28use Wikimedia\RemexHtml\HTMLData;
29use Wikimedia\RemexHtml\Tokenizer\Tokenizer as RemexTokenizer;
43 '/&([A-Za-z0-9\x80-\xff]+;)
45 |&\#[xX]([0-9A-Fa-f]+);
102 if ( self::$attribsRegex ===
null ) {
103 $spaceChars =
'\x09\x0a\x0c\x0d\x20';
104 $space =
"[{$spaceChars}]";
105 $attrib =
"[^{$spaceChars}\/>=]";
106 $attribFirst =
"(?:{$attrib}|=)";
107 self::$attribsRegex =
108 "/({$attribFirst}{$attrib}*)
111 # The attribute value: quoted or alone
118 return self::$attribsRegex;
131 if ( self::$attribNameRegex ===
null ) {
132 $attribFirst =
"[:_\p{L}\p{N}]";
133 $attrib =
"[:_\.\-\p{L}\p{N}]";
134 self::$attribNameRegex =
"/^({$attribFirst}{$attrib}*)$/sxu";
136 return self::$attribNameRegex;
148 static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
149 $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
154 if ( !$staticInitialised || $staticInitialised != $globalContext ) {
155 $htmlpairsStatic = [ # Tags that must be closed
156 'b',
'bdi',
'del',
'i',
'ins',
'u',
'font',
'big',
'small',
'sub',
'sup',
'h1',
157 'h2',
'h3',
'h4',
'h5',
'h6',
'cite',
'code',
'em',
's',
158 'strike',
'strong',
'tt',
'var',
'div',
'center',
159 'blockquote',
'ol',
'ul',
'dl',
'table',
'caption',
'pre',
160 'ruby',
'rb',
'rp',
'rt',
'rtc',
'p',
'span',
'abbr',
'dfn',
161 'kbd',
'samp',
'data',
'time',
'mark'
164 'br',
'wbr',
'hr',
'li',
'dt',
'dd',
'meta',
'link'
167 # Elements that cannot have close tags. This is (not coincidentally)
168 # also the list of tags for which the HTML 5 parsing algorithm
169 # requires you to "acknowledge the token's self-closing flag", i.e.
170 # a self-closing tag like <br/> is not an HTML 5 parse error only
173 'br',
'wbr',
'hr',
'meta',
'link'
176 $htmlnest = [ # Tags that can be nested--??
177 'table',
'tr',
'td',
'th',
'div',
'blockquote',
'ol',
'ul',
178 'li',
'dl',
'dt',
'dd',
'font',
'big',
'small',
'sub',
'sup',
'span',
179 'var',
'kbd',
'samp',
'em',
'strong',
'q',
'ruby',
'bdo'
181 $tabletags = [ # Can only appear inside table, we will close them
184 $htmllist = [ # Tags used by list
187 $listtags = [ # Tags that can appear in a list
193 'is deprecated since MediaWiki 1.35',
'1.35',
false,
false );
194 $htmlsingle[] =
'img';
195 $htmlsingleonly[] =
'img';
198 $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
199 $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
201 # Convert them all to hashtables for faster lookup
202 $vars = [
'htmlpairsStatic',
'htmlsingle',
'htmlsingleonly',
'htmlnest',
'tabletags',
203 'htmllist',
'listtags',
'htmlsingleallowed',
'htmlelementsStatic' ];
204 foreach ( $vars as $var ) {
205 $$var = array_fill_keys( $$var,
true );
207 $staticInitialised = $globalContext;
210 # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
211 $extratags = array_fill_keys( $extratags,
true );
212 $removetags = array_fill_keys( $removetags,
true );
213 $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
214 $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ), $removetags );
217 'htmlpairs' => $htmlpairs,
218 'htmlsingle' => $htmlsingle,
219 'htmlsingleonly' => $htmlsingleonly,
220 'htmlnest' => $htmlnest,
221 'tabletags' => $tabletags,
222 'htmllist' => $htmllist,
223 'listtags' => $listtags,
224 'htmlsingleallowed' => $htmlsingleallowed,
225 'htmlelements' => $htmlelements,
241 $args = [], $extratags = [], $removetags = []
243 $tagData = self::getRecognizedTagData( $extratags, $removetags );
244 $htmlpairs = $tagData[
'htmlpairs'];
245 $htmlsingle = $tagData[
