lang' => 9001,
171  'laquo' => 171,
172  'larr' => 8592,
173  'lArr' => 8656,
174  'lceil' => 8968,
175  'ldquo' => 8220,
176  'le' => 8804,
177  'lfloor' => 8970,
178  'lowast' => 8727,
179  'loz' => 9674,
180  'lrm' => 8206,
181  'lsaquo' => 8249,
182  'lsquo' => 8216,
183  'lt' => 60,
184  'macr' => 175,
185  'mdash' => 8212,
186  'micro' => 181,
187  'middot' => 183,
188  'minus' => 8722,
189  'Mu' => 924,
190  'mu' => 956,
191  'nabla' => 8711,
192  'nbsp' => 160,
193  'ndash' => 8211,
194  'ne' => 8800,
195  'ni' => 8715,
196  'not' => 172,
197  'notin' => 8713,
198  'nsub' => 8836,
199  'Ntilde' => 209,
200  'ntilde' => 241,
201  'Nu' => 925,
202  'nu' => 957,
203  'Oacute' => 211,
204  'oacute' => 243,
205  'Ocirc' => 212,
206  'ocirc' => 244,
207  'OElig' => 338,
208  'oelig' => 339,
209  'Ograve' => 210,
210  'ograve' => 242,
211  'oline' => 8254,
212  'Omega' => 937,
213  'omega' => 969,
214  'Omicron' => 927,
215  'omicron' => 959,
216  'oplus' => 8853,
217  'or' => 8744,
218  'ordf' => 170,
219  'ordm' => 186,
220  'Oslash' => 216,
221  'oslash' => 248,
222  'Otilde' => 213,
223  'otilde' => 245,
224  'otimes' => 8855,
225  'Ouml' => 214,
226  'ouml' => 246,
227  'para' => 182,
228  'part' => 8706,
229  'permil' => 8240,
230  'perp' => 8869,
231  'Phi' => 934,
232  'phi' => 966,
233  'Pi' => 928,
234  'pi' => 960,
235  'piv' => 982,
236  'plusmn' => 177,
237  'pound' => 163,
238  'prime' => 8242,
239  'Prime' => 8243,
240  'prod' => 8719,
241  'prop' => 8733,
242  'Psi' => 936,
243  'psi' => 968,
244  'quot' => 34,
245  'radic' => 8730,
246  'rang' => 9002,
247  'raquo' => 187,
248  'rarr' => 8594,
249  'rArr' => 8658,
250  'rceil' => 8969,
251  'rdquo' => 8221,
252  'real' => 8476,
253  'reg' => 174,
254  'rfloor' => 8971,
255  'Rho' => 929,
256  'rho' => 961,
257  'rlm' => 8207,
258  'rsaquo' => 8250,
259  'rsquo' => 8217,
260  'sbquo' => 8218,
261  'Scaron' => 352,
262  'scaron' => 353,
263  'sdot' => 8901,
264  'sect' => 167,
265  'shy' => 173,
266  'Sigma' => 931,
267  'sigma' => 963,
268  'sigmaf' => 962,
269  'sim' => 8764,
270  'spades' => 9824,
271  'sub' => 8834,
272  'sube' => 8838,
273  'sum' => 8721,
274  'sup' => 8835,
275  'sup1' => 185,
276  'sup2' => 178,
277  'sup3' => 179,
278  'supe' => 8839,
279  'szlig' => 223,
280  'Tau' => 932,
281  'tau' => 964,
282  'there4' => 8756,
283  'Theta' => 920,
284  'theta' => 952,
285  'thetasym' => 977,
286  'thinsp' => 8201,
287  'THORN' => 222,
288  'thorn' => 254,
289  'tilde' => 732,
290  'times' => 215,
291  'trade' => 8482,
292  'Uacute' => 218,
293  'uacute' => 250,
294  'uarr' => 8593,
295  'uArr' => 8657,
296  'Ucirc' => 219,
297  'ucirc' => 251,
298  'Ugrave' => 217,
299  'ugrave' => 249,
300  'uml' => 168,
301  'upsih' => 978,
302  'Upsilon' => 933,
303  'upsilon' => 965,
304  'Uuml' => 220,
305  'uuml' => 252,
306  'weierp' => 8472,
307  'Xi' => 926,
308  'xi' => 958,
309  'Yacute' => 221,
310  'yacute' => 253,
311  'yen' => 165,
312  'Yuml' => 376,
313  'yuml' => 255,
314  'Zeta' => 918,
315  'zeta' => 950,
316  'zwj' => 8205,
317  'zwnj' => 8204
318  ];
319 
323  private static $htmlEntityAliases = [
324  'רלמ' => 'rlm',
325  'رلم' => 'rlm',
326  ];
327 
331  private static $attribsRegex;
332 
340  static function getAttribsRegex() {
341  if ( self::$attribsRegex === null ) {
342  $attribFirst = '[:A-Z_a-z0-9]';
343  $attrib = '[:A-Z_a-z-.0-9]';
344  $space = '[\x09\x0a\x0c\x0d\x20]';
345  self::$attribsRegex =
346  "/(?:^|$space)({$attribFirst}{$attrib}*)
347  ($space*=$space*
348  (?:
349  # The attribute value: quoted or alone
350  \"([^\"]*)(?:\"|\$)
351  | '([^']*)(?:'|\$)
352  | (((?!$space|>).)*)
353  )
354  )?(?=$space|\$)/sx";
355  }
356  return self::$attribsRegex;
357  }
358 
365  public static function getRecognizedTagData( $extratags = [], $removetags = [] ) {
366  global $wgAllowImageTag;
367 
368  static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
369  $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
370 
371  // Base our staticInitialised variable off of the global config state so that if the globals
372  // are changed (like in the screwed up test system) we will re-initialise the settings.
373  $globalContext = $wgAllowImageTag;
374  if ( !$staticInitialised || $staticInitialised != $globalContext ) {
375  $htmlpairsStatic = [ # Tags that must be closed
376  'b', 'bdi', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
377  'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
378  'strike', 'strong', 'tt', 'var', 'div', 'center',
379  'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
380  'ruby', 'rb', 'rp', 'rt', 'rtc', 'p', 'span', 'abbr', 'dfn',
381  'kbd', 'samp', 'data', 'time', 'mark'
382  ];
383  $htmlsingle = [
384  'br', 'wbr', 'hr', 'li', 'dt', 'dd', 'meta', 'link'
385  ];
386 
387  # Elements that cannot have close tags. This is (not coincidentally)
388  # also the list of tags for which the HTML 5 parsing algorithm
389  # requires you to "acknowledge the token's self-closing flag", i.e.
390  # a self-closing tag like <br/> is not an HTML 5 parse error only
391  # for this list.
392  $htmlsingleonly = [
393  'br', 'wbr', 'hr', 'meta', 'link'
394  ];
395 
396  $htmlnest = [ # Tags that can be nested--??
397  'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
398  'li', 'dl', 'dt', 'dd', 'font', 'big', 'small', 'sub', 'sup', 'span',
399  'var', 'kbd', 'samp', 'em', 'strong', 'q', 'ruby', 'bdo'
400  ];
401  $tabletags = [ # Can only appear inside table, we will close them
402  'td', 'th', 'tr',
403  ];
404  $htmllist = [ # Tags used by list
405  'ul', 'ol',
406  ];
407  $listtags = [ # Tags that can appear in a list
408  'li',
409  ];
410 
411  if ( $wgAllowImageTag ) {
412  $htmlsingle[] = 'img';
413  $htmlsingleonly[] = 'img';
414  }
415 
416  $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
417  $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
418 
419  # Convert them all to hashtables for faster lookup
420  $vars = [ 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
421  'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' ];
422  foreach ( $vars as $var ) {
423  $$var = array_flip( $$var );
424  }
425  $staticInitialised = $globalContext;
426  }
427 
428  # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
429  $extratags = array_flip( $extratags );
430  $removetags = array_flip( $removetags );
431  $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
432  $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ), $removetags );
433 
434  return [
435  'htmlpairs' => $htmlpairs,
436  'htmlsingle' => $htmlsingle,
437  'htmlsingleonly' => $htmlsingleonly,
438  'htmlnest' => $htmlnest,
439  'tabletags' => $tabletags,
440  'htmllist' => $htmllist,
441  'listtags' => $listtags,
442  'htmlsingleallowed' => $htmlsingleallowed,
443  'htmlelements' => $htmlelements,
444  ];
445  }
446 
462  public static function removeHTMLtags( $text, $processCallback = null,
463  $args = [], $extratags = [], $removetags = [], $warnCallback = null
464  ) {
465  extract( self::getRecognizedTagData( $extratags, $removetags ) );
466 
467  # Remove HTML comments
468  $text = Sanitizer::removeHTMLcomments( $text );
469  $bits = explode( '<', $text );
470  $text = str_replace( '>', '&gt;', array_shift( $bits ) );
471  if ( !MWTidy::isEnabled() ) {
472  $tagstack = $tablestack = [];
473  foreach ( $bits as $x ) {
474  $regs = [];
475  # $slash: Does the current element start with a '/'?
