MediaWiki  REL1_31
Sanitizer.php
Go to the documentation of this file.
1 <?php
31 class Sanitizer {
37  '/&([A-Za-z0-9\x80-\xff]+);
38  |&\#([0-9]+);
39  |&\#[xX]([0-9A-Fa-f]+);
40  |(&)/x';
41 
46  const ELEMENT_BITS_REGEX = '!^(/?)([A-Za-z][^\t\n\v />\0]*+)([^>]*?)(/?>)([^<]*)$!';
47 
56  const EVIL_URI_PATTERN = '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i';
57  const XMLNS_ATTRIBUTE_PATTERN = "/^xmlns:[:A-Z_a-z-.0-9]+$/";
58 
64  const ID_PRIMARY = 0;
65 
72  const ID_FALLBACK = 1;
73 
79  private static $htmlEntities = [
80  'Aacute' => 193,
81  'aacute' => 225,
82  'Acirc' => 194,
83  'acirc' => 226,
84  'acute' => 180,
85  'AElig' => 198,
86  'aelig' => 230,
87  'Agrave' => 192,
88  'agrave' => 224,
89  'alefsym' => 8501,
90  'Alpha' => 913,
91  'alpha' => 945,
92  'amp' => 38,
93  'and' => 8743,
94  'ang' => 8736,
95  'apos' => 39, // New in XHTML & HTML 5; avoid in output for compatibility with IE.
96  'Aring' => 197,
97  'aring' => 229,
98  'asymp' => 8776,
99  'Atilde' => 195,
100  'atilde' => 227,
101  'Auml' => 196,
102  'auml' => 228,
103  'bdquo' => 8222,
104  'Beta' => 914,
105  'beta' => 946,
106  'brvbar' => 166,
107  'bull' => 8226,
108  'cap' => 8745,
109  'Ccedil' => 199,
110  'ccedil' => 231,
111  'cedil' => 184,
112  'cent' => 162,
113  'Chi' => 935,
114  'chi' => 967,
115  'circ' => 710,
116  'clubs' => 9827,
117  'cong' => 8773,
118  'copy' => 169,
119  'crarr' => 8629,
120  'cup' => 8746,
121  'curren' => 164,
122  'dagger' => 8224,
123  'Dagger' => 8225,
124  'darr' => 8595,
125  'dArr' => 8659,
126  'deg' => 176,
127  'Delta' => 916,
128  'delta' => 948,
129  'diams' => 9830,
130  'divide' => 247,
131  'Eacute' => 201,
132  'eacute' => 233,
133  'Ecirc' => 202,
134  'ecirc' => 234,
135  'Egrave' => 200,
136  'egrave' => 232,
137  'empty' => 8709,
138  'emsp' => 8195,
139  'ensp' => 8194,
140  'Epsilon' => 917,
141  'epsilon' => 949,
142  'equiv' => 8801,
143  'Eta' => 919,
144  'eta' => 951,
145  'ETH' => 208,
146  'eth' => 240,
147  'Euml' => 203,
148  'euml' => 235,
149  'euro' => 8364,
150  'exist' => 8707,
151  'fnof' => 402,
152  'forall' => 8704,
153  'frac12' => 189,
154  'frac14' => 188,
155  'frac34' => 190,
156  'frasl' => 8260,
157  'Gamma' => 915,
158  'gamma' => 947,
159  'ge' => 8805,
160  'gt' => 62,
161  'harr' => 8596,
162  'hArr' => 8660,
163  'hearts' => 9829,
164  'hellip' => 8230,
165  'Iacute' => 205,
166  'iacute' => 237,
167  'Icirc' => 206,
168  'icirc' => 238,
169  'iexcl' => 161,
170  'Igrave' => 204,
171  'igrave' => 236,
172  'image' => 8465,
173  'infin' => 8734,
174  'int' => 8747,
175  'Iota' => 921,
176  'iota' => 953,
177  'iquest' => 191,
178  'isin' => 8712,
179  'Iuml' => 207,
180  'iuml' => 239,
181  'Kappa' => 922,
182  'kappa' => 954,
183  'Lambda' => 923,
184  'lambda' => 955,
185  'lang' => 9001,
186  'laquo' => 171,
187  'larr' => 8592,
188  'lArr' => 8656,
189  'lceil' => 8968,
190  'ldquo' => 8220,
191  'le' => 8804,
192  'lfloor' => 8970,
193  'lowast' => 8727,
194  'loz' => 9674,
195  'lrm' => 8206,
196  'lsaquo' => 8249,
197  'lsquo' => 8216,
198  'lt' => 60,
199  'macr' => 175,
200  'mdash' => 8212,
201  'micro' => 181,
202  'middot' => 183,
203  'minus' => 8722,
204  'Mu' => 924,
205  'mu' => 956,
206  'nabla' => 8711,
207  'nbsp' => 160,
208  'ndash' => 8211,
209  'ne' => 8800,
210  'ni' => 8715,
211  'not' => 172,
212  'notin' => 8713,
213  'nsub' => 8836,
214  'Ntilde' => 209,
215  'ntilde' => 241,
216  'Nu' => 925,
217  'nu' => 957,
218  'Oacute' => 211,
219  'oacute' => 243,
220  'Ocirc' => 212,
221  'ocirc' => 244,
222  'OElig' => 338,
223  'oelig' => 339,
224  'Ograve' => 210,
225  'ograve' => 242,
226  'oline' => 8254,
227  'Omega' => 937,
228  'omega' => 969,
229  'Omicron' => 927,
230  'omicron' => 959,
231  'oplus' => 8853,
232  'or' => 8744,
233  'ordf' => 170,
234  'ordm' => 186,
235  'Oslash' => 216,
236  'oslash' => 248,
237  'Otilde' => 213,
238  'otilde' => 245,
239  'otimes' => 8855,
240  'Ouml' => 214,
241  'ouml' => 246,
242  'para' => 182,
243  'part' => 8706,
244  'permil' => 8240,
245  'perp' => 8869,
246  'Phi' => 934,
247  'phi' => 966,
248  'Pi' => 928,
249  'pi' => 960,
250  'piv' => 982,
251  'plusmn' => 177,
252  'pound' => 163,
253  'prime' => 8242,
254  'Prime' => 8243,
255  'prod' => 8719,
256  'prop' => 8733,
257  'Psi' => 936,
258  'psi' => 968,
259  'quot' => 34,
260  'radic' => 8730,
261  'rang' => 9002,
262  'raquo' => 187,
263  'rarr' => 8594,
264  'rArr' => 8658,
265  'rceil' => 8969,
266  'rdquo' => 8221,
267  'real' => 8476,
268  'reg' => 174,
269  'rfloor' => 8971,
270  'Rho' => 929,
271  'rho' => 961,
272  'rlm' => 8207,
273  'rsaquo' => 8250,
274  'rsquo' => 8217,
275  'sbquo' => 8218,
276  'Scaron' => 352,
277  'scaron' => 353,
278  'sdot' => 8901,
279  'sect' => 167,
280  'shy' => 173,
281  'Sigma' => 931,
282  'sigma' => 963,
283  'sigmaf' => 962,
284  'sim' => 8764,
285  'spades' => 9824,
286  'sub' => 8834,
287  'sube' => 8838,
288  'sum' => 8721,
289  'sup' => 8835,
290  'sup1' => 185,
291  'sup2' => 178,
292  'sup3' => 179,
293  'supe' => 8839,
294  'szlig' => 223,
295  'Tau' => 932,
296  'tau' => 964,
297  'there4' => 8756,
298  'Theta' => 920,
299  'theta' => 952,
300  'thetasym' => 977,
301  'thinsp' => 8201,
302  'THORN' => 222,
303  'thorn' => 254,
304  'tilde' => 732,
305  'times' => 215,
306  'trade' => 8482,
307  'Uacute' => 218,
308  'uacute' => 250,
309  'uarr' => 8593,
310  'uArr' => 8657,
311  'Ucirc' => 219,
312  'ucirc' => 251,
313  'Ugrave' => 217,
314  'ugrave' => 249,
315  'uml' => 168,
316  'upsih' => 978,
317  'Upsilon' => 933,
318  'upsilon' => 965,
319  'Uuml' => 220,
320  'uuml' => 252,
321  'weierp' => 8472,
322  'Xi' => 926,
323  'xi' => 958,
324  'Yacute' => 221,
325  'yacute' => 253,
326  'yen' => 165,
327  'Yuml' => 376,
328  'yuml' => 255,
329  'Zeta' => 918,
330  'zeta' => 950,
331  'zwj' => 8205,
332  'zwnj' => 8204
333  ];
334 
338  private static $htmlEntityAliases = [
339  'רלמ' => 'rlm',
340  'رلم' => 'rlm',
341  ];
342 
346  private static $attribsRegex;
347 
355  static function getAttribsRegex() {
356  if ( self::$attribsRegex === null ) {
357  $attribFirst = "[:_\p{L}\p{N}]";
358  $attrib = "[:_\.\-\p{L}\p{N}]";
359  $space = '[\x09\x0a\x0c\x0d\x20]';
360  self::$attribsRegex =
361  "/(?:^|$space)({$attribFirst}{$attrib}*)
362  ($space*=$space*
363  (?:
364  # The attribute value: quoted or alone
365  \"([^\"]*)(?:\"|\$)
366  | '([^']*)(?:'|\$)
367  | (((?!$space|>).)*)
368  )
369  )?(?=$space|\$)/sxu";
370  }
371  return self::$attribsRegex;
372  }
373 
380  public static function getRecognizedTagData( $extratags = [], $removetags = [] ) {
382 
383  static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
384  $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
385 
386  // Base our staticInitialised variable off of the global config state so that if the globals
387  // are changed (like in the screwed up test system) we will re-initialise the settings.
