HTML sanitizer for MediaWiki. More...

Static Public Member Functions
static	armorFrenchSpaces ( $text, $space=' ')
	Armor French spaces with a replacement character.

static	checkCss ( $value)
	Pick apart some CSS and check it for forbidden or unsafe structures.

static	cleanUrl ( $url)

static	decodeCharReferences ( $text)
	Decode any character references, numeric or named entities, in the text and return a UTF-8 string.

static	decodeCharReferencesAndNormalize ( $text)
	Decode any character references, numeric or named entities, in the next and normalize the resulting string.

static	decodeTagAttributes ( $text)
	Return an associative array of attribute names and values from a partial tag string.

static	encodeAttribute ( $text)
	Encode an attribute value for HTML output.

static	escapeClass ( $class)
	Given a value, escape it so that it can be used as a CSS class and return it.

static	escapeHtmlAllowEntities ( $html)
	Given HTML input, escape with htmlspecialchars but un-escape entities.

static	escapeIdForAttribute ( $id, $mode=self::ID_PRIMARY)
	Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid HTML id attribute.

static	escapeIdForExternalInterwiki ( $id)
	Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid URL fragment for external interwikis.

static	escapeIdForLink ( $id)
	Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid URL fragment.

static	escapeIdReferenceList ( $referenceString)
	Given a string containing a space delimited list of ids, escape each id to match ids escaped by the escapeIdForAttribute() function.

static	fixTagAttributes ( $text, $element, $sorted=false)
	Take a tag soup fragment listing an HTML element's attributes and normalize it to well-formed XML, discarding unwanted attributes.

static	getRecognizedTagData ( $extratags=[], $removetags=[])
	Return the various lists of recognized tags.

static	hackDocType ()
	Hack up a private DOCTYPE with HTML's standard entity declarations.

static	isReservedDataAttribute ( $attr)
	Given an attribute name, checks whether it is a reserved data attribute (such as data-mw-foo) which is unavailable to user-generated HTML so MediaWiki core and extension code can safely use it to communicate with frontend code.

static	mergeAttributes ( $a, $b)
	Merge two sets of HTML attributes.

static	normalizeCharReferences ( $text)
	Ensure that any entities and character references are legal for XML and XHTML specifically.

static	normalizeCss ( $value)
	Normalize CSS into a format we can easily search for hostile input.

static	normalizeSectionNameWhitespace ( $section)
	Normalizes whitespace in a section name, such as might be returned by Parser::stripSectionName(), for use in the id's that are used for section links.

static	removeHTMLcomments ( $text)
	Remove '', and everything between.

static	removeHTMLtags ( $text, $processCallback=null, $args=[], $extratags=[], $removetags=[])
	Cleans up HTML, removes dangerous tags and attributes, and removes HTML comments.

static	safeEncodeAttribute ( $text)
	Encode an attribute value for HTML tags, with extra armoring against further wiki processing.

static	safeEncodeTagAttributes ( $assoc_array)
	Build a partial tag string from an associative array of attribute names and values as returned by decodeTagAttributes.

static	stripAllTags ( $html)
	Take a fragment of (potentially invalid) HTML and return a version with any tags removed, encoded as plain text.

static	validateAttributes ( $attribs, $allowed)
	Take an array of attribute names and values and normalize or discard illegal values.

static	validateEmail ( $addr)
	Does a string look like an e-mail address?

static	validateTagAttributes ( $attribs, $element)
	Take an array of attribute names and values and normalize or discard illegal values for the given element type.

Public Attributes
const	ID_FALLBACK = 1
	Tells escapeUrlForHtml() to encode the ID using the fallback encoding, or return false if no fallback is configured.

const	ID_PRIMARY = 0
	Tells escapeUrlForHtml() to encode the ID using the wiki's primary encoding.

Static Private Member Functions
static	attributesAllowedInternal ( $element)
	Fetch the list of acceptable attributes for a given element name.

static	cleanUrlCallback ( $matches)

static	cssDecodeCallback ( $matches)

static	decCharReference ( $codepoint)

static	decodeChar ( $codepoint)
	Return UTF-8 string for a codepoint if that is a valid character reference, otherwise U+FFFD REPLACEMENT CHARACTER.

static	decodeCharReferencesCallback ( $matches)

static	decodeEntity ( $name)
	If the named entity is defined in HTML5 return the UTF-8 encoding of that character.

static	escapeIdInternal ( $id, $mode)
	Helper for escapeIdFor*() functions.