'htmlsingle'];
246 $htmlsingleonly = $tagData[
'htmlsingleonly'];
247 $htmlnest = $tagData[
'htmlnest'];
248 $tabletags = $tagData[
'tabletags'];
249 $htmllist = $tagData[
'htmllist'];
250 $listtags = $tagData[
'listtags'];
251 $htmlsingleallowed = $tagData[
'htmlsingleallowed'];
252 $htmlelements = $tagData[
'htmlelements'];
254 # Remove HTML comments
255 $text = self::removeHTMLcomments( $text );
256 $bits = explode(
'<', $text );
257 $text = str_replace(
'>',
'>', array_shift( $bits ) );
259 # this might be possible using remex tidy itself
260 foreach ( $bits as $x ) {
261 if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
262 list( , $slash,
$t, $params, $brace, $rest ) = $regs;
265 $t = strtolower(
$t );
266 if ( isset( $htmlelements[
$t] ) ) {
267 if ( is_callable( $processCallback ) ) {
268 call_user_func_array( $processCallback, [ &$params,
$args ] );
271 if ( $brace ==
'/>' && !( isset( $htmlsingle[
$t] ) || isset( $htmlsingleonly[
$t] ) ) ) {
276 if ( !self::validateTag( $params,
$t ) ) {
280 $newparams = self::fixTagAttributes( $params,
$t );
282 if ( $brace ===
'/>' && !isset( $htmlsingleonly[
$t] ) ) {
283 # Interpret self-closing tags as empty tags even when
284 # HTML 5 would interpret them as start tags. Such input
285 # is commonly seen on Wikimedia wikis with this intention.
289 $rest = str_replace(
'>',
'>', $rest );
290 $text .=
"<$slash$t$newparams$brace$rest";
295 $text .=
'<' . str_replace(
'>',
'>', $x );
310 while ( ( $start = strpos( $text,
'<!--' ) ) !==
false ) {
311 $end = strpos( $text,
'-->', $start + 4 );
312 if ( $end ===
false ) {
313 # Unterminated comment; bail out
319 # Trim space and newline if the comment is both
320 # preceded and followed by a newline
321 $spaceStart = max( $start - 1, 0 );
322 $spaceLen = $end - $spaceStart;
323 while ( substr( $text, $spaceStart, 1 ) ===
' ' && $spaceStart > 0 ) {
327 while ( substr( $text, $spaceStart + $spaceLen, 1 ) ===
' ' ) {
330 if ( substr( $text, $spaceStart, 1 ) ===
"\n"
331 && substr( $text, $spaceStart + $spaceLen, 1 ) ===
"\n" ) {
332 # Remove the comment, leading and trailing
333 # spaces, and leave only one newline.
334 $text = substr_replace( $text,
"\n", $spaceStart, $spaceLen + 1 );
336 # Remove just the comment.
337 $text = substr_replace( $text,
'', $start, $end - $start );
356 $params = self::decodeTagAttributes( $params );
358 if ( $element ==
'meta' || $element ==
'link' ) {
359 if ( !isset( $params[
'itemprop'] ) ) {
363 if ( $element ==
'meta' && !isset( $params[
'content'] ) ) {
367 if ( $element ==
'link' && !isset( $params[
'href'] ) ) {
392 return self::validateAttributes( $attribs,
393 self::attributesAllowedInternal( $element ) );
415 if ( isset( $allowed[0] ) ) {
418 wfDeprecated( __METHOD__ .
' with sequential array',
'1.35' );
419 $allowed = array_fill_keys( $allowed,
true );
424 foreach ( $attribs as $attribute => $value ) {
425 # Allow XML namespace declaration to allow RDFa
426 if ( preg_match( self::XMLNS_ATTRIBUTE_PATTERN, $attribute ) ) {
427 if ( !preg_match( self::EVIL_URI_PATTERN, $value ) ) {
428 $out[$attribute] = $value;
434 # Allow any attribute beginning with "data-"
436 # * Disallow data attributes used by MediaWiki code
437 # * Ensure that the attribute is not namespaced by banning
440 !preg_match(
'/^data-[^:]*$/i', $attribute ) &&
441 !array_key_exists( $attribute, $allowed )
442 ) || self::isReservedDataAttribute( $attribute ) ) {
446 # Strip javascript "expression" from stylesheets.