388  $globalContext = $wgAllowImageTag;
389  if ( !$staticInitialised || $staticInitialised != $globalContext ) {
390  $htmlpairsStatic = [ # Tags that must be closed
391  'b', 'bdi', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
392  'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
393  'strike', 'strong', 'tt', 'var', 'div', 'center',
394  'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
395  'ruby', 'rb', 'rp', 'rt', 'rtc', 'p', 'span', 'abbr', 'dfn',
396  'kbd', 'samp', 'data', 'time', 'mark'
397  ];
398  $htmlsingle = [
399  'br', 'wbr', 'hr', 'li', 'dt', 'dd', 'meta', 'link'
400  ];
401 
402  # Elements that cannot have close tags. This is (not coincidentally)
403  # also the list of tags for which the HTML 5 parsing algorithm
404  # requires you to "acknowledge the token's self-closing flag", i.e.
405  # a self-closing tag like <br/> is not an HTML 5 parse error only
406  # for this list.
407  $htmlsingleonly = [
408  'br', 'wbr', 'hr', 'meta', 'link'
409  ];
410 
411  $htmlnest = [ # Tags that can be nested--??
412  'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
413  'li', 'dl', 'dt', 'dd', 'font', 'big', 'small', 'sub', 'sup', 'span',
414  'var', 'kbd', 'samp', 'em', 'strong', 'q', 'ruby', 'bdo'
415  ];
416  $tabletags = [ # Can only appear inside table, we will close them
417  'td', 'th', 'tr',
418  ];
419  $htmllist = [ # Tags used by list
420  'ul', 'ol',
421  ];
422  $listtags = [ # Tags that can appear in a list
423  'li',
424  ];
425 
426  if ( $wgAllowImageTag ) {
427  $htmlsingle[] = 'img';
428  $htmlsingleonly[] = 'img';
429  }
430 
431  $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
432  $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
433 
434  # Convert them all to hashtables for faster lookup
435  $vars = [ 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
436  'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' ];
437  foreach ( $vars as $var ) {
438  $$var = array_flip( $$var );
439  }
440  $staticInitialised = $globalContext;
441  }
442 
443  # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
444  $extratags = array_flip( $extratags );
445  $removetags = array_flip( $removetags );
446  $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
447  $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ), $removetags );
448 
449  return [
450  'htmlpairs' => $htmlpairs,
451  'htmlsingle' => $htmlsingle,
452  'htmlsingleonly' => $htmlsingleonly,
453  'htmlnest' => $htmlnest,
454  'tabletags' => $tabletags,
455  'htmllist' => $htmllist,
456  'listtags' => $listtags,
457  'htmlsingleallowed' => $htmlsingleallowed,
458  'htmlelements' => $htmlelements,
459  ];
460  }
461 
477  public static function removeHTMLtags( $text, $processCallback = null,
478  $args = [], $extratags = [], $removetags = [], $warnCallback = null
479  ) {
480  $tagData = self::getRecognizedTagData( $extratags, $removetags );
481  $htmlpairs = $tagData['htmlpairs'];
482  $htmlsingle = $tagData['htmlsingle'];
483  $htmlsingleonly = $tagData['htmlsingleonly'];
484  $htmlnest = $tagData['htmlnest'];
485  $tabletags = $tagData['tabletags'];
486  $htmllist = $tagData['htmllist'];
487  $listtags = $tagData['listtags'];
488  $htmlsingleallowed = $tagData['htmlsingleallowed'];
489  $htmlelements = $tagData['htmlelements'];
490 
491  # Remove HTML comments
492  $text = self::removeHTMLcomments( $text );
493  $bits = explode( '<', $text );
494  $text = str_replace( '>', '&gt;', array_shift( $bits ) );
495  if ( !MWTidy::isEnabled() ) {
496  $tagstack = $tablestack = [];
497  foreach ( $bits as $x ) {
498  $regs = [];
499  # $slash: Does the current element start with a '/'?
500  # $t: Current element name
501  # $params: String between element name and >
502  # $brace: Ending '>' or '/>'
503  # $rest: Everything until the next element of $bits
504  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
505  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
506  } else {
507  $slash = $t = $params = $brace = $rest = null;
508  }
509 
510  $badtag = false;
511  $t = strtolower( $t );
512  if ( isset( $htmlelements[$t] ) ) {
513  # Check our stack
514  if ( $slash && isset( $htmlsingleonly[$t] ) ) {
515  $badtag = true;
516  } elseif ( $slash ) {
517  # Closing a tag... is it the one we just opened?
518  Wikimedia\suppressWarnings();
519  $ot = array_pop( $tagstack );
520  Wikimedia\restoreWarnings();
521 
522  if ( $ot != $t ) {
523  if ( isset( $htmlsingleallowed[$ot] ) ) {
524  # Pop all elements with an optional close tag
525  # and see if we find a match below them
526  $optstack = [];
527  array_push( $optstack, $ot );
528  Wikimedia\suppressWarnings();
529  $ot = array_pop( $tagstack );
530  Wikimedia\restoreWarnings();
531  while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
532  array_push( $optstack, $ot );
533  Wikimedia\suppressWarnings();
534  $ot = array_pop( $tagstack );
535  Wikimedia\restoreWarnings();
536  }
537  if ( $t != $ot ) {
538  # No match. Push the optional elements back again
539  $badtag = true;
540  Wikimedia\suppressWarnings();
541  $ot = array_pop( $optstack );
542  Wikimedia\restoreWarnings();
543  while ( $ot ) {
544  array_push( $tagstack, $ot );
545  Wikimedia\suppressWarnings();
546  $ot = array_pop( $optstack );
547  Wikimedia\restoreWarnings();
548  }
549  }
550  } else {
551  Wikimedia\suppressWarnings();
552  array_push( $tagstack, $ot );
553  Wikimedia\restoreWarnings();
554 
555  # <li> can be nested in <ul> or <ol>, skip those cases:
556  if ( !isset( $htmllist[$ot] ) || !isset( $listtags[$t] ) ) {
557  $badtag = true;
558  }
559  }
560  } else {
561  if ( $t == 'table' ) {
562  $tagstack = array_pop( $tablestack );
563  }
564  }
565  $newparams = '';
566  } else {
567  # Keep track for later
568  if ( isset( $tabletags[$t] ) && !in_array( 'table', $tagstack ) ) {
569  $badtag = true;
570  } elseif ( in_array( $t, $tagstack ) && !isset( $htmlnest[$t] ) ) {
571  $badtag = true;
572  #  Is it a self closed htmlpair ? (T7487)
573  } elseif ( $brace == '/>' && isset( $htmlpairs[$t] ) ) {
574  // Eventually we'll just remove the self-closing
575  // slash, in order to be consistent with HTML5
576  // semantics.
577  // $brace = '>';
578  // For now, let's just warn authors to clean up.
579  if ( is_callable( $warnCallback ) ) {
580  call_user_func_array( $warnCallback, [ 'deprecated-self-close-category' ] );
581  }
582  $badtag = true;
583  } elseif ( isset( $htmlsingleonly[$t] ) ) {
584  # Hack to force empty tag for unclosable elements
585  $brace = '/>';
586  } elseif ( isset( $htmlsingle[$t] ) ) {
587  # Hack to not close $htmlsingle tags
588  $brace = null;
589  # Still need to push this optionally-closed tag to
590  # the tag stack so that we can match end tags
591  # instead of marking them as bad.
592  array_push( $tagstack, $t );
593  } elseif ( isset( $tabletags[$t] ) && in_array( $t, $tagstack ) ) {
594  // New table tag but forgot to close the previous one
595  $text .= "</$t>";
596  } else {
597  if ( $t == 'table' ) {
598  array_push( $tablestack, $tagstack );
599  $tagstack = [];
600  }
601  array_push( $tagstack, $t );
602  }
603 
604  # Replace any variables or template parameters with
605  # plaintext results.
606  if ( is_callable( $processCallback ) ) {
607  call_user_func_array( $processCallback, [ &$params, $args ] );
608  }
609 
610  if ( !self::validateTag( $params, $t ) ) {
611  $badtag = true;
612  }
613 
614  # Strip non-approved attributes from the tag
615  $newparams = self::fixTagAttributes( $params, $t );
616  }
617  if ( !$badtag ) {
618  $rest = str_replace( '>', '&gt;', $rest );
619  $close = ( $brace == '/>' && !$slash ) ? ' /' : '';
620  $text .= "<$slash$t$newparams$close>$rest";
621  continue;
622  }
623  }
624  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
625  }
626  # Close off any remaining tags
627  while ( is_array( $tagstack ) && ( $t = array_pop( $tagstack ) ) ) {
628  $text .= "</$t>\n";
629  if ( $t == 'table' ) {
630  $tagstack = array_pop( $tablestack );
631  }
632  }
633  } else {
634  # this might be possible using tidy itself
635  foreach ( $bits as $x ) {
636  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
637  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
638 
639  $badtag = false;
640  $t = strtolower( $t );
641  if ( isset( $htmlelements[$t] ) ) {
642  if ( is_callable( $processCallback ) ) {
643  call_user_func_array( $processCallback, [ &$params, $args ] );
644  }
645 
646  if ( $brace == '/>' && !( isset( $htmlsingle[$t] ) || isset( $htmlsingleonly[$t] ) ) ) {
647  // Eventually we'll just remove the self-closing
648  // slash, in order to be consistent with HTML5
649  // semantics.
650  // $brace = '>';
651  // For now, let's just warn authors to clean up.
652  if ( is_callable( $warnCallback ) ) {
653  call_user_func_array( $warnCallback, [ 'deprecated-self-close-category' ] );
654  }
655  }
656  if ( !self::validateTag( $params, $t ) ) {
657  $badtag = true;
658  }
659 
660  $newparams = self::fixTagAttributes( $params, $t );
661  if ( !$badtag ) {
662  if ( $brace === '/>' && !isset( $htmlsingleonly[$t] ) ) {
663  # Interpret self-closing tags as empty tags even when
664  # HTML 5 would interpret them as start tags. Such input
665  # is commonly seen on Wikimedia wikis with this intention.