static	escapeIdInternalUrl ( $id, $mode)
	Do percent encoding of percent signs for href (but not id) attributes.

static	escapeIdReferenceListInternal ( $referenceString)
	Given a string containing a space delimited list of ids, escape each id to match ids escaped by the escapeIdForAttribute() function.

static	getAttribNameRegex ()
	Used in Sanitizer::decodeTagAttributes to filter attributes.

static	getAttribsRegex ()
	Regular expression to match HTML/XML attribute pairs within a tag.

static	getTagAttributeCallback ( $set)
	Pick the appropriate attribute value from a match set from the attribs regex matches.

static	hexCharReference ( $codepoint)

static	normalizeCharReferencesCallback ( $matches)

static	normalizeEntity ( $name)
	If the named entity is defined in HTML5 return the equivalent numeric entity reference (except for the core < > & ").

static	normalizeWhitespace ( $text)

static	setupAttributesAllowedInternal ()
	Foreach array key (an allowed HTML element), return an array of allowed attributes.

static	validateCodepoint ( $codepoint)
	Returns true if a given Unicode codepoint is a valid character in both HTML5 and XML.

static	validateTag ( $params, $element)
	Takes attribute names and values for a tag and the tag name and validates that the tag is allowed to be present.

Private Attributes
const	CHAR_REFS_REGEX
	Regular expression to match various types of character references in Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences.

const	ELEMENT_BITS_REGEX = '!^(/?)([A-Za-z][^\t\n\v />\0]+)([^>]?)(/?>)([^<]*)$!'
	Acceptable tag name charset from HTML5 parsing spec https://www.w3.org/TR/html5/syntax.html#tag-open-state.

const	EVIL_URI_PATTERN = '!(^\|\s\|\/\s)(javascript\|vbscript)([^\w]\|$)!i'
	Pattern matching evil uris like javascript: WARNING: DO NOT use this in any place that actually requires denying certain URIs for security reasons.

const	MW_ENTITY_ALIASES
	Character entity aliases accepted by MediaWiki in wikitext.

const	XMLNS_ATTRIBUTE_PATTERN = "/^xmlns:[:A-Z_a-z-.0-9]+$/"

Static Private Attributes
static	$attribNameRegex
	Lazy-initialised attribute name regex, see getAttribNameRegex()

static	$attribsRegex
	Lazy-initialised attributes regex, see getAttribsRegex()

Detailed Description

HTML sanitizer for MediaWiki.

Definition at line 35 of file Sanitizer.php.

Member Function Documentation

◆ armorFrenchSpaces()

static Sanitizer::armorFrenchSpaces	(	$text,
		$space = `' '`
	)

static

Armor French spaces with a replacement character.

Since: 1.32

Parameters

string	$text	Text to armor
string	$space	Space character for the French spaces, defaults to ' '

Returns: string Armored text

Definition at line 747 of file Sanitizer.php.

◆ attributesAllowedInternal()

static Sanitizer::attributesAllowedInternal ( $element )

staticprivate

Fetch the list of acceptable attributes for a given element name.

Parameters

string $element

Returns: array An associative array where keys are acceptable attribute names

Definition at line 1317 of file Sanitizer.php.

◆ checkCss()

static Sanitizer::checkCss ( $value )

static

Pick apart some CSS and check it for forbidden or unsafe structures.

Returns a sanitized string. This sanitized string will have character references and escape sequences decoded and comments stripped (unless it is itself one valid comment, in which case the value will be passed through). If the input is just too evil, only a comment complaining about evilness will be returned.

Currently URL references, 'expression', 'tps' are forbidden.

NOTE: Despite the fact that character references are decoded, the returned string may contain character references given certain clever input strings. These character references must be escaped before the return value is embedded in HTML.

Parameters

string $value

Returns: string

Definition at line 633 of file Sanitizer.php.

◆ cleanUrl()

static Sanitizer::cleanUrl ( $url )

static

Parameters

string $url

Returns: mixed|string

Definition at line 1628 of file Sanitizer.php.

References $matches.

◆ cleanUrlCallback()

static Sanitizer::cleanUrlCallback ( $matches )

staticprivate

Parameters

array $matches

Returns: string

Definition at line 1682 of file Sanitizer.php.

References $matches.

◆ cssDecodeCallback()

static Sanitizer::cssDecodeCallback ( $matches )

staticprivate

Parameters

array $matches

Returns: string

Definition at line 662 of file Sanitizer.php.

References $matches.