448 if ( $attribute ==
'style' ) {
449 $value = self::checkCss( $value );
452 # Escape HTML id attributes
453 if ( $attribute ===
'id' ) {
454 $value = self::escapeIdForAttribute( $value, self::ID_PRIMARY );
457 # Escape HTML id reference lists
458 if ( $attribute ===
'aria-describedby'
459 || $attribute ===
'aria-flowto'
460 || $attribute ===
'aria-labelledby'
461 || $attribute ===
'aria-owns'
463 $value = self::escapeIdReferenceListInternal( $value );
468 if ( $attribute ===
'rel' || $attribute ===
'rev'
470 || $attribute ===
'about' || $attribute ===
'property'
471 || $attribute ===
'resource' || $attribute ===
'datatype'
472 || $attribute ===
'typeof'
474 || $attribute ===
'itemid' || $attribute ===
'itemprop'
475 || $attribute ===
'itemref' || $attribute ===
'itemscope'
476 || $attribute ===
'itemtype'
479 if ( preg_match( self::EVIL_URI_PATTERN, $value ) ) {
484 # NOTE: even though elements using href/src are not allowed directly, supply
485 # validation code that can be used by tag hook handlers, etc
486 if ( $attribute ===
'href' || $attribute ===
'src' || $attribute ===
'poster' ) {
487 if ( !preg_match( $hrefExp, $value ) ) {
493 if ( $attribute ===
'tabindex' && $value !==
'0' ) {
500 $out[$attribute] = $value;
503 # itemtype, itemid, itemref don't make sense without itemscope
504 if ( !array_key_exists(
'itemscope', $out ) ) {
505 unset( $out[
'itemtype'] );
506 unset( $out[
'itemid'] );
507 unset( $out[
'itemref'] );
509 # TODO: Strip itemprop if we aren't descendants of an itemscope or pointed to by an itemref.
529 return (
bool)preg_match(
'/^data-(ooui|mw|parsoid)/i', $attr );
543 $out = array_merge( $a, $b );
544 if ( isset( $a[
'class'] ) && isset( $b[
'class'] )
545 && is_string( $a[
'class'] ) && is_string( $b[
'class'] )
546 && $a[
'class'] !== $b[
'class']
548 $classes = preg_split(
'/\s+/',
"{$a['class']} {$b['class']}",
549 -1, PREG_SPLIT_NO_EMPTY );
550 $out[
'class'] = implode(
' ', array_unique( $classes ) );
565 $value = self::decodeCharReferences( $value );
577 if ( !$decodeRegex ) {
578 $space =
'[\\x20\\t\\r\\n\\f]';
579 $nl =
'(?:\\n|\\r\\n|\\r|\\f)';
581 $decodeRegex =
"/ $backslash
583 ($nl) | # 1. Line continuation
584 ([0-9A-Fa-f]{1,6})$space? | # 2. character number
585 (.) | # 3. backslash cancelling special meaning
586 () | # 4. backslash at end of string
589 $value = preg_replace_callback( $decodeRegex,
590 [ __CLASS__,
'cssDecodeCallback' ], $value );
595 if ( !preg_match(
'! ^ \s* /\* [^*\\/]* \*/ \s* $ !x', $value ) ) {
606 $commentPos = strpos( $value,
'/*' );
607 if ( $commentPos !==
false ) {
608 $value = substr( $value, 0, $commentPos );
634 $value = self::normalizeCss( $value );
637 if ( preg_match(
'/[\000-\010\013\016-\037\177]/', $value ) ||
638 strpos( $value, UtfNormal\Constants::UTF8_REPLACEMENT ) !==
false ) {
639 return '/* invalid control char */';
640 } elseif ( preg_match(
650 | attr\s*\([^)]+[\s,]+url
653 return '/* insecure input */';
667 $char = UtfNormal\Utils::codepointToUtf8( hexdec(
$matches[2] ) );
673 if ( $char ==
"\n" || $char ==
'"' || $char ==
"'" || $char ==
'\\' ) {
676 return '\\' . dechex( ord( $char ) ) .