666  $brace = "></$t>";
667  }
668 
669  $rest = str_replace( '>', '&gt;', $rest );
670  $text .= "<$slash$t$newparams$brace$rest";
671  continue;
672  }
673  }
674  }
675  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
676  }
677  }
678  return $text;
679  }
680 
690  public static function removeHTMLcomments( $text ) {
691  while ( ( $start = strpos( $text, '<!--' ) ) !== false ) {
692  $end = strpos( $text, '-->', $start + 4 );
693  if ( $end === false ) {
694  # Unterminated comment; bail out
695  break;
696  }
697 
698  $end += 3;
699 
700  # Trim space and newline if the comment is both
701  # preceded and followed by a newline
702  $spaceStart = max( $start - 1, 0 );
703  $spaceLen = $end - $spaceStart;
704  while ( substr( $text, $spaceStart, 1 ) === ' ' && $spaceStart > 0 ) {
705  $spaceStart--;
706  $spaceLen++;
707  }
708  while ( substr( $text, $spaceStart + $spaceLen, 1 ) === ' ' ) {
709  $spaceLen++;
710  }
711  if ( substr( $text, $spaceStart, 1 ) === "\n"
712  && substr( $text, $spaceStart + $spaceLen, 1 ) === "\n" ) {
713  # Remove the comment, leading and trailing
714  # spaces, and leave only one newline.
715  $text = substr_replace( $text, "\n", $spaceStart, $spaceLen + 1 );
716  } else {
717  # Remove just the comment.
718  $text = substr_replace( $text, '', $start, $end - $start );
719  }
720  }
721  return $text;
722  }
723 
736  static function validateTag( $params, $element ) {
738 
739  if ( $element == 'meta' || $element == 'link' ) {
740  if ( !isset( $params['itemprop'] ) ) {
741  // <meta> and <link> must have an itemprop="" otherwise they are not valid or safe in content
742  return false;
743  }
744  if ( $element == 'meta' && !isset( $params['content'] ) ) {
745  // <meta> must have a content="" for the itemprop
746  return false;
747  }
748  if ( $element == 'link' && !isset( $params['href'] ) ) {
749  // <link> must have an associated href=""
750  return false;
751  }
752  }
753 
754  return true;
755  }
756 
772  static function validateTagAttributes( $attribs, $element ) {
774  self::attributeWhitelist( $element ) );
775  }
776 
792  static function validateAttributes( $attribs, $whitelist ) {
793  $whitelist = array_flip( $whitelist );
794  $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
795 
796  $out = [];
797  foreach ( $attribs as $attribute => $value ) {
798  # Allow XML namespace declaration to allow RDFa
799  if ( preg_match( self::XMLNS_ATTRIBUTE_PATTERN, $attribute ) ) {
800  if ( !preg_match( self::EVIL_URI_PATTERN, $value ) ) {
801  $out[$attribute] = $value;
802  }
803 
804  continue;
805  }
806 
807  # Allow any attribute beginning with "data-"
808  # However:
809  # * Disallow data attributes used by MediaWiki code
810  # * Ensure that the attribute is not namespaced by banning
811  # colons.
812  if ( !preg_match( '/^data-[^:]*$/i', $attribute )
813  && !isset( $whitelist[$attribute] )
814  || self::isReservedDataAttribute( $attribute )
815  ) {
816  continue;
817  }
818 
819  # Strip javascript "expression" from stylesheets.
820  # https://msdn.microsoft.com/en-us/library/ms537634.aspx
821  if ( $attribute == 'style' ) {
823  }
824 
825  # Escape HTML id attributes
826  if ( $attribute === 'id' ) {
827  $value = self::escapeIdForAttribute( $value, self::ID_PRIMARY );
828  }
829 
830  # Escape HTML id reference lists
831  if ( $attribute === 'aria-describedby'
832  || $attribute === 'aria-flowto'
833  || $attribute === 'aria-labelledby'
834  || $attribute === 'aria-owns'
835  ) {
837  }
838 
839  // RDFa and microdata properties allow URLs, URIs and/or CURIs.
840  // Check them for sanity.
841  if ( $attribute === 'rel' || $attribute === 'rev'
842  # RDFa
843  || $attribute === 'about' || $attribute === 'property'
844  || $attribute === 'resource' || $attribute === 'datatype'
845  || $attribute === 'typeof'
846  # HTML5 microdata
847  || $attribute === 'itemid' || $attribute === 'itemprop'
848  || $attribute === 'itemref' || $attribute === 'itemscope'
849  || $attribute === 'itemtype'
850  ) {
851  // Paranoia. Allow "simple" values but suppress javascript
852  if ( preg_match( self::EVIL_URI_PATTERN, $value ) ) {
853  continue;
854  }
855  }
856 
857  # NOTE: even though elements using href/src are not allowed directly, supply
858  # validation code that can be used by tag hook handlers, etc
859  if ( $attribute === 'href' || $attribute === 'src' || $attribute === 'poster' ) {
860  if ( !preg_match( $hrefExp, $value ) ) {
861  continue; // drop any href or src attributes not using an allowed protocol.
862  // NOTE: this also drops all relative URLs
863  }
864  }
865 
866  // If this attribute was previously set, override it.
867  // Output should only have one attribute of each name.
868  $out[$attribute] = $value;
869  }
870 
871  # itemtype, itemid, itemref don't make sense without itemscope
872  if ( !array_key_exists( 'itemscope', $out ) ) {
873  unset( $out['itemtype'] );
874  unset( $out['itemid'] );
875  unset( $out['itemref'] );
876  }
877  # TODO: Strip itemprop if we aren't descendants of an itemscope or pointed to by an itemref.
878 
879  return $out;
880  }
881 
889  public static function isReservedDataAttribute( $attr ) {
890  // data-ooui is reserved for ooui.
891  // data-mw and data-parsoid are reserved for parsoid.
892  // data-mw-<name here> is reserved for extensions (or core) if
893  // they need to communicate some data to the client and want to be
894  // sure that it isn't coming from an untrusted user.
895  // We ignore the possibility of namespaces since user-generated HTML
896  // can't use them anymore.
897  return (bool)preg_match( '/^data-(ooui|mw|parsoid)/i', $attr );
898  }
899 
910  static function mergeAttributes( $a, $b ) {
911  $out = array_merge( $a, $b );
912  if ( isset( $a['class'] ) && isset( $b['class'] )
913  && is_string( $a['class'] ) && is_string( $b['class'] )
914  && $a['class'] !== $b['class']
915  ) {
916  $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
917  -1, PREG_SPLIT_NO_EMPTY );
918  $out['class'] = implode( ' ', array_unique( $classes ) );
919  }
920  return $out;
921  }
922 
932  public static function normalizeCss( $value ) {
933  // Decode character references like &#123;
935 
936  // Decode escape sequences and line continuation
937  // See the grammar in the CSS 2 spec, appendix D.
938  // This has to be done AFTER decoding character references.
939  // This means it isn't possible for this function to return
940  // unsanitized escape sequences. It is possible to manufacture
941  // input that contains character references that decode to
942  // escape sequences that decode to character references, but
943  // it's OK for the return value to contain character references
944  // because the caller is supposed to escape those anyway.
945  static $decodeRegex;
946  if ( !$decodeRegex ) {
947  $space = '[\\x20\\t\\r\\n\\f]';
948  $nl = '(?:\\n|\\r\\n|\\r|\\f)';
949  $backslash = '\\\\';
950  $decodeRegex = "/ $backslash
951  (?:
952  ($nl) | # 1. Line continuation
953  ([0-9A-Fa-f]{1,6})$space? | # 2. character number
954  (.) | # 3. backslash cancelling special meaning
955  () | # 4. backslash at end of string
956  )/xu";
957  }
958  $value = preg_replace_callback( $decodeRegex,
959  [ __CLASS__, 'cssDecodeCallback' ], $value );
960 
961  // Normalize Halfwidth and Fullwidth Unicode block that IE6 might treat as ascii
962  $value = preg_replace_callback(
963  '/[!-[]-z]/u', // U+FF01 to U+FF5A, excluding U+FF3C (T60088)
964  function ( $matches ) {
966  if ( $cp === false ) {
967  return '';
968  }
969  return chr( $cp - 65248 ); // ASCII range \x21-\x7A
970  },
971  $value
972  );
973 
974  // Convert more characters IE6 might treat as ascii
975  // U+0280, U+0274, U+207F, U+029F, U+026A, U+207D, U+208D
976  $value = str_replace(
977  [ 'ʀ', 'ɴ', 'ⁿ', 'ʟ', 'ɪ', '⁽', '₍' ],
978  [ 'r', 'n', 'n', 'l', 'i', '(', '(' ],
979  $value
980  );
981 
982  // Let the value through if it's nothing but a single comment, to
983  // allow other functions which may reject it to pass some error
984  // message through.
985  if ( !preg_match( '! ^ \s* /\* [^*\\/]* \*/ \s* $ !x', $value ) ) {
986  // Remove any comments; IE gets token splitting wrong
987  // This must be done AFTER decoding character references and
988  // escape sequences, because those steps can introduce comments
989  // This step cannot introduce character references or escape
990  // sequences, because it replaces comments with spaces rather
991  // than removing them completely.
992  $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value );
993 
994  // Remove anything after a comment-start token, to guard against
995  // incorrect client implementations.