476  # $t: Current element name
477  # $params: String between element name and >
478  # $brace: Ending '>' or '/>'
479  # $rest: Everything until the next element of $bits
480  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
481  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
482  } else {
483  $slash = $t = $params = $brace = $rest = null;
484  }
485 
486  $badtag = false;
487  $t = strtolower( $t );
488  if ( isset( $htmlelements[$t] ) ) {
489  # Check our stack
490  if ( $slash && isset( $htmlsingleonly[$t] ) ) {
491  $badtag = true;
492  } elseif ( $slash ) {
493  # Closing a tag... is it the one we just opened?
494  MediaWiki\suppressWarnings();
495  $ot = array_pop( $tagstack );
496  MediaWiki\restoreWarnings();
497 
498  if ( $ot != $t ) {
499  if ( isset( $htmlsingleallowed[$ot] ) ) {
500  # Pop all elements with an optional close tag
501  # and see if we find a match below them
502  $optstack = [];
503  array_push( $optstack, $ot );
504  MediaWiki\suppressWarnings();
505  $ot = array_pop( $tagstack );
506  MediaWiki\restoreWarnings();
507  while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
508  array_push( $optstack, $ot );
509  MediaWiki\suppressWarnings();
510  $ot = array_pop( $tagstack );
511  MediaWiki\restoreWarnings();
512  }
513  if ( $t != $ot ) {
514  # No match. Push the optional elements back again
515  $badtag = true;
516  MediaWiki\suppressWarnings();
517  $ot = array_pop( $optstack );
518  MediaWiki\restoreWarnings();
519  while ( $ot ) {
520  array_push( $tagstack, $ot );
521  MediaWiki\suppressWarnings();
522  $ot = array_pop( $optstack );
523  MediaWiki\restoreWarnings();
524  }
525  }
526  } else {
527  MediaWiki\suppressWarnings();
528  array_push( $tagstack, $ot );
529  MediaWiki\restoreWarnings();
530 
531  # <li> can be nested in <ul> or <ol>, skip those cases:
532  if ( !isset( $htmllist[$ot] ) || !isset( $listtags[$t] ) ) {
533  $badtag = true;
534  }
535  }
536  } else {
537  if ( $t == 'table' ) {
538  $tagstack = array_pop( $tablestack );
539  }
540  }
541  $newparams = '';
542  } else {
543  # Keep track for later
544  if ( isset( $tabletags[$t] ) && !in_array( 'table', $tagstack ) ) {
545  $badtag = true;
546  } elseif ( in_array( $t, $tagstack ) && !isset( $htmlnest[$t] ) ) {
547  $badtag = true;
548  #  Is it a self closed htmlpair ? (bug 5487)
549  } elseif ( $brace == '/>' && isset( $htmlpairs[$t] ) ) {
550  // Eventually we'll just remove the self-closing
551  // slash, in order to be consistent with HTML5
552  // semantics.
553  // $brace = '>';
554  // For now, let's just warn authors to clean up.
555  if ( is_callable( $warnCallback ) ) {
556  call_user_func_array( $warnCallback, [ 'deprecated-self-close-category' ] );
557  }
558  $badtag = true;
559  } elseif ( isset( $htmlsingleonly[$t] ) ) {
560  # Hack to force empty tag for unclosable elements
561  $brace = '/>';
562  } elseif ( isset( $htmlsingle[$t] ) ) {
563  # Hack to not close $htmlsingle tags
564  $brace = null;
565  # Still need to push this optionally-closed tag to
566  # the tag stack so that we can match end tags
567  # instead of marking them as bad.
568  array_push( $tagstack, $t );
569  } elseif ( isset( $tabletags[$t] ) && in_array( $t, $tagstack ) ) {
570  // New table tag but forgot to close the previous one
571  $text .= "</$t>";
572  } else {
573  if ( $t == 'table' ) {
574  array_push( $tablestack, $tagstack );
575  $tagstack = [];
576  }
577  array_push( $tagstack, $t );
578  }
579 
580  # Replace any variables or template parameters with
581  # plaintext results.
582  if ( is_callable( $processCallback ) ) {
583  call_user_func_array( $processCallback, [ &$params, $args ] );
584  }
585 
586  if ( !Sanitizer::validateTag( $params, $t ) ) {
587  $badtag = true;
588  }
589 
590  # Strip non-approved attributes from the tag
591  $newparams = Sanitizer::fixTagAttributes( $params, $t );
592  }
593  if ( !$badtag ) {
594  $rest = str_replace( '>', '&gt;', $rest );
595  $close = ( $brace == '/>' && !$slash ) ? ' /' : '';
596  $text .= "<$slash$t$newparams$close>$rest";
597  continue;
598  }
599  }
600  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
601  }
602  # Close off any remaining tags
603  while ( is_array( $tagstack ) && ( $t = array_pop( $tagstack ) ) ) {
604  $text .= "</$t>\n";
605  if ( $t == 'table' ) {
606  $tagstack = array_pop( $tablestack );
607  }
608  }
609  } else {
610  # this might be possible using tidy itself
611  foreach ( $bits as $x ) {
612  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
613  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
614 
615  $badtag = false;
616  $t = strtolower( $t );
617  if ( isset( $htmlelements[$t] ) ) {
618  if ( is_callable( $processCallback ) ) {
619  call_user_func_array( $processCallback, [ &$params, $args ] );
620  }
621 
622  if ( $brace == '/>' && !( isset( $htmlsingle[$t] ) || isset( $htmlsingleonly[$t] ) ) ) {
623  // Eventually we'll just remove the self-closing
624  // slash, in order to be consistent with HTML5
625  // semantics.
626  // $brace = '>';
627  // For now, let's just warn authors to clean up.
628  if ( is_callable( $warnCallback ) ) {
629  call_user_func_array( $warnCallback, [ 'deprecated-self-close-category' ] );
630  }
631  }
632  if ( !Sanitizer::validateTag( $params, $t ) ) {
633  $badtag = true;
634  }
635 
636  $newparams = Sanitizer::fixTagAttributes( $params, $t );
637  if ( !$badtag ) {
638  if ( $brace === '/>' && !isset( $htmlsingleonly[$t] ) ) {
639  # Interpret self-closing tags as empty tags even when
640  # HTML 5 would interpret them as start tags. Such input
641  # is commonly seen on Wikimedia wikis with this intention.
642  $brace = "></$t>";
643  }
644 
645  $rest = str_replace( '>', '&gt;', $rest );
646  $text .= "<$slash$t$newparams$brace$rest";
647  continue;
648  }
649  }
650  }
651  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
652  }
653  }
654  return $text;
655  }
656 
666  public static function removeHTMLcomments( $text ) {
667  while ( ( $start = strpos( $text, '<!--' ) ) !== false ) {
668  $end = strpos( $text, '-->', $start + 4 );
669  if ( $end === false ) {
670  # Unterminated comment; bail out
671  break;
672  }
673 
674  $end += 3;
675 
676  # Trim space and newline if the comment is both
677  # preceded and followed by a newline
678  $spaceStart = max( $start - 1, 0 );
679  $spaceLen = $end - $spaceStart;
680  while ( substr( $text, $spaceStart, 1 ) === ' ' && $spaceStart > 0 ) {
681  $spaceStart--;
682  $spaceLen++;
683  }
684  while ( substr( $text, $spaceStart + $spaceLen, 1 ) === ' ' ) {
685  $spaceLen++;
686  }
687  if ( substr( $text, $spaceStart, 1 ) === "\n"
688  && substr( $text, $spaceStart + $spaceLen, 1 ) === "\n" ) {
689  # Remove the comment, leading and trailing
690  # spaces, and leave only one newline.