' ';
705 if ( trim( $text ) ==
'' ) {
709 $decoded = self::decodeTagAttributes( $text );
710 $stripped = self::validateTagAttributes( $decoded, $element );
716 return self::safeEncodeTagAttributes( $stripped );
725 $encValue = htmlspecialchars( $text, ENT_QUOTES );
730 $encValue = strtr( $encValue, [
751 # French spaces, last one Guillemet-left
752 # only if it isn't followed by a word character.
753 '/ (?=[?:;!%»›](?!\w))/u' =>
"$space",
754 # French spaces, Guillemet-right
755 '/([«‹]) /u' =>
"\\1$space",
757 return preg_replace( array_keys( $fixtags ), array_values( $fixtags ), $text );
767 $encValue = self::encodeAttribute( $text );
769 # Templates and links may be expanded in later parsing,
770 # creating invalid or dangerous output. Suppress this.
771 $encValue = strtr( $encValue, [
779 "''" =>
'''',
780 'ISBN' =>
'ISBN',
782 'PMID' =>
'PMID',
788 $encValue = preg_replace_callback(
791 return str_replace(
':',
':',
$matches[1] );
816 if ( $mode === self::ID_PRIMARY ) {
817 throw new UnexpectedValueException(
'$wgFragmentMode is configured with no primary mode' );
824 return self::escapeIdInternal( $id, $internalMode );
843 throw new UnexpectedValueException(
'$wgFragmentMode is configured with no primary mode' );
848 $id = self::escapeIdInternalUrl( $id, $mode );
880 $id = self::escapeIdInternal( $id, $mode );
881 if ( $mode ===
'html5' ) {
882 $id = preg_replace(
'/%([a-fA-F0-9]{2})/',
'%25$1', $id );
897 $id = mb_substr( $id, 0, 1024 );
905 $id = str_replace( [
"\t",
"\n",
"\f",
"\r",
" " ],
'_', $id );
914 $id = urlencode( str_replace(
' ',
'_', $id ) );
915 $id = strtr( $id, $replace );
918 throw new InvalidArgumentException(
"Invalid mode '$mode' passed to '" . __METHOD__ );
936 return self::escapeIdReferenceListInternal( $referenceString );
947 # Explode the space delimited list string into an array of tokens
948 $references = preg_split(
'/\s+/',
"{$referenceString}", -1, PREG_SPLIT_NO_EMPTY );
950 # Escape each token as an id
951 foreach ( $references as &$ref ) {
952 $ref = self::escapeIdForAttribute( $ref );
955 # Merge the array back to a space delimited list string
956 # If the array is empty, the result will be an empty string ('')
957 $referenceString = implode(
' ', $references );
959 return $referenceString;
975 return rtrim( preg_replace(
976 [
'/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/',
'/_+/' ],
989 $html = self::decodeCharReferences( $html );
990 # It seems wise to escape ' as well as ", as a matter of course. Can't
991 # hurt. Use ENT_SUBSTITUTE so that incorrectly truncated multibyte characters
992 # don't cause the entire string to disappear.
993 $html = htmlspecialchars( $html, ENT_QUOTES | ENT_SUBSTITUTE );
1005 public static function decodeTagAttributes( $text ) {
1006 if ( trim( $text ) == '' ) {
1011 if ( !preg_match_all(
1012 self::getAttribsRegex(),
1015 PREG_SET_ORDER ) ) {
1020 foreach ( $pairs as $set ) {
1021 $attribute = strtolower( $set[1] );
1023 // Filter attribute names with unacceptable characters
1024 if ( !preg_match( self::getAttribNameRegex(), $attribute ) ) {
1028 $value = self::getTagAttributeCallback( $set );
1030 // Normalize whitespace
1031 $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1032 $value = trim( $value );
1034 // Decode character references
1035 $attribs[$attribute] = self::decodeCharReferences( $value );
1047 public static function safeEncodeTagAttributes( $assoc_array ) {
1049 foreach ( $assoc_array as $attribute => $value ) {
1050 $encAttribute = htmlspecialchars( $attribute );
1051 $encValue = self::safeEncodeAttribute( $value );
1053 $attribs[] = "$encAttribute=\"$encValue\"";
1055 return count( $attribs ) ?