996  $commentPos = strpos( $value, '/*' );
997  if ( $commentPos !== false ) {
998  $value = substr( $value, 0, $commentPos );
999  }
1000  }
1001 
1002  // S followed by repeat, iteration, or prolonged sound marks,
1003  // which IE will treat as "ss"
1004  $value = preg_replace(
1005  '/s(?:
1006  \xE3\x80\xB1 | # U+3031
1007  \xE3\x82\x9D | # U+309D
1008  \xE3\x83\xBC | # U+30FC
1009  \xE3\x83\xBD | # U+30FD
1010  \xEF\xB9\xBC | # U+FE7C
1011  \xEF\xB9\xBD | # U+FE7D
1012  \xEF\xBD\xB0 # U+FF70
1013  )/ix',
1014  'ss',
1015  $value
1016  );
1017 
1018  return $value;
1019  }
1020 
1039  static function checkCss( $value ) {
1041 
1042  // Reject problematic keywords and control characters
1043  if ( preg_match( '/[\000-\010\013\016-\037\177]/', $value ) ||
1044  strpos( $value, UtfNormal\Constants::UTF8_REPLACEMENT ) !== false ) {
1045  return '/* invalid control char */';
1046  } elseif ( preg_match(
1047  '! expression
1048  | filter\s*:
1049  | accelerator\s*:
1050  | -o-link\s*:
1051  | -o-link-source\s*:
1052  | -o-replace\s*:
1053  | url\s*\‍(
1054  | image\s*\‍(
1055  | image-set\s*\‍(
1056  | attr\s*\‍([^)]+[\s,]+url
1057  | var\s*\‍(
1058  !ix', $value ) ) {
1059  return '/* insecure input */';
1060  }
1061  return $value;
1062  }
1063 
1068  static function cssDecodeCallback( $matches ) {
1069  if ( $matches[1] !== '' ) {
1070  // Line continuation
1071  return '';
1072  } elseif ( $matches[2] !== '' ) {
1073  $char = UtfNormal\Utils::codepointToUtf8( hexdec( $matches[2] ) );
1074  } elseif ( $matches[3] !== '' ) {
1075  $char = $matches[3];
1076  } else {
1077  $char = '\\';
1078  }
1079  if ( $char == "\n" || $char == '"' || $char == "'" || $char == '\\' ) {
1080  // These characters need to be escaped in strings
1081  // Clean up the escape sequence to avoid parsing errors by clients
1082  return '\\' . dechex( ord( $char ) ) . ' ';
1083  } else {
1084  // Decode unnecessary escape
1085  return $char;
1086  }
1087  }
1088 
1110  static function fixTagAttributes( $text, $element, $sorted = false ) {
1111  if ( trim( $text ) == '' ) {
1112  return '';
1113  }
1114 
1115  $decoded = self::decodeTagAttributes( $text );
1116  $stripped = self::validateTagAttributes( $decoded, $element );
1117 
1118  if ( $sorted ) {
1119  ksort( $stripped );
1120  }
1121 
1122  return self::safeEncodeTagAttributes( $stripped );
1123  }
1124 
1130  static function encodeAttribute( $text ) {
1131  $encValue = htmlspecialchars( $text, ENT_QUOTES );
1132 
1133  // Whitespace is normalized during attribute decoding,
1134  // so if we've been passed non-spaces we must encode them
1135  // ahead of time or they won't be preserved.
1136  $encValue = strtr( $encValue, [
1137  "\n" => '&#10;',
1138  "\r" => '&#13;',
1139  "\t" => '&#9;',
1140  ] );
1141 
1142  return $encValue;
1143  }
1144 
1151  static function safeEncodeAttribute( $text ) {
1152  $encValue = self::encodeAttribute( $text );
1153 
1154  # Templates and links may be expanded in later parsing,
1155  # creating invalid or dangerous output. Suppress this.
1156  $encValue = strtr( $encValue, [
1157  '<' => '&lt;', // This should never happen,
1158  '>' => '&gt;', // we've received invalid input
1159  '"' => '&quot;', // which should have been escaped.
1160  '{' => '&#123;',
1161  '}' => '&#125;', // prevent unpaired language conversion syntax
1162  '[' => '&#91;',
1163  ']' => '&#93;',
1164  "''" => '&#39;&#39;',
1165  'ISBN' => '&#73;SBN',
1166  'RFC' => '&#82;FC',
1167  'PMID' => '&#80;MID',
1168  '|' => '&#124;',
1169  '__' => '&#95;_',
1170  ] );
1171 
1172  # Stupid hack
1173  $encValue = preg_replace_callback(
1174  '/((?i)' . wfUrlProtocols() . ')/',
1175  function ( $matches ) {
1176  return str_replace( ':', '&#58;', $matches[1] );
1177  },
1178  $encValue );
1179  return $encValue;
1180  }
1181 
1215  static function escapeId( $id, $options = [] ) {
1217  $options = (array)$options;
1218 
1219  if ( $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) {
1220  $id = preg_replace( '/[ \t\n\r\f_\'"&#%]+/', '_', $id );
1221  $id = trim( $id, '_' );
1222  if ( $id === '' ) {
1223  // Must have been all whitespace to start with.
1224  return '_';
1225  } else {
1226  return $id;
1227  }
1228  }
1229 
1230  // HTML4-style escaping
1231  static $replace = [
1232  '%3A' => ':',
1233  '%' => '.'
1234  ];
1235 
1236  $id = urlencode( strtr( $id, ' ', '_' ) );
1237  $id = strtr( $id, $replace );
1238 
1239  if ( !preg_match( '/^[a-zA-Z]/', $id ) && !in_array( 'noninitial', $options ) ) {
1240  // Initial character must be a letter!
1241  $id = "x$id";
1242  }
1243  return $id;
1244  }
1245 
1261  public static function escapeIdForAttribute( $id, $mode = self::ID_PRIMARY ) {
1263 
1264  if ( !isset( $wgFragmentMode[$mode] ) ) {
1265  if ( $mode === self::ID_PRIMARY ) {
1266  throw new UnexpectedValueException( '$wgFragmentMode is configured with no primary mode' );
1267  }
1268  return false;
1269  }
1270 
1271  $internalMode = $wgFragmentMode[$mode];
1272 
1273  return self::escapeIdInternal( $id, $internalMode );
1274  }
1275 
1288  public static function escapeIdForLink( $id ) {
1290 
1291  if ( !isset( $wgFragmentMode[self::ID_PRIMARY] ) ) {
1292  throw new UnexpectedValueException( '$wgFragmentMode is configured with no primary mode' );
1293  }
1294 
1296 
1297  $id = self::escapeIdInternal( $id, $mode );
1298 
1299  return $id;
1300  }
1301 
1311  public static function escapeIdForExternalInterwiki( $id ) {
1313 
1315 
1316  return $id;
1317  }
1318 
1326  private static function escapeIdInternal( $id, $mode ) {
1327  // Truncate overly-long IDs. This isn't an HTML limit, it's just
1328  // griefer protection. [T251506]
1329  $id = mb_substr( $id, 0, 1024 );
1330 
1331  switch ( $mode ) {
1332  case 'html5':
1333  $id = str_replace( ' ', '_', $id );
1334  break;
1335  case 'legacy':
1336  // This corresponds to 'noninitial' mode of the old escapeId()
1337  static $replace = [
1338  '%3A' => ':',
1339  '%' => '.'
1340  ];
1341 
1342  $id = urlencode( str_replace( ' ', '_', $id ) );
1343  $id = strtr( $id, $replace );
1344  break;
1345  case 'html5-legacy':
1346  $id = preg_replace( '/[ \t\n\r\f_\'"&#%]+/', '_', $id );
1347  $id = trim( $id, '_' );
1348  if ( $id === '' ) {
1349  // Must have been all whitespace to start with.
1350  $id = '_';
1351  }
1352  break;
1353  default:
1354  throw new InvalidArgumentException( "Invalid mode '$mode' passed to '" . __METHOD__ );
1355  }
1356 
1357  return $id;
1358  }
1359 
1372  static function escapeIdReferenceList( $referenceString, $options = [] ) {
1373  if ( $options ) {
1374  wfDeprecated( __METHOD__ . ' with $options', '1.31' );
1375  }
1376  # Explode the space delimited list string into an array of tokens
1377  $references = preg_split( '/\s+/', "{$referenceString}", -1, PREG_SPLIT_NO_EMPTY );
1378 
1379  # Escape each token as an id
1380  foreach ( $references as &$ref ) {
1381  $ref = self::escapeIdForAttribute( $ref );
1382  }
1383 
1384  # Merge the array back to a space delimited list string
1385  # If the array is empty, the result will be an empty string ('')
1386  $referenceString = implode( ' ', $references );
1387 
1388  return $referenceString;
1389  }
1390 
1402  static function escapeClass( $class ) {
1403  // Convert ugly stuff to underscores and kill underscores in ugly places
1404  return rtrim( preg_replace(
1405  [ '/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/', '/_+/' ],
1406  '_',
1407  $class ), '_' );
1408  }
1409 
1417  static function escapeHtmlAllowEntities( $html ) {
1419  # It seems wise to escape ' as well as ", as a matter of course. Can't
1420  # hurt. Use ENT_SUBSTITUTE so that incorrectly truncated multibyte characters
1421  # don't cause the entire string to disappear.
1422  $html = htmlspecialchars( $html, ENT_QUOTES | ENT_SUBSTITUTE );
1423  return $html;
1424  }
1425 
1434  public static function decodeTagAttributes( $text ) {
1435  if ( trim( $text ) == '' ) {
1436  return [];
1437  }
1438 
1439  $attribs = [];
1440  $pairs = [];
1441  if ( !preg_match_all(
1442  self::getAttribsRegex(),
1443  $text,
1444  $pairs,
1445  PREG_SET_ORDER ) ) {
1446  return $attribs;
1447  }
1448 
1449  foreach ( $pairs as $set ) {
1450  $attribute = strtolower( $set[1] );
1452 
1453  // Normalize whitespace
1454  $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1455  $value = trim( $value );
1456 
1457  // Decode character references
1458  $attribs[$attribute] = self::decodeCharReferences( $value );
1459  }
1460  return $attribs;
1461  }
1462 
1470  public static function safeEncodeTagAttributes( $assoc_array ) {
1471  $attribs = [];
1472  foreach ( $assoc_array as $attribute => $value ) {
1473  $encAttribute = htmlspecialchars( $attribute );
1474  $encValue = self::safeEncodeAttribute( $value );
1475 
1476  $attribs[] = "$encAttribute=\"$encValue\"";
1477  }
1478  return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : '';
1479  }
1480 
1489  private static function getTagAttributeCallback( $set ) {
1490  if ( isset( $set[5] ) ) {
1491  # No quotes.