◆ decCharReference()

static Sanitizer::decCharReference ( $codepoint )

staticprivate

Parameters

int $codepoint

Returns: null|string

Definition at line 1182 of file Sanitizer.php.

◆ decodeChar()

static Sanitizer::decodeChar ( $codepoint )

staticprivate

Return UTF-8 string for a codepoint if that is a valid character reference, otherwise U+FFFD REPLACEMENT CHARACTER.

Parameters

int $codepoint

Returns: string

Access: internal

Definition at line 1285 of file Sanitizer.php.

◆ decodeCharReferences()

static Sanitizer::decodeCharReferences ( $text )

static

Decode any character references, numeric or named entities, in the text and return a UTF-8 string.

Parameters

string $text

Returns: string

Definition at line 1229 of file Sanitizer.php.

◆ decodeCharReferencesAndNormalize()

static Sanitizer::decodeCharReferencesAndNormalize ( $text )

static

Decode any character references, numeric or named entities, in the next and normalize the resulting string.

(T16952)

This is useful for page titles, not for text to be displayed, MediaWiki allows HTML entities to escape normalization as a feature.

Parameters

string $text Already normalized, containing entities

Returns: string Still normalized, without entities

Definition at line 1246 of file Sanitizer.php.

◆ decodeCharReferencesCallback()

static Sanitizer::decodeCharReferencesCallback ( $matches )

staticprivate

Parameters

string $matches

Returns: string

Definition at line 1266 of file Sanitizer.php.

References $matches.

◆ decodeEntity()

static Sanitizer::decodeEntity ( $name )

staticprivate

If the named entity is defined in HTML5 return the UTF-8 encoding of that character.

Otherwise, returns pseudo-entity source (eg "&foo;")

Parameters

string $name Semicolon-terminated entity name

Returns: string

Definition at line 1301 of file Sanitizer.php.

◆ decodeTagAttributes()

static Sanitizer::decodeTagAttributes ( $text )

static

Return an associative array of attribute names and values from a partial tag string.

Attribute names are forced to lowercase, character references are decoded to UTF-8 text.

Parameters

string $text

Returns: array

Definition at line 1005 of file Sanitizer.php.

◆ encodeAttribute()

static Sanitizer::encodeAttribute ( $text )

static

Encode an attribute value for HTML output.

Parameters

string $text

Returns: string HTML-encoded text fragment

Definition at line 724 of file Sanitizer.php.

◆ escapeClass()

static Sanitizer::escapeClass ( $class )

static

Given a value, escape it so that it can be used as a CSS class and return it.

Todo:: For extra validity, input should be validated UTF-8.

See also: https://www.w3.org/TR/CSS21/syndata.html Valid characters/format

Parameters

string $class

Returns: string

Definition at line 973 of file Sanitizer.php.

◆ escapeHtmlAllowEntities()

static Sanitizer::escapeHtmlAllowEntities ( $html )

static

Given HTML input, escape with htmlspecialchars but un-escape entities.

This allows (generally harmless) entities like   to survive.

Parameters

string $html HTML to escape

Returns: string Escaped input

Definition at line 988 of file Sanitizer.php.

◆ escapeIdForAttribute()

static Sanitizer::escapeIdForAttribute	(	$id,
		$mode = `self::ID_PRIMARY`
	)

static

Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid HTML id attribute.

WARNING: The output of this function is not guaranteed to be HTML safe, so be sure to use proper escaping.

Parameters

string	$id	String to escape
int	$mode	One of ID_* constants, specifying whether the primary or fallback encoding should be used.

Returns: string|bool Escaped ID or false if fallback encoding is requested but it's not configured.

Since: 1.30

Definition at line 812 of file Sanitizer.php.

References $wgFragmentMode.

◆ escapeIdForExternalInterwiki()

static Sanitizer::escapeIdForExternalInterwiki ( $id )

static

Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid URL fragment for external interwikis.

Parameters

string $id String to escape

Returns: string Escaped ID

Since: 1.30

Definition at line 862 of file Sanitizer.php.

References $wgExternalInterwikiFragmentMode.

◆ escapeIdForLink()

static Sanitizer::escapeIdForLink ( $id )

static

Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid URL fragment.

WARNING: The output of this function is not guaranteed to be HTML safe, so be sure to use proper escaping.

Parameters

string $id String to escape

Returns: string Escaped ID

Since: 1.30

Definition at line 839 of file Sanitizer.php.

References $wgFragmentMode.