' ' . implode(
' ', $attribs ) :
'';
1067 if ( isset( $set[5] ) ) {
1070 } elseif ( isset( $set[4] ) ) {
1073 } elseif ( isset( $set[3] ) ) {
1076 } elseif ( !isset( $set[2] ) ) {
1077 # In XHTML, attributes must have a value so return an empty string.
1078 # See "Empty attribute syntax",
1082 throw new MWException(
"Tag conditions not met. This should never happen and is a bug." );
1091 return trim( preg_replace(
1092 '/(?:\r\n|[\x20\x0d\x0a\x09])+/',
1106 return trim( preg_replace(
'/[ _]+/',
' ', $section ) );
1125 return preg_replace_callback(
1126 self::CHAR_REFS_REGEX,
1127 [ self::class,
'normalizeCharReferencesCallback' ],
1138 $ret = self::normalizeEntity(
$matches[1] );
1140 $ret = self::decCharReference(
$matches[2] );
1142 $ret = self::hexCharReference(
$matches[3] );
1144 if ( $ret ===
null ) {
1145 return htmlspecialchars(
$matches[0] );
1162 if ( isset( self::MW_ENTITY_ALIASES[$name] ) ) {
1164 return '&' . self::MW_ENTITY_ALIASES[$name];
1165 } elseif ( in_array( $name, [
'lt;',
'gt;',
'amp;',
'quot;' ],
true ) ) {
1168 } elseif ( isset( HTMLData::$namedEntityTranslations[$name] ) ) {
1170 return preg_replace_callback(
'/./Ssu',
static function ( $m ) {
1171 return '&#' . UtfNormal\Utils::utf8ToCodepoint( $m[0] ) .
';';
1172 }, HTMLData::$namedEntityTranslations[$name] );
1174 return "&$name";
1183 $point = intval( $codepoint );
1184 if ( self::validateCodepoint( $point ) ) {
1185 return sprintf(
'&#%d;', $point );
1196 $point = hexdec( $codepoint );
1197 if ( self::validateCodepoint( $point ) ) {
1198 return sprintf(
'&#x%x;', $point );
1211 # U+000C is valid in HTML5 but not allowed in XML.
1212 # U+000D is valid in XML but not allowed in HTML5.
1213 # U+007F - U+009F are disallowed in HTML5 (control characters).
1214 return $codepoint == 0x09
1215 || $codepoint == 0x0a
1216 || ( $codepoint >= 0x20 && $codepoint <= 0x7e )
1217 || ( $codepoint >= 0xa0 && $codepoint <= 0xd7ff )
1218 || ( $codepoint >= 0xe000 && $codepoint <= 0xfffd )
1219 || ( $codepoint >= 0x10000 && $codepoint <= 0x10ffff );
1230 return preg_replace_callback(
1231 self::CHAR_REFS_REGEX,
1232 [ self::class,
'decodeCharReferencesCallback' ],
1247 $text = preg_replace_callback(
1248 self::CHAR_REFS_REGEX,
1249 [ self::class,
'decodeCharReferencesCallback' ],
1256 return MediaWikiServices::getInstance()->getContentLanguage()->normalize( $text );
1268 return self::decodeEntity(
$matches[1] );
1270 return self::decodeChar( intval(
$matches[2] ) );
1272 return self::decodeChar( hexdec(
$matches[3] ) );
1274 # Last case should be an ampersand by itself
1286 if ( self::validateCodepoint( $codepoint ) ) {
1287 return UtfNormal\Utils::codepointToUtf8( $codepoint );
1289 return UtfNormal\Constants::UTF8_REPLACEMENT;
1303 if ( isset( self::MW_ENTITY_ALIASES[$name] ) ) {
1304 $name = self::MW_ENTITY_ALIASES[$name];
1306 $trans = HTMLData::$namedEntityTranslations[$name] ??
null;
1307 return $trans ??