691  $text = substr_replace( $text, "\n", $spaceStart, $spaceLen + 1 );
692  } else {
693  # Remove just the comment.
694  $text = substr_replace( $text, '', $start, $end - $start );
695  }
696  }
697  return $text;
698  }
699 
712  static function validateTag( $params, $element ) {
714 
715  if ( $element == 'meta' || $element == 'link' ) {
716  if ( !isset( $params['itemprop'] ) ) {
717  // <meta> and <link> must have an itemprop="" otherwise they are not valid or safe in content
718  return false;
719  }
720  if ( $element == 'meta' && !isset( $params['content'] ) ) {
721  // <meta> must have a content="" for the itemprop
722  return false;
723  }
724  if ( $element == 'link' && !isset( $params['href'] ) ) {
725  // <link> must have an associated href=""
726  return false;
727  }
728  }
729 
730  return true;
731  }
732 
748  static function validateTagAttributes( $attribs, $element ) {
750  Sanitizer::attributeWhitelist( $element ) );
751  }
752 
768  static function validateAttributes( $attribs, $whitelist ) {
769  $whitelist = array_flip( $whitelist );
770  $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
771 
772  $out = [];
773  foreach ( $attribs as $attribute => $value ) {
774  # Allow XML namespace declaration to allow RDFa
775  if ( preg_match( self::XMLNS_ATTRIBUTE_PATTERN, $attribute ) ) {
776  if ( !preg_match( self::EVIL_URI_PATTERN, $value ) ) {
777  $out[$attribute] = $value;
778  }
779 
780  continue;
781  }
782 
783  # Allow any attribute beginning with "data-"
784  # However:
785  # * data-ooui is reserved for ooui
786  # * data-mw and data-parsoid are reserved for parsoid
787  # * data-mw-<name here> is reserved for extensions (or core) if
788  # they need to communicate some data to the client and want to be
789  # sure that it isn't coming from an untrusted user.
790  # * Ensure that the attribute is not namespaced by banning
791  # colons.
792  if ( !preg_match( '/^data-(?!ooui|mw|parsoid)[^:]*$/i', $attribute )
793  && !isset( $whitelist[$attribute] )
794  ) {
795  continue;
796  }
797 
798  # Strip javascript "expression" from stylesheets.
799  # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
800  if ( $attribute == 'style' ) {
802  }
803 
804  # Escape HTML id attributes
805  if ( $attribute === 'id' ) {
806  $value = Sanitizer::escapeId( $value, 'noninitial' );
807  }
808 
809  # Escape HTML id reference lists
810  if ( $attribute === 'aria-describedby'
811  || $attribute === 'aria-flowto'
812  || $attribute === 'aria-labelledby'
813  || $attribute === 'aria-owns'
814  ) {
816  }
817 
818  // RDFa and microdata properties allow URLs, URIs and/or CURIs.
819  // Check them for sanity.
820  if ( $attribute === 'rel' || $attribute === 'rev'
821  # RDFa
822  || $attribute === 'about' || $attribute === 'property'
823  || $attribute === 'resource' || $attribute === 'datatype'
824  || $attribute === 'typeof'
825  # HTML5 microdata
826  || $attribute === 'itemid' || $attribute === 'itemprop'
827  || $attribute === 'itemref' || $attribute === 'itemscope'
828  || $attribute === 'itemtype'
829  ) {
830  // Paranoia. Allow "simple" values but suppress javascript
831  if ( preg_match( self::EVIL_URI_PATTERN, $value ) ) {
832  continue;
833  }
834  }
835 
836  # NOTE: even though elements using href/src are not allowed directly, supply
837  # validation code that can be used by tag hook handlers, etc
838  if ( $attribute === 'href' || $attribute === 'src' ) {
839  if ( !preg_match( $hrefExp, $value ) ) {
840  continue; // drop any href or src attributes not using an allowed protocol.
841  // NOTE: this also drops all relative URLs
842  }
843  }
844 
845  // If this attribute was previously set, override it.
846  // Output should only have one attribute of each name.
847  $out[$attribute] = $value;
848  }
849 
850  # itemtype, itemid, itemref don't make sense without itemscope
851  if ( !array_key_exists( 'itemscope', $out ) ) {
852  unset( $out['itemtype'] );
853  unset( $out['itemid'] );
854  unset( $out['itemref'] );
855  }
856  # TODO: Strip itemprop if we aren't descendants of an itemscope or pointed to by an itemref.
857 
858  return $out;
859  }
860 
871  static function mergeAttributes( $a, $b ) {
872  $out = array_merge( $a, $b );
873  if ( isset( $a['class'] ) && isset( $b['class'] )
874  && is_string( $a['class'] ) && is_string( $b['class'] )
875  && $a['class'] !== $b['class']
876  ) {
877  $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
878  -1, PREG_SPLIT_NO_EMPTY );
879  $out['class'] = implode( ' ', array_unique( $classes ) );
880  }
881  return $out;
882  }
883 
893  public static function normalizeCss( $value ) {
894 
895  // Decode character references like &#123;
897 
898  // Decode escape sequences and line continuation
899  // See the grammar in the CSS 2 spec, appendix D.
900  // This has to be done AFTER decoding character references.
901  // This means it isn't possible for this function to return
902  // unsanitized escape sequences. It is possible to manufacture
903  // input that contains character references that decode to
904  // escape sequences that decode to character references, but
905  // it's OK for the return value to contain character references
906  // because the caller is supposed to escape those anyway.
907  static $decodeRegex;
908  if ( !$decodeRegex ) {
909  $space = '[\\x20\\t\\r\\n\\f]';
910  $nl = '(?:\\n|\\r\\n|\\r|\\f)';
911  $backslash = '\\\\';
912  $decodeRegex = "/ $backslash
913  (?:
914  ($nl) | # 1. Line continuation
915  ([0-9A-Fa-f]{1,6})$space? | # 2. character number
916  (.) | # 3. backslash cancelling special meaning
917  () | # 4. backslash at end of string
918  )/xu";
919  }
920  $value = preg_replace_callback( $decodeRegex,
921  [ __CLASS__, 'cssDecodeCallback' ], $value );
922 
923  // Normalize Halfwidth and Fullwidth Unicode block that IE6 might treat as ascii
924  $value = preg_replace_callback(
925  '/[!-[]-z]/u', // U+FF01 to U+FF5A, excluding U+FF3C (bug 58088)
926  function ( $matches ) {
928  if ( $cp === false ) {
929  return '';
930  }
931  return chr( $cp - 65248 ); // ASCII range \x21-\x7A
932  },
933  $value
934  );
935 
936  // Convert more characters IE6 might treat as ascii
937  // U+0280, U+0274, U+207F, U+029F, U+026A, U+207D, U+208D
938  $value = str_replace(
939  [ 'ʀ', 'ɴ', 'ⁿ', 'ʟ', 'ɪ', '⁽', '₍' ],
940  [ 'r', 'n', 'n', 'l', 'i', '(', '(' ],
941  $value
942  );
943 
944  // Let the value through if it's nothing but a single comment, to
945  // allow other functions which may reject it to pass some error
946  // message through.
947  if ( !preg_match( '! ^ \s* /\* [^*\\/]* \*/ \s* $ !x', $value ) ) {
948  // Remove any comments; IE gets token splitting wrong
949  // This must be done AFTER decoding character references and
950  // escape sequences, because those steps can introduce comments
951  // This step cannot introduce character references or escape
952  // sequences, because it replaces comments with spaces rather
953  // than removing them completely.
954  $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value );
955 
956  // Remove anything after a comment-start token, to guard against
957  // incorrect client implementations.