◆ escapeIdInternal()

static Sanitizer::escapeIdInternal	(	$id,
		$mode
	)

staticprivate

Helper for escapeIdFor*() functions.

Performs most of the actual escaping.

Parameters

string	$id	String to escape
string	$mode	One of modes from $wgFragmentMode

Returns: string

Definition at line 894 of file Sanitizer.php.

◆ escapeIdInternalUrl()

static Sanitizer::escapeIdInternalUrl	(	$id,
		$mode
	)

staticprivate

Do percent encoding of percent signs for href (but not id) attributes.

Since: 1.35

See also: https://phabricator.wikimedia.org/T238385

Parameters

string	$id	String to escape
string	$mode	One of modes from $wgFragmentMode

Returns: string

Definition at line 879 of file Sanitizer.php.

◆ escapeIdReferenceList()

static Sanitizer::escapeIdReferenceList ( $referenceString )

static

Given a string containing a space delimited list of ids, escape each id to match ids escaped by the escapeIdForAttribute() function.

Since: 1.27

Deprecated:: since 1.36. Unused outside this class, will be made private.

Parameters

string $referenceString Space delimited list of ids

Returns: string

Definition at line 934 of file Sanitizer.php.

References wfDeprecated().

◆ escapeIdReferenceListInternal()

static Sanitizer::escapeIdReferenceListInternal ( $referenceString )

staticprivate

Given a string containing a space delimited list of ids, escape each id to match ids escaped by the escapeIdForAttribute() function.

Parameters

string $referenceString Space delimited list of ids

Returns: string

Definition at line 946 of file Sanitizer.php.

◆ fixTagAttributes()

static Sanitizer::fixTagAttributes	(	$text,
		$element,
		$sorted = `false`
	)

static

Take a tag soup fragment listing an HTML element's attributes and normalize it to well-formed XML, discarding unwanted attributes.

Output is safe for further wikitext processing, with escaping of values that could trigger problems.

Normalizes attribute names to lowercase
Discards attributes not allowed for the given element
Turns broken or invalid entities into plaintext
Double-quotes all attribute values
Attributes without values are given the name as attribute
Double attributes are discarded
Unsafe style attributes are discarded
Prepends space if there are attributes.
(Optionally) Sorts attributes by name.

Parameters

string	$text
string	$element
bool	$sorted	Whether to sort the attributes (default: false)

Returns: string

Definition at line 704 of file Sanitizer.php.

◆ getAttribNameRegex()

static Sanitizer::getAttribNameRegex ( )

staticprivate

Used in Sanitizer::decodeTagAttributes to filter attributes.

Returns: string

Definition at line 130 of file Sanitizer.php.

◆ getAttribsRegex()

static Sanitizer::getAttribsRegex ( )

staticprivate

Regular expression to match HTML/XML attribute pairs within a tag.

Based on https://www.w3.org/TR/html5/syntax.html#before-attribute-name-state Used in Sanitizer::decodeTagAttributes

Returns: string

Definition at line 101 of file Sanitizer.php.

◆ getRecognizedTagData()

static Sanitizer::getRecognizedTagData	(	$extratags = `[]`,
		$removetags = `[]`
	)

static

Return the various lists of recognized tags.

Parameters

array	$extratags	For any extra tags to include
array	$removetags	For any tags (default or extra) to exclude

Returns: array

Definition at line 145 of file Sanitizer.php.

References $wgAllowImageTag, and wfDeprecatedMsg().

◆ getTagAttributeCallback()

static Sanitizer::getTagAttributeCallback ( $set )

staticprivate

Pick the appropriate attribute value from a match set from the attribs regex matches.

Parameters

array $set

Exceptions

MWException When tag conditions are not met.

Returns: string

Definition at line 1066 of file Sanitizer.php.

◆ hackDocType()

static Sanitizer::hackDocType ( )

static

Hack up a private DOCTYPE with HTML's standard entity declarations.

PHP 4 seemed to know these if you gave it an HTML doctype, but PHP 5.1 doesn't.

Use for passing XHTML fragments to PHP's XML parsing functions

Returns: string

Deprecated:: since 1.36; will be made private or removed in a future release.

Definition at line 1604 of file Sanitizer.php.

◆ hexCharReference()

static Sanitizer::hexCharReference ( $codepoint )

staticprivate

Parameters

int $codepoint

Returns: null|string

Definition at line 1195 of file Sanitizer.php.