1492  return $set[5];
1493  } elseif ( isset( $set[4] ) ) {
1494  # Single-quoted
1495  return $set[4];
1496  } elseif ( isset( $set[3] ) ) {
1497  # Double-quoted
1498  return $set[3];
1499  } elseif ( !isset( $set[2] ) ) {
1500  # In XHTML, attributes must have a value so return an empty string.
1501  # See "Empty attribute syntax",
1502  # https://www.w3.org/TR/html5/syntax.html#syntax-attribute-name
1503  return "";
1504  } else {
1505  throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1506  }
1507  }
1508 
1513  private static function normalizeWhitespace( $text ) {
1514  return preg_replace(
1515  '/\r\n|[\x20\x0d\x0a\x09]/',
1516  ' ',
1517  $text );
1518  }
1519 
1529  return trim( preg_replace( '/[ _]+/', ' ', $section ) );
1530  }
1531 
1547  static function normalizeCharReferences( $text ) {
1548  return preg_replace_callback(
1549  self::CHAR_REFS_REGEX,
1550  [ self::class, 'normalizeCharReferencesCallback' ],
1551  $text );
1552  }
1553 
1559  $ret = null;
1560  if ( $matches[1] != '' ) {
1562  } elseif ( $matches[2] != '' ) {
1564  } elseif ( $matches[3] != '' ) {
1566  }
1567  if ( is_null( $ret ) ) {
1568  return htmlspecialchars( $matches[0] );
1569  } else {
1570  return $ret;
1571  }
1572  }
1573 
1584  static function normalizeEntity( $name ) {
1585  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1586  return '&' . self::$htmlEntityAliases[$name] . ';';
1587  } elseif ( in_array( $name, [ 'lt', 'gt', 'amp', 'quot' ] ) ) {
1588  return "&$name;";
1589  } elseif ( isset( self::$htmlEntities[$name] ) ) {
1590  return '&#' . self::$htmlEntities[$name] . ';';
1591  } else {
1592  return "&amp;$name;";
1593  }
1594  }
1595 
1600  static function decCharReference( $codepoint ) {
1601  $point = intval( $codepoint );
1602  if ( self::validateCodepoint( $point ) ) {
1603  return sprintf( '&#%d;', $point );
1604  } else {
1605  return null;
1606  }
1607  }
1608 
1613  static function hexCharReference( $codepoint ) {
1614  $point = hexdec( $codepoint );
1615  if ( self::validateCodepoint( $point ) ) {
1616  return sprintf( '&#x%x;', $point );
1617  } else {
1618  return null;
1619  }
1620  }
1621 
1628  private static function validateCodepoint( $codepoint ) {
1629  # U+000C is valid in HTML5 but not allowed in XML.
1630  # U+000D is valid in XML but not allowed in HTML5.
1631  # U+007F - U+009F are disallowed in HTML5 (control characters).
1632  return $codepoint == 0x09
1633  || $codepoint == 0x0a
1634  || ( $codepoint >= 0x20 && $codepoint <= 0x7e )
1635  || ( $codepoint >= 0xa0 && $codepoint <= 0xd7ff )
1636  || ( $codepoint >= 0xe000 && $codepoint <= 0xfffd )
1637  || ( $codepoint >= 0x10000 && $codepoint <= 0x10ffff );
1638  }
1639 
1647  public static function decodeCharReferences( $text ) {
1648  return preg_replace_callback(
1649  self::CHAR_REFS_REGEX,
1650  [ self::class, 'decodeCharReferencesCallback' ],
1651  $text );
1652  }
1653 
1664  public static function decodeCharReferencesAndNormalize( $text ) {
1666  $text = preg_replace_callback(
1667  self::CHAR_REFS_REGEX,
1668  [ self::class, 'decodeCharReferencesCallback' ],
1669  $text,
1670  -1, //limit
1671  $count
1672  );
1673 
1674  if ( $count ) {
1675  return $wgContLang->normalize( $text );
1676  } else {
1677  return $text;
1678  }
1679  }
1680 
1686  if ( $matches[1] != '' ) {
1687  return self::decodeEntity( $matches[1] );
1688  } elseif ( $matches[2] != '' ) {
1689  return self::decodeChar( intval( $matches[2] ) );
1690  } elseif ( $matches[3] != '' ) {
1691  return self::decodeChar( hexdec( $matches[3] ) );
1692  }
1693  # Last case should be an ampersand by itself
1694  return $matches[0];
1695  }
1696 
1704  static function decodeChar( $codepoint ) {
1705  if ( self::validateCodepoint( $codepoint ) ) {
1706  return UtfNormal\Utils::codepointToUtf8( $codepoint );
1707  } else {
1709  }
1710  }
1711 
1720  static function decodeEntity( $name ) {
1721  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1722  $name = self::$htmlEntityAliases[$name];
1723  }
1724  if ( isset( self::$htmlEntities[$name] ) ) {
1725  return UtfNormal\Utils::codepointToUtf8( self::$htmlEntities[$name] );
1726  } else {
1727  return "&$name;";
1728  }
1729  }
1730 
1737  static function attributeWhitelist( $element ) {
1739  return isset( $list[$element] )
1740  ? $list[$element]
1741  : [];
1742  }
1743 
1749  static function setupAttributeWhitelist() {
1750  static $whitelist;
1751 
1752  if ( $whitelist !== null ) {
1753  return $whitelist;
1754  }
1755 
1756  $common = [
1757  # HTML
1758  'id',
1759  'class',
1760  'style',
1761  'lang',
1762  'dir',
1763  'title',
1764 
1765  # WAI-ARIA
1766  'aria-describedby',
1767  'aria-flowto',
1768  'aria-label',
1769  'aria-labelledby',
1770  'aria-owns',
1771  'role',
1772 
1773  # RDFa
1774  # These attributes are specified in section 9 of
1775  # https://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1776  'about',
1777  'property',
1778  'resource',
1779  'datatype',
1780  'typeof',
1781 
1782  # Microdata. These are specified by
1783  # https://html.spec.whatwg.org/multipage/microdata.html#the-microdata-model
1784  'itemid',
1785  'itemprop',
1786  'itemref',
1787  'itemscope',
1788  'itemtype',
1789  ];
1790 
1791  $block = array_merge( $common, [ 'align' ] );
1792  $tablealign = [ 'align', 'valign' ];
1793  $tablecell = [
1794  'abbr',
1795  'axis',
1796  'headers',
1797  'scope',
1798  'rowspan',
1799  'colspan',
1800  'nowrap', # deprecated
1801  'width', # deprecated
1802  'height', # deprecated
1803  'bgcolor', # deprecated
1804  ];
1805 
1806  # Numbers refer to sections in HTML 4.01 standard describing the element.
1807  # See: https://www.w3.org/TR/html4/
1808  $whitelist = [
1809  # 7.5.4
1810  'div' => $block,
1811  'center' => $common, # deprecated
1812  'span' => $common,
1813 
1814  # 7.5.5
1815  'h1' => $block,
1816  'h2' => $block,
1817  'h3' => $block,
1818  'h4' => $block,
1819  'h5' => $block,
1820  'h6' => $block,
1821 
1822  # 7.5.6
1823  # address
1824 
1825  # 8.2.4
1826  'bdo' => $common,
1827 
1828  # 9.2.1
1829  'em' => $common,
1830  'strong' => $common,
1831  'cite' => $common,
1832  'dfn' => $common,
1833  'code' => $common,
1834  'samp' => $common,
1835  'kbd' => $common,
1836  'var' => $common,
1837  'abbr' => $common,
1838  # acronym
1839 
1840  # 9.2.2
1841  'blockquote' => array_merge( $common, [ 'cite' ] ),
1842  'q' => array_merge( $common, [ 'cite' ] ),
1843 
1844  # 9.2.3
1845  'sub' => $common,
1846  'sup' => $common,
1847 
1848  # 9.3.1
1849  'p' => $block,
1850 
1851  # 9.3.2
1852  'br' => array_merge( $common, [ 'clear' ] ),
1853 
1854  # https://www.w3.org/TR/html5/text-level-semantics.html#the-wbr-element
1855  'wbr' => $common,
1856 
1857  # 9.3.4
1858  'pre' => array_merge( $common, [ 'width' ] ),
1859 
1860  # 9.4
1861  'ins' => array_merge( $common, [ 'cite', 'datetime' ] ),
1862  'del' => array_merge( $common, [ 'cite', 'datetime' ] ),
1863 
1864  # 10.2
1865  'ul' => array_merge( $common, [ 'type' ] ),
1866  'ol' => array_merge( $common, [ 'type', 'start', 'reversed' ] ),
1867  'li' => array_merge( $common, [ 'type', 'value' ] ),
1868 
1869  # 10.3
1870  'dl' => $common,
1871  'dd' => $common,
1872  'dt' => $common,
1873 
1874  # 11.2.1
1875  'table' => array_merge( $common,
1876  [ 'summary', 'width', 'border', 'frame',
1877  'rules', 'cellspacing', 'cellpadding',
1878  'align', 'bgcolor',
1879  ] ),
1880 
1881  # 11.2.2
1882  'caption' => $block,
1883 
1884  # 11.2.3
1885  'thead' => $common,
1886  'tfoot' => $common,
1887  'tbody' => $common,
1888 
1889  # 11.2.4
1890  'colgroup' => array_merge( $common, [ 'span' ] ),
1891  'col' => array_merge( $common, [ 'span' ] ),
1892 
1893  # 11.2.5
1894  'tr' => array_merge( $common, [ 'bgcolor' ], $tablealign ),
1895 
1896  # 11.2.6
1897  'td' => array_merge( $common, $tablecell, $tablealign ),
1898  'th' => array_merge( $common, $tablecell, $tablealign ),
1899 
1900  # 12.2
1901  # NOTE: <a> is not allowed directly, but the attrib
1902  # whitelist is used from the Parser object
1903  'a' => array_merge( $common, [ 'href', 'rel', 'rev' ] ), # rel/rev esp. for RDFa
1904 
1905  # 13.2
1906  # Not usually allowed, but may be used for extension-style hooks
1907  # such as <math> when it is rasterized, or if $wgAllowImageTag is
1908  # true
1909  'img' => array_merge( $common, [ 'alt', 'src', 'width', 'height', 'srcset' ] ),
1910 
1911  'video' => array_merge( $common, [ 'poster', 'controls', 'preload', 'width', 'height' ] ),
1912  'source' => array_merge( $common, [ 'type', 'src' ] ),
1913  'track' => array_merge( $common, [ 'type', 'src', 'srclang', 'kind', 'label' ] ),
1914 
1915  # 15.2.1
1916  'tt' => $common,
1917  'b' => $common,
1918  'i' => $common,
1919  'big' => $common,
1920  'small' => $common,
1921  'strike' => $common,
1922  's' => $common,
1923  'u' => $common,
1924 
1925  # 15.2.2
1926  'font' => array_merge( $common, [ 'size', 'color', 'face' ] ),
1927  # basefont
1928 
1929  # 15.3
1930  'hr' => array_merge( $common, [ 'width' ] ),
1931 
1932  # HTML Ruby annotation text module, simple ruby only.