958  $commentPos = strpos( $value, '/*' );
959  if ( $commentPos !== false ) {
960  $value = substr( $value, 0, $commentPos );
961  }
962  }
963 
964  // S followed by repeat, iteration, or prolonged sound marks,
965  // which IE will treat as "ss"
966  $value = preg_replace(
967  '/s(?:
968  \xE3\x80\xB1 | # U+3031
969  \xE3\x82\x9D | # U+309D
970  \xE3\x83\xBC | # U+30FC
971  \xE3\x83\xBD | # U+30FD
972  \xEF\xB9\xBC | # U+FE7C
973  \xEF\xB9\xBD | # U+FE7D
974  \xEF\xBD\xB0 # U+FF70
975  )/ix',
976  'ss',
977  $value
978  );
979 
980  return $value;
981  }
982 
1001  static function checkCss( $value ) {
1002  $value = self::normalizeCss( $value );
1003 
1004  // Reject problematic keywords and control characters
1005  if ( preg_match( '/[\000-\010\013\016-\037\177]/', $value ) ||
1006  strpos( $value, UtfNormal\Constants::UTF8_REPLACEMENT ) !== false ) {
1007  return '/* invalid control char */';
1008  } elseif ( preg_match(
1009  '! expression
1010  | filter\s*:
1011  | accelerator\s*:
1012  | -o-link\s*:
1013  | -o-link-source\s*:
1014  | -o-replace\s*:
1015  | url\s*\(
1016  | image\s*\(
1017  | image-set\s*\(
1018  | attr\s*\([^)]+[\s,]+url
1019  !ix', $value ) ) {
1020  return '/* insecure input */';
1021  }
1022  return $value;
1023  }
1024 
1029  static function cssDecodeCallback( $matches ) {
1030  if ( $matches[1] !== '' ) {
1031  // Line continuation
1032  return '';
1033  } elseif ( $matches[2] !== '' ) {
1034  $char = UtfNormal\Utils::codepointToUtf8( hexdec( $matches[2] ) );
1035  } elseif ( $matches[3] !== '' ) {
1036  $char = $matches[3];
1037  } else {
1038  $char = '\\';
1039  }
1040  if ( $char == "\n" || $char == '"' || $char == "'" || $char == '\\' ) {
1041  // These characters need to be escaped in strings
1042  // Clean up the escape sequence to avoid parsing errors by clients
1043  return '\\' . dechex( ord( $char ) ) . ' ';
1044  } else {
1045  // Decode unnecessary escape
1046  return $char;
1047  }
1048  }
1049 
1071  static function fixTagAttributes( $text, $element, $sorted = false ) {
1072  if ( trim( $text ) == '' ) {
1073  return '';
1074  }
1075 
1076  $decoded = Sanitizer::decodeTagAttributes( $text );
1077  $stripped = Sanitizer::validateTagAttributes( $decoded, $element );
1078 
1079  if ( $sorted ) {
1080  ksort( $stripped );
1081  }
1082 
1083  return Sanitizer::safeEncodeTagAttributes( $stripped );
1084  }
1085 
1091  static function encodeAttribute( $text ) {
1092  $encValue = htmlspecialchars( $text, ENT_QUOTES );
1093 
1094  // Whitespace is normalized during attribute decoding,
1095  // so if we've been passed non-spaces we must encode them
1096  // ahead of time or they won't be preserved.
1097  $encValue = strtr( $encValue, [
1098  "\n" => '&#10;',
1099  "\r" => '&#13;',
1100  "\t" => '&#9;',
1101  ] );
1102 
1103  return $encValue;
1104  }
1105 
1112  static function safeEncodeAttribute( $text ) {
1113  $encValue = Sanitizer::encodeAttribute( $text );
1114 
1115  # Templates and links may be expanded in later parsing,
1116  # creating invalid or dangerous output. Suppress this.
1117  $encValue = strtr( $encValue, [
1118  '<' => '&lt;', // This should never happen,
1119  '>' => '&gt;', // we've received invalid input
1120  '"' => '&quot;', // which should have been escaped.
1121  '{' => '&#123;',
1122  '[' => '&#91;',
1123  "''" => '&#39;&#39;',
1124  'ISBN' => '&#73;SBN',
1125  'RFC' => '&#82;FC',
1126  'PMID' => '&#80;MID',
1127  '|' => '&#124;',
1128  '__' => '&#95;_',
1129  ] );
1130 
1131  # Stupid hack
1132  $encValue = preg_replace_callback(
1133  '/((?i)' . wfUrlProtocols() . ')/',
1134  [ 'Sanitizer', 'armorLinksCallback' ],
1135  $encValue );
1136  return $encValue;
1137  }
1138 
1170  static function escapeId( $id, $options = [] ) {
1172  $options = (array)$options;
1173 
1174  $id = Sanitizer::decodeCharReferences( $id );
1175 
1176  if ( $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) {
1177  $id = preg_replace( '/[ \t\n\r\f_\'"&#%]+/', '_', $id );
1178  $id = trim( $id, '_' );
1179  if ( $id === '' ) {
1180  // Must have been all whitespace to start with.
1181  return '_';
1182  } else {
1183  return $id;
1184  }
1185  }
1186 
1187  // HTML4-style escaping
1188  static $replace = [
1189  '%3A' => ':',
1190  '%' => '.'
1191  ];
1192 
1193  $id = urlencode( strtr( $id, ' ', '_' ) );
1194  $id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
1195 
1196  if ( !preg_match( '/^[a-zA-Z]/', $id ) && !in_array( 'noninitial', $options ) ) {
1197  // Initial character must be a letter!
1198  $id = "x$id";
1199  }
1200  return $id;
1201  }
1202 
1220  static function escapeIdReferenceList( $referenceString, $options = [] ) {
1221  # Explode the space delimited list string into an array of tokens
1222  $references = preg_split( '/\s+/', "{$referenceString}", -1, PREG_SPLIT_NO_EMPTY );
1223 
1224  # Escape each token as an id
1225  foreach ( $references as &$ref ) {
1226  $ref = Sanitizer::escapeId( $ref, $options );
1227  }
1228 
1229  # Merge the array back to a space delimited list string
1230  # If the array is empty, the result will be an empty string ('')
1231  $referenceString = implode( ' ', $references );
1232 
1233  return $referenceString;
1234  }
1235 
1247  static function escapeClass( $class ) {
1248  // Convert ugly stuff to underscores and kill underscores in ugly places
1249  return rtrim( preg_replace(
1250  [ '/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/', '/_+/' ],
1251  '_',
1252  $class ), '_' );
1253  }
1254 
1262  static function escapeHtmlAllowEntities( $html ) {
1264  # It seems wise to escape ' as well as ", as a matter of course. Can't
1265  # hurt.
1266  $html = htmlspecialchars( $html, ENT_QUOTES );
1267  return $html;
1268  }
1269 
1275  private static function armorLinksCallback( $matches ) {
1276  return str_replace( ':', '&#58;', $matches[1] );
1277  }
1278 
1287  public static function decodeTagAttributes( $text ) {
1288  if ( trim( $text ) == '' ) {
1289  return [];
1290  }
1291 
1292  $attribs = [];
1293  $pairs = [];
1294  if ( !preg_match_all(
1295  self::getAttribsRegex(),
1296  $text,
1297  $pairs,
1298  PREG_SET_ORDER ) ) {
1299  return $attribs;
1300  }
1301 
1302  foreach ( $pairs as $set ) {
1303  $attribute = strtolower( $set[1] );
1305 
1306  // Normalize whitespace
1307  $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1308  $value = trim( $value );
1309 
1310  // Decode character references
1312  }
1313  return $attribs;
1314  }
1315 
1323  public static function safeEncodeTagAttributes( $assoc_array ) {
1324  $attribs = [];
1325  foreach ( $assoc_array as $attribute => $value ) {
1326  $encAttribute = htmlspecialchars( $attribute );
1327  $encValue = Sanitizer::safeEncodeAttribute( $value );
1328 
1329  $attribs[] = "$encAttribute=\"$encValue\"";
1330  }
1331  return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : '';
1332  }
1333 
1342  private static function getTagAttributeCallback( $set ) {
1343  if ( isset( $set[5] ) ) {
1344  # No quotes.