"&$name";
1318 $list = self::setupAttributesAllowedInternal();
1319 return $list[$element] ?? [];
1332 if ( $allowed !==
null ) {
1338 $merge =
static function ( $a, $b, $c = [] ) {
1341 array_fill_keys( $b,
true ),
1342 array_fill_keys( $c,
true ) );
1344 $common = $merge( [], [
1364 # These attributes are specified in section 9 of
1372 # Microdata. These are specified by
1381 $block = $merge( $common, [
'align' ] );
1383 $tablealign = [
'align',
'valign' ];
1391 'nowrap', # deprecated
1392 'width', # deprecated
1393 'height', # deprecated
1394 'bgcolor', # deprecated
1397 # Numbers refer to sections in HTML 4.01 standard describing the element.
1402 'center' => $common, # deprecated
1421 'strong' => $common,
1432 'blockquote' => $merge( $common, [
'cite' ] ),
1433 'q' => $merge( $common, [
'cite' ] ),
1443 'br' => $merge( $common, [
'clear' ] ),
1449 'pre' => $merge( $common, [
'width' ] ),
1452 'ins' => $merge( $common, [
'cite',
'datetime' ] ),
1453 'del' => $merge( $common, [
'cite',
'datetime' ] ),
1456 'ul' => $merge( $common, [
'type' ] ),
1457 'ol' => $merge( $common, [
'type',
'start',
'reversed' ] ),
1458 'li' => $merge( $common, [
'type',
'value' ] ),
1466 'table' => $merge( $common,
1467 [
'summary',
'width',
'border',
'frame',
1468 'rules',
'cellspacing',
'cellpadding',
1473 'caption' => $block,
1481 'colgroup' => $merge( $common, [
'span' ] ),
1482 'col' => $merge( $common, [
'span' ] ),
1485 'tr' => $merge( $common, [
'bgcolor' ], $tablealign ),
1488 'td' => $merge( $common, $tablecell, $tablealign ),
1489 'th' => $merge( $common, $tablecell, $tablealign ),
1492 # NOTE: <a> is not allowed directly, but this list of allowed
1493 # attributes is used from the Parser object
1494 'a' => $merge( $common, [
'href',
'rel',
'rev' ] ), # rel/rev esp.
for RDFa
1497 # Not usually allowed, but may be used for extension-style hooks
1498 # such as <math> when it is rasterized, or if $wgAllowImageTag is
1500 'img' => $merge( $common, [
'alt',
'src',
'width',
'height',
'srcset' ] ),
1501 # Attributes for A/V tags added in T163583 / T133673
1502 'audio' => $merge( $common, [
'controls',
'preload',
'width',
'height' ] ),
1503 'video' => $merge( $common, [
'poster',
'controls',
'preload',
'width',
'height' ] ),
1504 'source' => $merge( $common, [
'type',
'src' ] ),
1505 'track' => $merge( $common, [
'type',
'src',
'srclang',
'kind',
'label' ] ),
1513 'strike' => $common,
1518 'font' => $merge( $common, [
'size',
'color',
'face' ] ),
1522 'hr' => $merge( $common, [
'width' ] ),
1524 # HTML Ruby annotation text module, simple ruby only.
1530 'rt' => $common, # $merge( $common, [
'rbspan' ] ),
1533 # MathML root element, where used for extensions
1534 # 'title' may not be 100% valid here; it's XHTML
1536 'math' => $merge( [], [
'class',
'style',
'id',
'title' ] ),
1539 'figure' => $common,
1540 'figcaption' => $common,
1542 # HTML 5 section 4.6
1545 # HTML5 elements, defined by:
1547 'data' => $merge( $common, [
'value' ] ),
1548 'time' => $merge( $common, [
'datetime' ] ),
1556 'meta' => $merge( [], [
'itemprop',
'content' ] ),
1557 'link' => $merge( [], [
'itemprop',
'href',
'title' ] ),
1559 # HTML 5 section 4.3.5
1580 $tokenizer =
new RemexTokenizer( $handler, $html, [
1581 'ignoreErrors' =>
true,
1583 'ignoreNulls' =>
true,
1584 'skipPreprocess' =>
true,
1586 $tokenizer->execute();
1587 $text = $handler->getResult();
1589 $text = self::normalizeWhitespace( $text );
1605 $out =
"<!DOCTYPE html [\n";
1606 foreach ( HTMLData::$namedEntityTranslations as $entity => $translation ) {
1607 if ( substr( $entity, -1 ) !==
';' ) {
1612 $name = substr( $entity, 0, -1 );
1613 $expansion = self::normalizeEntity( $entity );
1614 if ( $entity === $expansion ) {
1618 $out .=
"<!ENTITY $name \"$expansion\">";
1629 # Normalize any HTML entities in input. They will be
1630 # re-escaped by makeExternalLink().