1933  # https://www.w3.org/TR/html5/text-level-semantics.html#the-ruby-element
1934  'ruby' => $common,
1935  # rbc
1936  'rb' => $common,
1937  'rp' => $common,
1938  'rt' => $common, # array_merge( $common, array( 'rbspan' ) ),
1939  'rtc' => $common,
1940 
1941  # MathML root element, where used for extensions
1942  # 'title' may not be 100% valid here; it's XHTML
1943  # https://www.w3.org/TR/REC-MathML/
1944  'math' => [ 'class', 'style', 'id', 'title' ],
1945 
1946  // HTML 5 section 4.5
1947  'figure' => $common,
1948  'figcaption' => $common,
1949 
1950  # HTML 5 section 4.6
1951  'bdi' => $common,
1952 
1953  # HTML5 elements, defined by:
1954  # https://html.spec.whatwg.org/multipage/semantics.html#the-data-element
1955  'data' => array_merge( $common, [ 'value' ] ),
1956  'time' => array_merge( $common, [ 'datetime' ] ),
1957  'mark' => $common,
1958 
1959  // meta and link are only permitted by removeHTMLtags when Microdata
1960  // is enabled so we don't bother adding a conditional to hide these
1961  // Also meta and link are only valid in WikiText as Microdata elements
1962  // (ie: validateTag rejects tags missing the attributes needed for Microdata)
1963  // So we don't bother including $common attributes that have no purpose.
1964  'meta' => [ 'itemprop', 'content' ],
1965  'link' => [ 'itemprop', 'href', 'title' ],
1966  ];
1967 
1968  return $whitelist;
1969  }
1970 
1981  static function stripAllTags( $html ) {
1982  // Use RemexHtml to tokenize $html and extract the text
1984  $tokenizer = new RemexHtml\Tokenizer\Tokenizer( $handler, $html, [
1985  'ignoreErrors' => true,
1986  // don't ignore char refs, we want them to be decoded
1987  'ignoreNulls' => true,
1988  'skipPreprocess' => true,
1989  ] );
1990  $tokenizer->execute();
1991  $text = $handler->getResult();
1992 
1993  $text = self::normalizeWhitespace( $text );
1994  return $text;
1995  }
1996 
2006  static function hackDocType() {
2007  $out = "<!DOCTYPE html [\n";
2008  foreach ( self::$htmlEntities as $entity => $codepoint ) {
2009  $out .= "<!ENTITY $entity \"&#$codepoint;\">";
2010  }
2011  $out .= "]>\n";
2012  return $out;
2013  }
2014 
2019  static function cleanUrl( $url ) {
2020  # Normalize any HTML entities in input. They will be
2021  # re-escaped by makeExternalLink().
2022  $url = self::decodeCharReferences( $url );
2023 
2024  # Escape any control characters introduced by the above step
2025  $url = preg_replace_callback( '/[\][<>"\\x00-\\x20\\x7F\|]/',
2026  [ __CLASS__, 'cleanUrlCallback' ], $url );
2027 
2028  # Validate hostname portion
2029  $matches = [];
2030  if ( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
2031  list( /* $whole */, $protocol, $host, $rest ) = $matches;
2032 
2033  // Characters that will be ignored in IDNs.
2034  // https://tools.ietf.org/html/rfc3454#section-3.1
2035  // Strip them before further processing so blacklists and such work.
2036  $strip = "/
2037  \\s| # general whitespace
2038  \xc2\xad| # 00ad SOFT HYPHEN
2039  \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
2040  \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
2041  \xe2\x81\xa0| # 2060 WORD JOINER
2042  \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
2043  \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
2044  \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
2045  \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
2046  \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
2047  \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
2048  \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
2049  [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe0f VARIATION SELECTOR-1-16
2050  /xuD";
2051 
2052  $host = preg_replace( $strip, '', $host );
2053 
2054  // IPv6 host names are bracketed with []. Url-decode these.
2055  if ( substr_compare( "//%5B", $host, 0, 5 ) === 0 &&
2056  preg_match( '!^//%5B([0-9A-Fa-f:.]+)%5D((:\d+)?)$!', $host, $matches )
2057  ) {
2058  $host = '//[' . $matches[1] . ']' . $matches[2];
2059  }
2060 
2061  // @todo FIXME: Validate hostnames here
2062 
2063  return $protocol . $host . $rest;
2064  } else {
2065  return $url;
2066  }
2067  }
2068 
2073  static function cleanUrlCallback( $matches ) {
2074  return urlencode( $matches[0] );
2075  }
2076 
2105  public static function validateEmail( $addr ) {
2106  $result = null;
2107  if ( !Hooks::run( 'isValidEmailAddr', [ $addr, &$result ] ) ) {
2108  return $result;
2109  }
2110 
2111  // Please note strings below are enclosed in brackets [], this make the
2112  // hyphen "-" a range indicator. Hence it is double backslashed below.
2113  // See T28948
2114  $rfc5322_atext = "a-z0-9!#$%&'*+\\-\/=?^_`{|}~";
2115  $rfc1034_ldh_str = "a-z0-9\\-";
2116 
2117  $html5_email_regexp = "/
2118  ^ # start of string
2119  [$rfc5322_atext\\.]+ # user part which is liberal :p
2120  @ # 'apostrophe'
2121  [$rfc1034_ldh_str]+ # First domain part
2122  (\\.[$rfc1034_ldh_str]+)* # Following part prefixed with a dot
2123  $ # End of string
2124  /ix"; // case Insensitive, eXtended
2125 
2126  return (bool)preg_match( $html5_email_regexp, $addr );
2127  }
2128 }
Sanitizer\ID_FALLBACK
const ID_FALLBACK
Tells escapeUrlForHtml() to encode the ID using the fallback encoding, or return false if no fallback...
Definition: Sanitizer.php:72
$handler
this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that probably a stub it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output modifiable modifiable after all normalizations have been except for the $wgMaxImageArea check set to true or false to override the $wgMaxImageArea check result gives extension the possibility to transform it themselves $handler
Definition: hooks.txt:903
Sanitizer\normalizeEntity
static normalizeEntity( $name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the equivalent numeric entity re...
Definition: Sanitizer.php:1584
Sanitizer\escapeIdReferenceList
static escapeIdReferenceList( $referenceString, $options=[])
Given a string containing a space delimited list of ids, escape each id to match ids escaped by the e...
Definition: Sanitizer.php:1372
Sanitizer\getTagAttributeCallback
static getTagAttributeCallback( $set)
Pick the appropriate attribute value from a match set from the attribs regex matches.
Definition: Sanitizer.php:1489
Sanitizer\attributeWhitelist
static attributeWhitelist( $element)
Fetch the whitelist of acceptable attributes for a given element name.
Definition: Sanitizer.php:1737
Sanitizer\removeHTMLcomments
static removeHTMLcomments( $text)
Remove '', and everything between.
Definition: Sanitizer.php:690
$wgExperimentalHtmlIds
$wgExperimentalHtmlIds
Abandoned experiment with HTML5-style ID escaping.
Definition: DefaultSettings.php:3383
Sanitizer\stripAllTags
static stripAllTags( $html)
Take a fragment of (potentially invalid) HTML and return a version with any tags removed,...
Definition: Sanitizer.php:1981
$html
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses & $html
Definition: hooks.txt:2013
array
the array() calling protocol came about after MediaWiki 1.4rc1.
Sanitizer\EVIL_URI_PATTERN
const EVIL_URI_PATTERN
Blacklist for evil uris like javascript: WARNING: DO NOT use this in any place that actually requires...
Definition: Sanitizer.php:56
$wgExternalInterwikiFragmentMode
$wgExternalInterwikiFragmentMode
Which ID escaping mode should be used for external interwiki links? See documentation for $wgFragment...
Definition: DefaultSettings.php:3425
Sanitizer\$htmlEntities
static $htmlEntities
List of all named character entities defined in HTML 4.01 https://www.w3.org/TR/html4/sgml/entities....
Definition: Sanitizer.php:79
Sanitizer\escapeIdForAttribute
static escapeIdForAttribute( $id, $mode=self::ID_PRIMARY)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid HTM...
Definition: Sanitizer.php:1261
Sanitizer\decodeEntity
static decodeEntity( $name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the UTF-8 encoding of that chara...
Definition: Sanitizer.php:1720
$ret
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses & $ret
Definition: hooks.txt:2005
Sanitizer\mergeAttributes
static mergeAttributes( $a, $b)
Merge two sets of HTML attributes.