1345  return $set[5];
1346  } elseif ( isset( $set[4] ) ) {
1347  # Single-quoted
1348  return $set[4];
1349  } elseif ( isset( $set[3] ) ) {
1350  # Double-quoted
1351  return $set[3];
1352  } elseif ( !isset( $set[2] ) ) {
1353  # In XHTML, attributes must have a value so return an empty string.
1354  # See "Empty attribute syntax",
1355  # http://www.w3.org/TR/html5/syntax.html#syntax-attribute-name
1356  return "";
1357  } else {
1358  throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1359  }
1360  }
1361 
1366  private static function normalizeWhitespace( $text ) {
1367  return preg_replace(
1368  '/\r\n|[\x20\x0d\x0a\x09]/',
1369  ' ',
1370  $text );
1371  }
1372 
1382  return trim( preg_replace( '/[ _]+/', ' ', $section ) );
1383  }
1384 
1400  static function normalizeCharReferences( $text ) {
1401  return preg_replace_callback(
1402  self::CHAR_REFS_REGEX,
1403  [ 'Sanitizer', 'normalizeCharReferencesCallback' ],
1404  $text );
1405  }
1406 
1412  $ret = null;
1413  if ( $matches[1] != '' ) {
1415  } elseif ( $matches[2] != '' ) {
1417  } elseif ( $matches[3] != '' ) {
1419  }
1420  if ( is_null( $ret ) ) {
1421  return htmlspecialchars( $matches[0] );
1422  } else {
1423  return $ret;
1424  }
1425  }
1426 
1437  static function normalizeEntity( $name ) {
1438  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1439  return '&' . self::$htmlEntityAliases[$name] . ';';
1440  } elseif ( in_array( $name, [ 'lt', 'gt', 'amp', 'quot' ] ) ) {
1441  return "&$name;";
1442  } elseif ( isset( self::$htmlEntities[$name] ) ) {
1443  return '&#' . self::$htmlEntities[$name] . ';';
1444  } else {
1445  return "&amp;$name;";
1446  }
1447  }
1448 
1453  static function decCharReference( $codepoint ) {
1454  $point = intval( $codepoint );
1455  if ( Sanitizer::validateCodepoint( $point ) ) {
1456  return sprintf( '&#%d;', $point );
1457  } else {
1458  return null;
1459  }
1460  }
1461 
1466  static function hexCharReference( $codepoint ) {
1467  $point = hexdec( $codepoint );
1468  if ( Sanitizer::validateCodepoint( $point ) ) {
1469  return sprintf( '&#x%x;', $point );
1470  } else {
1471  return null;
1472  }
1473  }
1474 
1481  private static function validateCodepoint( $codepoint ) {
1482  # U+000C is valid in HTML5 but not allowed in XML.
1483  # U+000D is valid in XML but not allowed in HTML5.
1484  # U+007F - U+009F are disallowed in HTML5 (control characters).
1485  return $codepoint == 0x09
1486  || $codepoint == 0x0a
1487  || ( $codepoint >= 0x20 && $codepoint <= 0x7e )
1488  || ( $codepoint >= 0xa0 && $codepoint <= 0xd7ff )
1489  || ( $codepoint >= 0xe000 && $codepoint <= 0xfffd )
1490  || ( $codepoint >= 0x10000 && $codepoint <= 0x10ffff );
1491  }
1492 
1500  public static function decodeCharReferences( $text ) {
1501  return preg_replace_callback(
1502  self::CHAR_REFS_REGEX,
1503  [ 'Sanitizer', 'decodeCharReferencesCallback' ],
1504  $text );
1505  }
1506 
1517  public static function decodeCharReferencesAndNormalize( $text ) {
1519  $text = preg_replace_callback(
1520  self::CHAR_REFS_REGEX,
1521  [ 'Sanitizer', 'decodeCharReferencesCallback' ],
1522  $text, /* limit */ -1, $count );
1523 
1524  if ( $count ) {
1525  return $wgContLang->normalize( $text );
1526  } else {
1527  return $text;
1528  }
1529  }
1530 
1536  if ( $matches[1] != '' ) {
1537  return Sanitizer::decodeEntity( $matches[1] );
1538  } elseif ( $matches[2] != '' ) {
1539  return Sanitizer::decodeChar( intval( $matches[2] ) );
1540  } elseif ( $matches[3] != '' ) {
1541  return Sanitizer::decodeChar( hexdec( $matches[3] ) );
1542  }
1543  # Last case should be an ampersand by itself
1544  return $matches[0];
1545  }
1546 
1554  static function decodeChar( $codepoint ) {
1555  if ( Sanitizer::validateCodepoint( $codepoint ) ) {
1556  return UtfNormal\Utils::codepointToUtf8( $codepoint );
1557  } else {
1559  }
1560  }
1561 
1570  static function decodeEntity( $name ) {
1571  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1572  $name = self::$htmlEntityAliases[$name];
1573  }
1574  if ( isset( self::$htmlEntities[$name] ) ) {
1575  return UtfNormal\Utils::codepointToUtf8( self::$htmlEntities[$name] );
1576  } else {
1577  return "&$name;";
1578  }
1579  }
1580 
1587  static function attributeWhitelist( $element ) {
1589  return isset( $list[$element] )
1590  ? $list[$element]
1591  : [];
1592  }
1593 
1599  static function setupAttributeWhitelist() {
1600  static $whitelist;
1601 
1602  if ( $whitelist !== null ) {
1603  return $whitelist;
1604  }
1605 
1606  $common = [
1607  # HTML
1608  'id',
1609  'class',
1610  'style',
1611  'lang',
1612  'dir',
1613  'title',
1614 
1615  # WAI-ARIA
1616  'aria-describedby',
1617  'aria-flowto',
1618  'aria-label',
1619  'aria-labelledby',
1620  'aria-owns',
1621  'role',
1622 
1623  # RDFa
1624  # These attributes are specified in section 9 of
1625  # http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1626  'about',
1627  'property',
1628  'resource',
1629  'datatype',
1630  'typeof',
1631 
1632  # Microdata. These are specified by
1633  # http://www.whatwg.org/html/microdata.html#the-microdata-model
1634  'itemid',
1635  'itemprop',
1636  'itemref',
1637  'itemscope',
1638  'itemtype',
1639  ];
1640 
1641  $block = array_merge( $common, [ 'align' ] );
1642  $tablealign = [ 'align', 'valign' ];
1643  $tablecell = [
1644  'abbr',
1645  'axis',
1646  'headers',
1647  'scope',
1648  'rowspan',
1649  'colspan',
1650  'nowrap', # deprecated
1651  'width', # deprecated
1652  'height', # deprecated
1653  'bgcolor', # deprecated
1654  ];
1655 
1656  # Numbers refer to sections in HTML 4.01 standard describing the element.