1631 $url = self::decodeCharReferences( $url );
1633 # Escape any control characters introduced by the above step
1634 $url = preg_replace_callback(
'/[\][<>"\\x00-\\x20\\x7F\|]/',
1635 [ __CLASS__,
'cleanUrlCallback' ], $url );
1637 # Validate hostname portion
1639 if ( preg_match(
'!^([^:]+:)(//[^/]+)?(.*)$!iD', $url,
$matches ) ) {
1640 list( , $protocol, $host, $rest ) =
$matches;
1646 \\s| # general whitespace
1647 \xc2\xad| # 00ad SOFT HYPHEN
1648 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1649 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1650 \xe2\x81\xa0| # 2060 WORD JOINER
1651 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1652 \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
1653 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1654 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1655 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1656 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1657 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1658 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe0f VARIATION SELECTOR-1-16
1661 $host = preg_replace( $strip,
'', $host );
1664 if ( substr_compare(
"//%5B", $host, 0, 5 ) === 0 &&
1665 preg_match(
'!^//%5B([0-9A-Fa-f:.]+)%5D((:\d+)?)$!', $host,
$matches )
1672 return $protocol . $host . $rest;
1717 if ( !Hooks::runner()->onIsValidEmailAddr( $addr, $result ) ) {
1724 $rfc5322_atext =
"a-z0-9!#$%&'*+\\-\/=?^_`{|}~";
1725 $rfc1034_ldh_str =
"a-z0-9\\-";
1727 $html5_email_regexp =
"/
1729 [$rfc5322_atext\\.]+ # user part which is liberal :p
1731 [$rfc1034_ldh_str]+ # First domain part
1732 (\\.[$rfc1034_ldh_str]+)* # Following part prefixed with a dot
1736 return (
bool)preg_match( $html5_email_regexp, $addr );
$wgAllowImageTag
A different approach to the above: simply allow the "<img>" tag to be used.
$wgFragmentMode
How should section IDs be encoded? This array can contain 1 or 2 elements, each of them can be one of...
$wgExternalInterwikiFragmentMode
Which ID escaping mode should be used for external interwiki links? See documentation for $wgFragment...
wfDeprecatedMsg( $msg, $version=false, $component=false, $callerOffset=2)
Log a deprecation warning with arbitrary message text.
wfUrlProtocols( $includeProtocolRelative=true)
Returns a regular expression of url protocols.
wfDeprecated( $function, $version=false, $component=false, $callerOffset=2)
Logs a warning that a deprecated feature was used.
HTML sanitizer for MediaWiki.
static fixTagAttributes( $text, $element, $sorted=false)
Take a tag soup fragment listing an HTML element's attributes and normalize it to well-formed XML,...
const CHAR_REFS_REGEX
Regular expression to match various types of character references in Sanitizer::normalizeCharReferenc...
static decCharReference( $codepoint)
static isReservedDataAttribute( $attr)
Given an attribute name, checks whether it is a reserved data attribute (such as data-mw-foo) which i...
static escapeIdInternalUrl( $id, $mode)
Do percent encoding of percent signs for href (but not id) attributes.
static decodeChar( $codepoint)
Return UTF-8 string for a codepoint if that is a valid character reference, otherwise U+FFFD REPLACEM...
static escapeHtmlAllowEntities( $html)
Given HTML input, escape with htmlspecialchars but un-escape entities.
static getAttribNameRegex()
Used in Sanitizer::decodeTagAttributes to filter attributes.
static checkCss( $value)
Pick apart some CSS and check it for forbidden or unsafe structures.
static decodeEntity( $name)
If the named entity is defined in HTML5 return the UTF-8 encoding of that character.
static normalizeEntity( $name)
If the named entity is defined in HTML5 return the equivalent numeric entity reference (except for th...
static validateAttributes( $attribs, $allowed)
Take an array of attribute names and values and normalize or discard illegal values.