Definition: Sanitizer.php:910
$out
this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that probably a stub it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output $out
Definition: hooks.txt:864
Sanitizer\normalizeSectionNameWhitespace
static normalizeSectionNameWhitespace( $section)
Normalizes whitespace in a section name, such as might be returned by Parser::stripSectionName(),...
Definition: Sanitizer.php:1528
Sanitizer\escapeIdInternal
static escapeIdInternal( $id, $mode)
Helper for escapeIdFor*() functions.
Definition: Sanitizer.php:1326
Sanitizer\validateEmail
static validateEmail( $addr)
Does a string look like an e-mail address?
Definition: Sanitizer.php:2105
$params
$params
Definition: styleTest.css.php:40
Sanitizer\decCharReference
static decCharReference( $codepoint)
Definition: Sanitizer.php:1600
Sanitizer\safeEncodeTagAttributes
static safeEncodeTagAttributes( $assoc_array)
Build a partial tag string from an associative array of attribute names and values as returned by dec...
Definition: Sanitizer.php:1470
Sanitizer\decodeCharReferencesAndNormalize
static decodeCharReferencesAndNormalize( $text)
Decode any character references, numeric or named entities, in the next and normalize the resulting s...
Definition: Sanitizer.php:1664
used
you don t have to do a grep find to see where the $wgReverseTitle variable is used
Definition: hooks.txt:115
Sanitizer\$attribsRegex
static $attribsRegex
Lazy-initialised attributes regex, see getAttribsRegex()
Definition: Sanitizer.php:346
$wgFragmentMode
$wgFragmentMode
How should section IDs be encoded? This array can contain 1 or 2 elements, each of them can be one of...
Definition: DefaultSettings.php:3415
Sanitizer\escapeClass
static escapeClass( $class)
Given a value, escape it so that it can be used as a CSS class and return it.
Definition: Sanitizer.php:1402
Sanitizer\normalizeCharReferencesCallback
static normalizeCharReferencesCallback( $matches)
Definition: Sanitizer.php:1558
MWTidy\isEnabled
static isEnabled()
Definition: MWTidy.php:58
RemexStripTagHandler
Definition: RemexStripTagHandler.php:10
$result
The index of the header message $result[1]=The index of the body text message $result[2 through n]=Parameters passed to body text message. Please note the header message cannot receive/use parameters. 'ImgAuthModifyHeaders':Executed just before a file is streamed to a user via img_auth.php, allowing headers to be modified beforehand. $title:LinkTarget object & $headers:HTTP headers(name=> value, names are case insensitive). Two headers get special handling:If-Modified-Since(value must be a valid HTTP date) and Range(must be of the form "bytes=(\d*-\d*)") will be honored when streaming the file. 'ImportHandleLogItemXMLTag':When parsing a XML tag in a log item. Return false to stop further processing of the tag $reader:XMLReader object $logInfo:Array of information 'ImportHandlePageXMLTag':When parsing a XML tag in a page. Return false to stop further processing of the tag $reader:XMLReader object & $pageInfo:Array of information 'ImportHandleRevisionXMLTag':When parsing a XML tag in a page revision. Return false to stop further processing of the tag $reader:XMLReader object $pageInfo:Array of page information $revisionInfo:Array of revision information 'ImportHandleToplevelXMLTag':When parsing a top level XML tag. Return false to stop further processing of the tag $reader:XMLReader object 'ImportHandleUnknownUser':When a user doesn 't exist locally, this hook is called to give extensions an opportunity to auto-create it. If the auto-creation is successful, return false. $name:User name 'ImportHandleUploadXMLTag':When parsing a XML tag in a file upload. Return false to stop further processing of the tag $reader:XMLReader object $revisionInfo:Array of information 'ImportLogInterwikiLink':Hook to change the interwiki link used in log entries and edit summaries for transwiki imports. & $fullInterwikiPrefix:Interwiki prefix, may contain colons. & $pageTitle:String that contains page title. 'ImportSources':Called when reading from the $wgImportSources configuration variable. Can be used to lazy-load the import sources list. & $importSources:The value of $wgImportSources. Modify as necessary. See the comment in DefaultSettings.php for the detail of how to structure this array. 'InfoAction':When building information to display on the action=info page. $context:IContextSource object & $pageInfo:Array of information 'InitializeArticleMaybeRedirect':MediaWiki check to see if title is a redirect. & $title:Title object for the current page & $request:WebRequest & $ignoreRedirect:boolean to skip redirect check & $target:Title/string of redirect target & $article:Article object 'InternalParseBeforeLinks':during Parser 's internalParse method before links but after nowiki/noinclude/includeonly/onlyinclude and other processings. & $parser:Parser object & $text:string containing partially parsed text & $stripState:Parser 's internal StripState object 'InternalParseBeforeSanitize':during Parser 's internalParse method just before the parser removes unwanted/dangerous HTML tags and after nowiki/noinclude/includeonly/onlyinclude and other processings. Ideal for syntax-extensions after template/parser function execution which respect nowiki and HTML-comments. & $parser:Parser object & $text:string containing partially parsed text & $stripState:Parser 's internal StripState object 'InterwikiLoadPrefix':When resolving if a given prefix is an interwiki or not. Return true without providing an interwiki to continue interwiki search. $prefix:interwiki prefix we are looking for. & $iwData:output array describing the interwiki with keys iw_url, iw_local, iw_trans and optionally iw_api and iw_wikiid. 'InvalidateEmailComplete':Called after a user 's email has been invalidated successfully. $user:user(object) whose email is being invalidated 'IRCLineURL':When constructing the URL to use in an IRC notification. Callee may modify $url and $query, URL will be constructed as $url . $query & $url:URL to index.php & $query:Query string $rc:RecentChange object that triggered url generation 'IsFileCacheable':Override the result of Article::isFileCacheable()(if true) & $article:article(object) being checked 'IsTrustedProxy':Override the result of IP::isTrustedProxy() & $ip:IP being check & $result:Change this value to override the result of IP::isTrustedProxy() 'IsUploadAllowedFromUrl':Override the result of UploadFromUrl::isAllowedUrl() $url:URL used to upload from & $allowed:Boolean indicating if uploading is allowed for given URL 'isValidEmailAddr':Override the result of Sanitizer::validateEmail(), for instance to return false if the domain name doesn 't match your organization. $addr:The e-mail address entered by the user & $result:Set this and return false to override the internal checks 'isValidPassword':Override the result of User::isValidPassword() $password:The password entered by the user & $result:Set this and return false to override the internal checks $user:User the password is being validated for 'Language::getMessagesFileName':$code:The language code or the language we 're looking for a messages file for & $file:The messages file path, you can override this to change the location. 'LanguageGetMagic':DEPRECATED! Use $magicWords in a file listed in $wgExtensionMessagesFiles instead. Use this to define synonyms of magic words depending of the language & $magicExtensions:associative array of magic words synonyms $lang:language code(string) 'LanguageGetNamespaces':Provide custom ordering for namespaces or remove namespaces. Do not use this hook to add namespaces. Use CanonicalNamespaces for that. & $namespaces:Array of namespaces indexed by their numbers 'LanguageGetSpecialPageAliases':DEPRECATED! Use $specialPageAliases in a file listed in $wgExtensionMessagesFiles instead. Use to define aliases of special pages names depending of the language & $specialPageAliases:associative array of magic words synonyms $lang:language code(string) 'LanguageGetTranslatedLanguageNames':Provide translated language names. & $names:array of language code=> language name $code:language of the preferred translations 'LanguageLinks':Manipulate a page 's language links. This is called in various places to allow extensions to define the effective language links for a page. $title:The page 's Title. & $links:Array with elements of the form "language:title" in the order that they will be output. & $linkFlags:Associative array mapping prefixed links to arrays of flags. Currently unused, but planned to provide support for marking individual language links in the UI, e.g. for featured articles. 'LanguageSelector':Hook to change the language selector available on a page. $out:The output page. $cssClassName:CSS class name of the language selector. 'LinkBegin':DEPRECATED! Use HtmlPageLinkRendererBegin instead. Used when generating internal and interwiki links in Linker::link(), before processing starts. Return false to skip default processing and return $ret. See documentation for Linker::link() for details on the expected meanings of parameters. $skin:the Skin object $target:the Title that the link is pointing to & $html:the contents that the< a > tag should have(raw HTML) $result
Definition: hooks.txt:1993
php
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency which acts as the top level factory for services in MediaWiki which can be used to gain access to default instances of various services MediaWikiServices however also allows new services to be defined and default services to be redefined Services are defined or redefined by providing a callback the instantiator that will return a new instance of the service When it will create an instance of MediaWikiServices and populate it with the services defined in the files listed by thereby bootstrapping the DI framework Per $wgServiceWiringFiles lists includes ServiceWiring php
Definition: injection.txt:37
Sanitizer\validateTag
static validateTag( $params, $element)
Takes attribute names and values for a tag and the tag name and validates that the tag is allowed to ...
Definition: Sanitizer.php:736
Sanitizer\hackDocType
static hackDocType()
Hack up a private DOCTYPE with HTML's standard entity declarations.
Definition: Sanitizer.php:2006
Sanitizer\XMLNS_ATTRIBUTE_PATTERN
const XMLNS_ATTRIBUTE_PATTERN
Definition: Sanitizer.php:57
$wgAllowImageTag
$wgAllowImageTag
A different approach to the above: simply allow the "<img>" tag to be used.
Definition: DefaultSettings.php:4270
codepointToUtf8
codepointToUtf8( $codepoint)
Return UTF-8 sequence for a given Unicode code point.
Definition: UtfNormalUtil.php:39
MWException
MediaWiki exception.
Definition: MWException.php:26
Sanitizer\$htmlEntityAliases
static $htmlEntityAliases
Character entity aliases accepted by MediaWiki.
Definition: Sanitizer.php:338
wfDeprecated
wfDeprecated( $function, $version=false, $component=false, $callerOffset=2)
Throws a warning that $function is deprecated.