1657  # See: http://www.w3.org/TR/html4/
1658  $whitelist = [
1659  # 7.5.4
1660  'div' => $block,
1661  'center' => $common, # deprecated
1662  'span' => $common,
1663 
1664  # 7.5.5
1665  'h1' => $block,
1666  'h2' => $block,
1667  'h3' => $block,
1668  'h4' => $block,
1669  'h5' => $block,
1670  'h6' => $block,
1671 
1672  # 7.5.6
1673  # address
1674 
1675  # 8.2.4
1676  'bdo' => $common,
1677 
1678  # 9.2.1
1679  'em' => $common,
1680  'strong' => $common,
1681  'cite' => $common,
1682  'dfn' => $common,
1683  'code' => $common,
1684  'samp' => $common,
1685  'kbd' => $common,
1686  'var' => $common,
1687  'abbr' => $common,
1688  # acronym
1689 
1690  # 9.2.2
1691  'blockquote' => array_merge( $common, [ 'cite' ] ),
1692  'q' => array_merge( $common, [ 'cite' ] ),
1693 
1694  # 9.2.3
1695  'sub' => $common,
1696  'sup' => $common,
1697 
1698  # 9.3.1
1699  'p' => $block,
1700 
1701  # 9.3.2
1702  'br' => array_merge( $common, [ 'clear' ] ),
1703 
1704  # http://www.whatwg.org/html/text-level-semantics.html#the-wbr-element
1705  'wbr' => $common,
1706 
1707  # 9.3.4
1708  'pre' => array_merge( $common, [ 'width' ] ),
1709 
1710  # 9.4
1711  'ins' => array_merge( $common, [ 'cite', 'datetime' ] ),
1712  'del' => array_merge( $common, [ 'cite', 'datetime' ] ),
1713 
1714  # 10.2
1715  'ul' => array_merge( $common, [ 'type' ] ),
1716  'ol' => array_merge( $common, [ 'type', 'start', 'reversed' ] ),
1717  'li' => array_merge( $common, [ 'type', 'value' ] ),
1718 
1719  # 10.3
1720  'dl' => $common,
1721  'dd' => $common,
1722  'dt' => $common,
1723 
1724  # 11.2.1
1725  'table' => array_merge( $common,
1726  [ 'summary', 'width', 'border', 'frame',
1727  'rules', 'cellspacing', 'cellpadding',
1728  'align', 'bgcolor',
1729  ] ),
1730 
1731  # 11.2.2
1732  'caption' => $block,
1733 
1734  # 11.2.3
1735  'thead' => $common,
1736  'tfoot' => $common,
1737  'tbody' => $common,
1738 
1739  # 11.2.4
1740  'colgroup' => array_merge( $common, [ 'span' ] ),
1741  'col' => array_merge( $common, [ 'span' ] ),
1742 
1743  # 11.2.5
1744  'tr' => array_merge( $common, [ 'bgcolor' ], $tablealign ),
1745 
1746  # 11.2.6
1747  'td' => array_merge( $common, $tablecell, $tablealign ),
1748  'th' => array_merge( $common, $tablecell, $tablealign ),
1749 
1750  # 12.2
1751  # NOTE: <a> is not allowed directly, but the attrib
1752  # whitelist is used from the Parser object
1753  'a' => array_merge( $common, [ 'href', 'rel', 'rev' ] ), # rel/rev esp. for RDFa
1754 
1755  # 13.2
1756  # Not usually allowed, but may be used for extension-style hooks
1757  # such as <math> when it is rasterized, or if $wgAllowImageTag is
1758  # true
1759  'img' => array_merge( $common, [ 'alt', 'src', 'width', 'height' ] ),
1760 
1761  # 15.2.1
1762  'tt' => $common,
1763  'b' => $common,
1764  'i' => $common,
1765  'big' => $common,
1766  'small' => $common,
1767  'strike' => $common,
1768  's' => $common,
1769  'u' => $common,
1770 
1771  # 15.2.2
1772  'font' => array_merge( $common, [ 'size', 'color', 'face' ] ),
1773  # basefont
1774 
1775  # 15.3
1776  'hr' => array_merge( $common, [ 'width' ] ),
1777 
1778  # HTML Ruby annotation text module, simple ruby only.
1779  # http://www.whatwg.org/html/text-level-semantics.html#the-ruby-element
1780  'ruby' => $common,
1781  # rbc
1782  'rb' => $common,
1783  'rp' => $common,
1784  'rt' => $common, # array_merge( $common, array( 'rbspan' ) ),
1785  'rtc' => $common,
1786 
1787  # MathML root element, where used for extensions
1788  # 'title' may not be 100% valid here; it's XHTML
1789  # http://www.w3.org/TR/REC-MathML/
1790  'math' => [ 'class', 'style', 'id', 'title' ],
1791 
1792  # HTML 5 section 4.6
1793  'bdi' => $common,
1794 
1795  # HTML5 elements, defined by:
1796  # http://www.whatwg.org/html/
1797  'data' => array_merge( $common, [ 'value' ] ),
1798  'time' => array_merge( $common, [ 'datetime' ] ),
1799  'mark' => $common,
1800 
1801  // meta and link are only permitted by removeHTMLtags when Microdata
1802  // is enabled so we don't bother adding a conditional to hide these
1803  // Also meta and link are only valid in WikiText as Microdata elements
1804  // (ie: validateTag rejects tags missing the attributes needed for Microdata)
1805  // So we don't bother including $common attributes that have no purpose.
1806  'meta' => [ 'itemprop', 'content' ],
1807  'link' => [ 'itemprop', 'href' ],
1808  ];
1809 
1810  return $whitelist;
1811  }
1812 
1823  static function stripAllTags( $text ) {
1824  # Actual <tags>
1825  $text = StringUtils::delimiterReplace( '<', '>', '', $text );
1826 
1827  # Normalize &entities and whitespace
1828  $text = self::decodeCharReferences( $text );
1829  $text = self::normalizeWhitespace( $text );
1830 
1831  return $text;
1832  }
1833 
1843  static function hackDocType() {
1844  $out = "<!DOCTYPE html [\n";
1845  foreach ( self::$htmlEntities as $entity => $codepoint ) {
1846  $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1847  }
1848  $out .= "]>\n";
1849  return $out;
1850  }
1851 
1856  static function cleanUrl( $url ) {
1857  # Normalize any HTML entities in input. They will be
1858  # re-escaped by makeExternalLink().
1859  $url = Sanitizer::decodeCharReferences( $url );
1860 
1861  # Escape any control characters introduced by the above step
1862  $url = preg_replace_callback( '/[\][<>"\\x00-\\x20\\x7F\|]/',
1863  [ __CLASS__, 'cleanUrlCallback' ], $url );
1864 
1865  # Validate hostname portion
1866  $matches = [];
1867  if ( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1868  list( /* $whole */, $protocol, $host, $rest ) = $matches;
1869 
1870  // Characters that will be ignored in IDNs.
1871  // https://tools.ietf.org/html/rfc3454#section-3.1
1872  // Strip them before further processing so blacklists and such work.
1873  $strip = "/
1874  \\s| # general whitespace
1875  \xc2\xad| # 00ad SOFT HYPHEN
1876  \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1877  \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1878  \xe2\x81\xa0| # 2060 WORD JOINER
1879  \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1880  \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
1881  \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1882  \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1883  \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1884  \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1885  \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1886  [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe0f VARIATION SELECTOR-1-16
1887  /xuD";
1888 
1889  $host = preg_replace( $strip, '', $host );
1890 
1891  // IPv6 host names are bracketed with []. Url-decode these.
1892  if ( substr_compare( "//%5B", $host, 0, 5 ) === 0 &&
1893  preg_match( '!^//%5B([0-9A-Fa-f:.]+)%5D((:\d+)?)$!', $host, $matches )
1894  ) {
1895  $host = '//[' . $matches[1] . ']' . $matches[2];
1896  }
1897 
1898  // @todo FIXME: Validate hostnames here
1899 
1900  return $protocol . $host . $rest;
1901  } else {
1902  return $url;
1903  }
1904  }
1905 
1910  static function cleanUrlCallback( $matches ) {
1911  return urlencode( $matches[0] );
1912  }
1913 
1942  public static function validateEmail( $addr ) {
1943  $result = null;
1944  if ( !Hooks::run( 'isValidEmailAddr', [ $addr, &$result ] ) ) {
1945  return $result;
1946  }
1947 
1948  // Please note strings below are enclosed in brackets [], this make the
1949  // hyphen "-" a range indicator. Hence it is double backslashed below.
1950  // See bug 26948
1951  $rfc5322_atext = "a-z0-9!#$%&'*+\\-\/=?^_`{|}~";
1952  $rfc1034_ldh_str = "a-z0-9\\-";
1953 
1954  $html5_email_regexp = "/
1955  ^ # start of string
1956  [$rfc5322_atext\\.]+ # user part which is liberal :p
1957  @ # 'apostrophe'
1958  [$rfc1034_ldh_str]+ # First domain part
1959  (\\.[$rfc1034_ldh_str]+)* # Following part prefixed with a dot
1960  $ # End of string
1961  /ix"; // case Insensitive, eXtended
1962 
1963  return (bool)preg_match( $html5_email_regexp, $addr );
1964  }
1965 }
utf8ToCodepoint($char)
Determine the Unicode codepoint of a single-character UTF-8 sequence.
you don t have to do a grep find to see where the $wgReverseTitle variable is used
Definition: hooks.txt:117
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if that
Definition: deferred.txt:11
static decCharReference($codepoint)
Definition: Sanitizer.php:1453
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses & $html
Definition: hooks.txt:1936
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global list
Definition: deferred.txt:11
static decodeTagAttributes($text)
Return an associative array of attribute names and values from a partial tag string.