static armorFrenchSpaces( $text, $space=' ')
Armor French spaces with a replacement character.
static setupAttributesAllowedInternal()
Foreach array key (an allowed HTML element), return an array of allowed attributes.
static getRecognizedTagData( $extratags=[], $removetags=[])
Return the various lists of recognized tags.
static $attribsRegex
Lazy-initialised attributes regex, see getAttribsRegex()
static escapeIdForLink( $id)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid URL...
static removeHTMLcomments( $text)
Remove '', and everything between.
static encodeAttribute( $text)
Encode an attribute value for HTML output.
static hexCharReference( $codepoint)
static validateTagAttributes( $attribs, $element)
Take an array of attribute names and values and normalize or discard illegal values for the given ele...
static escapeClass( $class)
Given a value, escape it so that it can be used as a CSS class and return it.
const EVIL_URI_PATTERN
Pattern matching evil uris like javascript: WARNING: DO NOT use this in any place that actually requi...
static normalizeSectionNameWhitespace( $section)
Normalizes whitespace in a section name, such as might be returned by Parser::stripSectionName(),...
static normalizeCharReferencesCallback( $matches)
static hackDocType()
Hack up a private DOCTYPE with HTML's standard entity declarations.
static cleanUrlCallback( $matches)
static normalizeCharReferences( $text)
Ensure that any entities and character references are legal for XML and XHTML specifically.
static removeHTMLtags( $text, $processCallback=null, $args=[], $extratags=[], $removetags=[])
Cleans up HTML, removes dangerous tags and attributes, and removes HTML comments.
static cssDecodeCallback( $matches)
static escapeIdReferenceList( $referenceString)
Given a string containing a space delimited list of ids, escape each id to match ids escaped by the e...
const MW_ENTITY_ALIASES
Character entity aliases accepted by MediaWiki in wikitext.
static normalizeWhitespace( $text)
static escapeIdReferenceListInternal( $referenceString)
Given a string containing a space delimited list of ids, escape each id to match ids escaped by the e...
static getAttribsRegex()
Regular expression to match HTML/XML attribute pairs within a tag.
static validateCodepoint( $codepoint)
Returns true if a given Unicode codepoint is a valid character in both HTML5 and XML.
const ID_FALLBACK
Tells escapeUrlForHtml() to encode the ID using the fallback encoding, or return false if no fallback...
static decodeCharReferences( $text)
Decode any character references, numeric or named entities, in the text and return a UTF-8 string.
static escapeIdForAttribute( $id, $mode=self::ID_PRIMARY)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid HTM...
static $attribNameRegex
Lazy-initialised attribute name regex, see getAttribNameRegex()
static getTagAttributeCallback( $set)
Pick the appropriate attribute value from a match set from the attribs regex matches.
static escapeIdInternal( $id, $mode)
Helper for escapeIdFor*() functions.
static validateTag( $params, $element)
Takes attribute names and values for a tag and the tag name and validates that the tag is allowed to ...
static stripAllTags( $html)
Take a fragment of (potentially invalid) HTML and return a version with any tags removed,...
static attributesAllowedInternal( $element)
Fetch the list of acceptable attributes for a given element name.
static decodeCharReferencesAndNormalize( $text)
Decode any character references, numeric or named entities, in the next and normalize the resulting s...
static decodeCharReferencesCallback( $matches)
static mergeAttributes( $a, $b)
Merge two sets of HTML attributes.
static escapeIdForExternalInterwiki( $id)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid URL...
static validateEmail( $addr)
Does a string look like an e-mail address?
const ID_PRIMARY
Tells escapeUrlForHtml() to encode the ID using the wiki's primary encoding.
const ELEMENT_BITS_REGEX
Acceptable tag name charset from HTML5 parsing spec https://www.w3.org/TR/html5/syntax....
static safeEncodeAttribute( $text)
Encode an attribute value for HTML tags, with extra armoring against further wiki processing.
const XMLNS_ATTRIBUTE_PATTERN
static normalizeCss( $value)
Normalize CSS into a format we can easily search for hostile input.
static delimiterReplace( $startDelim, $endDelim, $replace, $subject, $flags='')
Perform an operation equivalent to preg_replace() with flags.