Definition: GlobalFunctions.php:1123
table
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if so it s not worth the trouble Since there is a job queue in the jobs table
Definition: deferred.txt:16
Sanitizer\safeEncodeAttribute
static safeEncodeAttribute( $text)
Encode an attribute value for HTML tags, with extra armoring against further wiki processing.
Definition: Sanitizer.php:1151
UtfNormal
Unicode normalization routines for working with UTF-8 strings.
Definition: UtfNormal.php:48
$matches
$matches
Definition: NoLocalSettings.php:24
Sanitizer\encodeAttribute
static encodeAttribute( $text)
Encode an attribute value for HTML output.
Definition: Sanitizer.php:1130
Sanitizer\validateAttributes
static validateAttributes( $attribs, $whitelist)
Take an array of attribute names and values and normalize or discard illegal values for the given whi...
Definition: Sanitizer.php:792
global
when a variable name is used in a it is silently declared as a new masking the global
Definition: design.txt:95
by
Apache License January AND DISTRIBUTION Definitions License shall mean the terms and conditions for and distribution as defined by Sections through of this document Licensor shall mean the copyright owner or entity authorized by the copyright owner that is granting the License Legal Entity shall mean the union of the acting entity and all other entities that control are controlled by or are under common control with that entity For the purposes of this definition control direct or to cause the direction or management of such whether by contract or including but not limited to software source documentation and configuration files Object form shall mean any form resulting from mechanical transformation or translation of a Source including but not limited to compiled object generated and conversions to other media types Work shall mean the work of whether in Source or Object made available under the as indicated by a copyright notice that is included in or attached to the whether in Source or Object that is based or other modifications as a an original work of authorship For the purposes of this Derivative Works shall not include works that remain separable or merely the Work and Derivative Works thereof Contribution shall mean any work of including the original version of the Work and any modifications or additions to that Work or Derivative Works that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner For the purposes of this submitted means any form of or written communication sent to the Licensor or its including but not limited to communication on electronic mailing source code control and issue tracking systems that are managed by
Definition: APACHE-LICENSE-2.0.txt:58
list
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global list
Definition: deferred.txt:11
Sanitizer\hexCharReference
static hexCharReference( $codepoint)
Definition: Sanitizer.php:1613
them
this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist Do not use this to implement individual filters if they are compatible with the ChangesListFilter and ChangesListFilterGroup structure use sub classes of those in conjunction with the ChangesListSpecialPageStructuredFilters hook This hook can be used to implement filters that do not implement that or custom behavior that is not an individual filter e g Watchlist and Watchlist you will want to construct new ChangesListBooleanFilter or ChangesListStringOptionsFilter objects When constructing them
Definition: hooks.txt:1018
will
</td >< td > &</td >< td > t want your writing to be edited mercilessly and redistributed at will
Definition: All_system_messages.txt:914
Sanitizer\validateCodepoint
static validateCodepoint( $codepoint)
Returns true if a given Unicode codepoint is a valid character in both HTML5 and XML.
Definition: Sanitizer.php:1628
$options
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped & $options
Definition: hooks.txt:2001
wfUrlProtocols
wfUrlProtocols( $includeProtocolRelative=true)
Returns a regular expression of url protocols.
Definition: GlobalFunctions.php:727
$attribs
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses after processing & $attribs
Definition: hooks.txt:2014
$value
$value
Definition: styleTest.css.php:45
Sanitizer\validateTagAttributes
static validateTagAttributes( $attribs, $element)
Take an array of attribute names and values and normalize or discard illegal values for the given ele...
Definition: Sanitizer.php:772
Sanitizer\ELEMENT_BITS_REGEX
const ELEMENT_BITS_REGEX
Acceptable tag name charset from HTML5 parsing spec https://www.w3.org/TR/html5/syntax....
Definition: Sanitizer.php:46
Sanitizer\escapeIdForExternalInterwiki
static escapeIdForExternalInterwiki( $id)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid URL...
Definition: Sanitizer.php:1311
Sanitizer\isReservedDataAttribute
static isReservedDataAttribute( $attr)
Given an attribute name, checks whether it is a reserved data attribute (such as data-mw-foo) which i...
Definition: Sanitizer.php:889
Sanitizer\cleanUrl
static cleanUrl( $url)
Definition: Sanitizer.php:2019
Sanitizer\cssDecodeCallback
static cssDecodeCallback( $matches)
Definition: Sanitizer.php:1068
Sanitizer\getRecognizedTagData
static getRecognizedTagData( $extratags=[], $removetags=[])
Return the various lists of recognized tags.
Definition: Sanitizer.php:380
Sanitizer\fixTagAttributes
static fixTagAttributes( $text, $element, $sorted=false)
Take a tag soup fragment listing an HTML element's attributes and normalize it to well-formed XML,...
Definition: Sanitizer.php:1110
UTF8_REPLACEMENT
const UTF8_REPLACEMENT
Definition: UtfNormalDefines.php:145
$args
if( $line===false) $args
Definition: cdb.php:64
$name
Allows to change the fields on the form that will be generated $name
Definition: hooks.txt:302
Sanitizer\normalizeCss
static normalizeCss( $value)
Normalize CSS into a format we can easily search for hostile input.
Definition: Sanitizer.php:932
$section
usually copyright or history_copyright This message must be in HTML not wikitext if the section is included from a template $section
Definition: hooks.txt:3022
Sanitizer\ID_PRIMARY
const ID_PRIMARY
Tells escapeUrlForHtml() to encode the ID using the wiki's primary encoding.
Definition: Sanitizer.php:64
Sanitizer\CHAR_REFS_REGEX
const CHAR_REFS_REGEX
Regular expression to match various types of character references in Sanitizer::normalizeCharReferenc...
Definition: Sanitizer.php:36
Sanitizer\normalizeWhitespace
static normalizeWhitespace( $text)
Definition: Sanitizer.php:1513
as
This document is intended to provide useful advice for parties seeking to redistribute MediaWiki to end users It s targeted particularly at maintainers for Linux since it s been observed that distribution packages of MediaWiki often break We ve consistently had to recommend that users seeking support use official tarballs instead of their distribution s and this often solves whatever problem the user is having It would be nice if this could such as
Definition: distributors.txt:22
Sanitizer\decodeChar
static decodeChar( $codepoint)
Return UTF-8 string for a codepoint if that is a valid character reference, otherwise U+FFFD REPLACEM...
Definition: Sanitizer.php:1704
StringUtils\delimiterReplace
static delimiterReplace( $startDelim, $endDelim, $replace, $subject, $flags='')
Perform an operation equivalent to preg_replace() with flags.
Definition: StringUtils.php:245
utf8ToCodepoint
utf8ToCodepoint( $char)
Determine the Unicode codepoint of a single-character UTF-8 sequence.
Definition: UtfNormalUtil.php:88
Sanitizer\normalizeCharReferences
static normalizeCharReferences( $text)
Ensure that any entities and character references are legal for XML and XHTML specifically.
Definition: Sanitizer.php:1547
in
null for the wiki Added in
Definition: hooks.txt:1591
Sanitizer\escapeIdForLink
static escapeIdForLink( $id)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid URL...
Definition: Sanitizer.php:1288
Sanitizer\decodeTagAttributes
static decodeTagAttributes( $text)
Return an associative array of attribute names and values from a partial tag string.
Definition: Sanitizer.php:1434
that
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if that
Definition: deferred.txt:13
class
you have access to all of the normal MediaWiki so you can get a DB use the etc For full docs on the Maintenance class
Definition: maintenance.txt:56
Sanitizer\setupAttributeWhitelist
static setupAttributeWhitelist()
Foreach array key (an allowed HTML element), return an array of allowed attributes.
Definition: Sanitizer.php:1749
$t
$t
Definition: testCompression.php:69
$vars
static configuration should be added through ResourceLoaderGetConfigVars instead & $vars
Definition: hooks.txt:2228
Sanitizer\decodeCharReferences
static decodeCharReferences( $text)
Decode any character references, numeric or named entities, in the text and return a UTF-8 string.
Definition: Sanitizer.php:1647
Hooks\run
static run( $event, array $args=[], $deprecatedVersion=null)
Call hook functions defined in Hooks::register and $wgHooks.
Definition: Hooks.php:203
Sanitizer
HTML sanitizer for MediaWiki.
Definition: Sanitizer.php:31
Sanitizer\checkCss
static checkCss( $value)
Pick apart some CSS and check it for forbidden or unsafe structures.
Definition: Sanitizer.php:1039
Sanitizer\escapeId
static escapeId( $id, $options=[])
Given a value, escape it so that it can be used in an id attribute and return it.
Definition: Sanitizer.php:1215
Sanitizer\getAttribsRegex
static getAttribsRegex()
Regular expression to match HTML/XML attribute pairs within a tag.
Definition: Sanitizer.php:355
Sanitizer\escapeHtmlAllowEntities
static escapeHtmlAllowEntities( $html)
Given HTML input, escape with htmlspecialchars but un-escape entities.
Definition: Sanitizer.php:1417
Sanitizer\decodeCharReferencesCallback
static decodeCharReferencesCallback( $matches)
Definition: Sanitizer.php:1685
Sanitizer\cleanUrlCallback
static cleanUrlCallback( $matches)
Definition: Sanitizer.php:2073
Sanitizer\removeHTMLtags
static removeHTMLtags( $text, $processCallback=null, $args=[], $extratags=[], $removetags=[], $warnCallback=null)
Cleans up HTML, removes dangerous tags and attributes, and removes HTML comments.
Definition: Sanitizer.php:477
$wgContLang
this class mediates it Skin Encapsulates a look and feel for the wiki All of the functions that render HTML and make choices about how to render it are here and are called from various other places when and is meant to be subclassed with other skins that may override some of its functions The User object contains a reference to a and so rather than having a global skin object we just rely on the global User and get the skin with $wgUser and also has some character encoding functions and other locale stuff The current user interface language is instantiated as and the content language as $wgContLang
Definition: design.txt:57