Definition: Sanitizer.php:1287
this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that probably a stub it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output $out
Definition: hooks.txt:802
static normalizeEntity($name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the equivalent numeric entity re...
Definition: Sanitizer.php:1437
the array() calling protocol came about after MediaWiki 1.4rc1.
static safeEncodeTagAttributes($assoc_array)
Build a partial tag string from an associative array of attribute names and values as returned by dec...
Definition: Sanitizer.php:1323
static normalizeCharReferencesCallback($matches)
Definition: Sanitizer.php:1411
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses & $ret
Definition: hooks.txt:1936
static setupAttributeWhitelist()
Foreach array key (an allowed HTML element), return an array of allowed attributes.
Definition: Sanitizer.php:1599
static isEnabled()
Definition: MWTidy.php:79
static fixTagAttributes($text, $element, $sorted=false)
Take a tag soup fragment listing an HTML element's attributes and normalize it to well-formed XML...
Definition: Sanitizer.php:1071
static decodeCharReferencesCallback($matches)
Definition: Sanitizer.php:1535
static cssDecodeCallback($matches)
Definition: Sanitizer.php:1029
null for the local wiki Added in
Definition: hooks.txt:1555
$value
static escapeClass($class)
Given a value, escape it so that it can be used as a CSS class and return it.
Definition: Sanitizer.php:1247
static hackDocType()
Hack up a private DOCTYPE with HTML's standard entity declarations.
Definition: Sanitizer.php:1843
static cleanUrl($url)
Definition: Sanitizer.php:1856
static stripAllTags($text)
Take a fragment of (potentially invalid) HTML and return a version with any tags removed, encoded as plain text.
Definition: Sanitizer.php:1823
when a variable name is used in a it is silently declared as a new local masking the global
Definition: design.txt:93
const UTF8_REPLACEMENT
static hexCharReference($codepoint)
Definition: Sanitizer.php:1466
static validateTagAttributes($attribs, $element)
Take an array of attribute names and values and normalize or discard illegal values for the given ele...
Definition: Sanitizer.php:748
static normalizeWhitespace($text)
Definition: Sanitizer.php:1366
static static static $attribsRegex
Lazy-initialised attributes regex, see getAttribsRegex()
Definition: Sanitizer.php:325
The index of the header message $result[1]=The index of the body text message $result[2 through n]=Parameters passed to body text message.Please note the header message cannot receive/use parameters. 'ImportHandleLogItemXMLTag':When parsing a XML tag in a log item.Return false to stop further processing of the tag $reader:XMLReader object $logInfo:Array of information 'ImportHandlePageXMLTag':When parsing a XML tag in a page.Return false to stop further processing of the tag $reader:XMLReader object &$pageInfo:Array of information 'ImportHandleRevisionXMLTag':When parsing a XML tag in a page revision.Return false to stop further processing of the tag $reader:XMLReader object $pageInfo:Array of page information $revisionInfo:Array of revision information 'ImportHandleToplevelXMLTag':When parsing a top level XML tag.Return false to stop further processing of the tag $reader:XMLReader object 'ImportHandleUploadXMLTag':When parsing a XML tag in a file upload.Return false to stop further processing of the tag $reader:XMLReader object $revisionInfo:Array of information 'ImportLogInterwikiLink':Hook to change the interwiki link used in log entries and edit summaries for transwiki imports.&$fullInterwikiPrefix:Interwiki prefix, may contain colons.&$pageTitle:String that contains page title. 'ImportSources':Called when reading from the $wgImportSources configuration variable.Can be used to lazy-load the import sources list.&$importSources:The value of $wgImportSources.Modify as necessary.See the comment in DefaultSettings.php for the detail of how to structure this array. 'InfoAction':When building information to display on the action=info page.$context:IContextSource object &$pageInfo:Array of information 'InitializeArticleMaybeRedirect':MediaWiki check to see if title is a redirect.&$title:Title object for the current page &$request:WebRequest &$ignoreRedirect:boolean to skip redirect check &$target:Title/string of redirect target &$article:Article object 'InternalParseBeforeLinks':during Parser's internalParse method before links but after nowiki/noinclude/includeonly/onlyinclude and other processings.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InternalParseBeforeSanitize':during Parser's internalParse method just before the parser removes unwanted/dangerous HTML tags and after nowiki/noinclude/includeonly/onlyinclude and other processings.Ideal for syntax-extensions after template/parser function execution which respect nowiki and HTML-comments.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InterwikiLoadPrefix':When resolving if a given prefix is an interwiki or not.Return true without providing an interwiki to continue interwiki search.$prefix:interwiki prefix we are looking for.&$iwData:output array describing the interwiki with keys iw_url, iw_local, iw_trans and optionally iw_api and iw_wikiid. 'InvalidateEmailComplete':Called after a user's email has been invalidated successfully.$user:user(object) whose email is being invalidated 'IRCLineURL':When constructing the URL to use in an IRC notification.Callee may modify $url and $query, URL will be constructed as $url.$query &$url:URL to index.php &$query:Query string $rc:RecentChange object that triggered url generation 'IsFileCacheable':Override the result of Article::isFileCacheable()(if true) &$article:article(object) being checked 'IsTrustedProxy':Override the result of IP::isTrustedProxy() &$ip:IP being check &$result:Change this value to override the result of IP::isTrustedProxy() 'IsUploadAllowedFromUrl':Override the result of UploadFromUrl::isAllowedUrl() $url:URL used to upload from &$allowed:Boolean indicating if uploading is allowed for given URL 'isValidEmailAddr':Override the result of Sanitizer::validateEmail(), for instance to return false if the domain name doesn't match your organization.$addr:The e-mail address entered by the user &$result:Set this and return false to override the internal checks 'isValidPassword':Override the result of User::isValidPassword() $password:The password entered by the user &$result:Set this and return false to override the internal checks $user:User the password is being validated for 'Language::getMessagesFileName':$code:The language code or the language we're looking for a messages file for &$file:The messages file path, you can override this to change the location. 'LanguageGetMagic':DEPRECATED!Use $magicWords in a file listed in $wgExtensionMessagesFiles instead.Use this to define synonyms of magic words depending of the language &$magicExtensions:associative array of magic words synonyms $lang:language code(string) 'LanguageGetNamespaces':Provide custom ordering for namespaces or remove namespaces.Do not use this hook to add namespaces.Use CanonicalNamespaces for that.&$namespaces:Array of namespaces indexed by their numbers 'LanguageGetSpecialPageAliases':DEPRECATED!Use $specialPageAliases in a file listed in $wgExtensionMessagesFiles instead.Use to define aliases of special pages names depending of the language &$specialPageAliases:associative array of magic words synonyms $lang:language code(string) 'LanguageGetTranslatedLanguageNames':Provide translated language names.&$names:array of language code=> language name $code:language of the preferred translations 'LanguageLinks':Manipulate a page's language links.This is called in various places to allow extensions to define the effective language links for a page.$title:The page's Title.&$links:Associative array mapping language codes to prefixed links of the form"language:title".&$linkFlags:Associative array mapping prefixed links to arrays of flags.Currently unused, but planned to provide support for marking individual language links in the UI, e.g.for featured articles. 'LanguageSelector':Hook to change the language selector available on a page.$out:The output page.$cssClassName:CSS class name of the language selector. 'LinkBegin':DEPRECATED!Use HtmlPageLinkRendererBegin instead.Used when generating internal and interwiki links in Linker::link(), before processing starts.Return false to skip default processing and return $ret.See documentation for Linker::link() for details on the expected meanings of parameters.$skin:the Skin object $target:the Title that the link is pointing to &$html:the contents that the< a > tag should have(raw HTML) $result
Definition: hooks.txt:1934
if($line===false) $args
Definition: cdb.php:64
static decodeCharReferences($text)
Decode any character references, numeric or named entities, in the text and return a UTF-8 string...
Definition: Sanitizer.php:1500
static validateCodepoint($codepoint)
Returns true if a given Unicode codepoint is a valid character in both HTML5 and XML.
Definition: Sanitizer.php:1481
const EVIL_URI_PATTERN
Blacklist for evil uris like javascript: WARNING: DO NOT use this in any place that actually requires...
Definition: Sanitizer.php:56
const ELEMENT_BITS_REGEX
Acceptable tag name charset from HTML5 parsing spec http://www.w3.org/TR/html5/syntax.html#tag-open-state.
Definition: Sanitizer.php:46
Unicode normalization routines for working with UTF-8 strings.
Definition: UtfNormal.php:48
static decodeChar($codepoint)
Return UTF-8 string for a codepoint if that is a valid character reference, otherwise U+FFFD REPLACEM...
Definition: Sanitizer.php:1554
static normalizeSectionNameWhitespace($section)
Normalizes whitespace in a section name, such as might be returned by Parser::stripSectionName(), for use in the id's that are used for section links.
Definition: Sanitizer.php:1381
static delimiterReplace($startDelim, $endDelim, $replace, $subject, $flags= '')
Perform an operation equivalent to preg_replace() with flags.
static $htmlEntities
List of all named character entities defined in HTML 4.01 http://www.w3.org/TR/html4/sgml/entities.html As well as ' which is only defined starting in XHTML1.
Definition: Sanitizer.php:64
static attributeWhitelist($element)
Fetch the whitelist of acceptable attributes for a given element name.
Definition: Sanitizer.php:1587
this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist e g Watchlist removed from all revisions and log entries to which it was applied This gives extensions a chance to take it off their books as the deletion has already been partly carried out by this point or something similar the user will be unable to create the tag set and then return false from the hook function Ensure you consume the ChangeTagAfterDelete hook to carry out custom deletion actions as context called by AbstractContent::getParserOutput May be used to override the normal model specific rendering of page content as context as context $options
Definition: hooks.txt:1046
static escapeHtmlAllowEntities($html)
Given HTML input, escape with htmlspecialchars but un-escape entities.
Definition: Sanitizer.php:1262
static validateTag($params, $element)
Takes attribute names and values for a tag and the tag name and validates that the tag is allowed to ...
Definition: Sanitizer.php:712
static mergeAttributes($a, $b)
Merge two sets of HTML attributes.
Definition: Sanitizer.php:871
const CHAR_REFS_REGEX
Regular expression to match various types of character references in Sanitizer::normalizeCharReferenc...
Definition: Sanitizer.php:36
static getRecognizedTagData($extratags=[], $removetags=[])
Return the various lists of recognized tags.
Definition: Sanitizer.php:365
$params
static validateAttributes($attribs, $whitelist)
Take an array of attribute names and values and normalize or discard illegal values for the given whi...
Definition: Sanitizer.php:768
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses after processing & $attribs
Definition: hooks.txt:1936
static decodeCharReferencesAndNormalize($text)
Decode any character references, numeric or named entities, in the next and normalize the resulting s...
Definition: Sanitizer.php:1517
static run($event, array $args=[], $deprecatedVersion=null)
Call hook functions defined in Hooks::register and $wgHooks.
Definition: Hooks.php:131
static static $htmlEntityAliases
Character entity aliases accepted by MediaWiki.
Definition: Sanitizer.php:323
static escapeIdReferenceList($referenceString, $options=[])
Given a string containing a space delimited list of ids, escape each id to match ids escaped by the e...
Definition: Sanitizer.php:1220
Apache License January AND DISTRIBUTION Definitions License shall mean the terms and conditions for and distribution as defined by Sections through of this document Licensor shall mean the copyright owner or entity authorized by the copyright owner that is granting the License Legal Entity shall mean the union of the acting entity and all other entities that control are controlled by or are under common control with that entity For the purposes of this definition control direct or to cause the direction or management of such whether by contract or including but not limited to software source documentation and configuration files Object form shall mean any form resulting from mechanical transformation or translation of a Source including but not limited to compiled object generated and conversions to other media types Work shall mean the work of whether in Source or Object made available under the as indicated by a copyright notice that is included in or attached to the whether in Source or Object that is based or other modifications as a an original work of authorship For the purposes of this Derivative Works shall not include works that remain separable or merely the Work and Derivative Works thereof Contribution shall mean any work of including the original version of the Work and any modifications or additions to that Work or Derivative Works that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner For the purposes of this submitted means any form of or written communication sent to the Licensor or its including but not limited to communication on electronic mailing source code control and issue tracking systems that are managed by
static cleanUrlCallback($matches)
Definition: Sanitizer.php:1910
This document is intended to provide useful advice for parties seeking to redistribute MediaWiki to end users It s targeted particularly at maintainers for Linux since it s been observed that distribution packages of MediaWiki often break We ve consistently had to recommend that users seeking support use official tarballs instead of their distribution s and this often solves whatever problem the user is having It would be nice if this could such as
Definition: distributors.txt:9
usually copyright or history_copyright This message must be in HTML not wikitext if the section is included from a template $section
Definition: hooks.txt:2889
static armorLinksCallback($matches)
Regex replace callback for armoring links against further processing.
Definition: Sanitizer.php:1275
static escapeId($id, $options=[])
Given a value, escape it so that it can be used in an id attribute and return it. ...
Definition: Sanitizer.php:1170
wfUrlProtocols($includeProtocolRelative=true)
Returns a regular expression of url protocols.
static normalizeCss($value)
Normalize CSS into a format we can easily search for hostile input.
Definition: Sanitizer.php:893
const XMLNS_ATTRIBUTE_PATTERN
Definition: Sanitizer.php:57
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency which acts as the top level factory for services in MediaWiki which can be used to gain access to default instances of various services MediaWikiServices however also allows new services to be defined and default services to be redefined Services are defined or redefined by providing a callback the instantiator that will return a new instance of the service When it will create an instance of MediaWikiServices and populate it with the services defined in the files listed by thereby bootstrapping the DI framework Per $wgServiceWiringFiles lists includes ServiceWiring php
Definition: injection.txt:35
static removeHTMLtags($text, $processCallback=null, $args=[], $extratags=[], $removetags=[], $warnCallback=null)
Cleans up HTML, removes dangerous tags and attributes, and removes HTML comments. ...
Definition: Sanitizer.php:462
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if so it s not worth the trouble Since there is a job queue in the jobs table
Definition: deferred.txt:11
static normalizeCharReferences($text)
Ensure that any entities and character references are legal for XML and XHTML specifically.
Definition: Sanitizer.php:1400
this class mediates it Skin Encapsulates a look and feel for the wiki All of the functions that render HTML and make choices about how to render it are here and are called from various other places when and is meant to be subclassed with other skins that may override some of its functions The User object contains a reference to a and so rather than having a global skin object we just rely on the global User and get the skin with $wgUser and also has some character encoding functions and other locale stuff The current user interface language is instantiated as and the local content language as $wgContLang
Definition: design.txt:56
$wgExperimentalHtmlIds
Should we allow a broader set of characters in id attributes, per HTML5? If not, use only HTML 4-comp...
$count
static removeHTMLcomments($text)
Remove '', and everything between.
Definition: Sanitizer.php:666
static getAttribsRegex()
Regular expression to match HTML/XML attribute pairs within a tag.
Definition: Sanitizer.php:340
codepointToUtf8($codepoint)
Return UTF-8 sequence for a given Unicode code point.
static validateEmail($addr)
Does a string look like an e-mail address?
Definition: Sanitizer.php:1942
static checkCss($value)
Pick apart some CSS and check it for forbidden or unsafe structures.
Definition: Sanitizer.php:1001
static getTagAttributeCallback($set)
Pick the appropriate attribute value from a match set from the attribs regex matches.
Definition: Sanitizer.php:1342
</td >< td > &</td >< td > t want your writing to be edited mercilessly and redistributed at will
static decodeEntity($name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the UTF-8 encoding of that chara...
Definition: Sanitizer.php:1570
static safeEncodeAttribute($text)
Encode an attribute value for HTML tags, with extra armoring against further wiki processing...
Definition: Sanitizer.php:1112
static configuration should be added through ResourceLoaderGetConfigVars instead & $vars
Definition: hooks.txt:2159
static encodeAttribute($text)
Encode an attribute value for HTML output.
Definition: Sanitizer.php:1091
$matches
Allows to change the fields on the form that will be generated $name
Definition: hooks.txt:300