◆ isReservedDataAttribute()

static Sanitizer::isReservedDataAttribute ( $attr )

static

Given an attribute name, checks whether it is a reserved data attribute (such as data-mw-foo) which is unavailable to user-generated HTML so MediaWiki core and extension code can safely use it to communicate with frontend code.

Parameters

string $attr Attribute name.

Returns: bool

Definition at line 521 of file Sanitizer.php.

◆ mergeAttributes()

static Sanitizer::mergeAttributes	(	$a,
		$b
	)

static

Merge two sets of HTML attributes.

Conflicting items in the second set will override those in the first, except for 'class' attributes which will be combined (if they're both strings).

Todo:: implement merging for other attributes such as style

Parameters

array	$a
array	$b

Returns: array

Definition at line 542 of file Sanitizer.php.

◆ normalizeCharReferences()

static Sanitizer::normalizeCharReferences ( $text )

static

Ensure that any entities and character references are legal for XML and XHTML specifically.

Any stray bits will be &-escaped to result in a valid text fragment.

a. named char refs can only be < > & ", others are numericized (this way we're well-formed even without a DTD) b. any numeric char refs must be legal chars, not invalid or forbidden c. use lower cased "&#x", not "&#X" d. fix or reject non-valid attributes

Parameters

string $text

Returns: string

Access: internal

Definition at line 1124 of file Sanitizer.php.

◆ normalizeCharReferencesCallback()

static Sanitizer::normalizeCharReferencesCallback ( $matches )

staticprivate

Parameters

string $matches

Returns: string

Definition at line 1135 of file Sanitizer.php.

References $matches.

◆ normalizeCss()

static Sanitizer::normalizeCss ( $value )

static

Normalize CSS into a format we can easily search for hostile input.

decode character references
decode escape sequences
remove comments, unless the entire value is one single comment
Parameters

string $value the css string

Returns
string normalized css

Definition at line 563 of file Sanitizer.php.

References StringUtils\delimiterReplace().

◆ normalizeEntity()

static Sanitizer::normalizeEntity ( $name )

staticprivate

If the named entity is defined in HTML5 return the equivalent numeric entity reference (except for the core < > & ").

If the entity is a MediaWiki-specific alias, returns the HTML equivalent. Otherwise, returns HTML-escaped text of pseudo-entity source (eg &foo;)

Parameters

string $name Semicolon-terminated name

Returns: string

Definition at line 1161 of file Sanitizer.php.

◆ normalizeSectionNameWhitespace()

static Sanitizer::normalizeSectionNameWhitespace ( $section )

static

Normalizes whitespace in a section name, such as might be returned by Parser::stripSectionName(), for use in the id's that are used for section links.

Parameters

string $section

Returns: string

Definition at line 1105 of file Sanitizer.php.

◆ normalizeWhitespace()

static Sanitizer::normalizeWhitespace ( $text )

staticprivate

Parameters

string $text

Returns: string

Definition at line 1090 of file Sanitizer.php.

◆ removeHTMLcomments()

static Sanitizer::removeHTMLcomments ( $text )

static

Remove '', and everything between.

To avoid leaving blank lines, when a comment is both preceded and followed by a newline (ignoring spaces), trim leading and trailing spaces and one of the newlines.

Parameters

string $text

Returns: string

Definition at line 309 of file Sanitizer.php.

◆ removeHTMLtags()

static Sanitizer::removeHTMLtags	(	$text,
		$processCallback = `null`,
		$args = `[]`,
		$extratags = `[]`,
		$removetags = `[]`
	)

static

Cleans up HTML, removes dangerous tags and attributes, and removes HTML comments.

Parameters

string	$text
callable \| null	$processCallback	Callback to do any variable or parameter replacements in HTML attribute values
array \| bool	$args	Arguments for the processing callback
array	$extratags	For any extra tags to include
array	$removetags	For any tags (default or extra) to exclude

Returns: string

Definition at line 240 of file Sanitizer.php.

References $args, and $t.

◆ safeEncodeAttribute()

static Sanitizer::safeEncodeAttribute ( $text )

static

Encode an attribute value for HTML tags, with extra armoring against further wiki processing.

Parameters

string $text

Returns: string HTML-encoded text fragment

Definition at line 766 of file Sanitizer.php.

References $matches, and wfUrlProtocols().

◆ safeEncodeTagAttributes()

static Sanitizer::safeEncodeTagAttributes ( $assoc_array )

static

Build a partial tag string from an associative array of attribute names and values as returned by decodeTagAttributes.

Parameters

array $assoc_array

Returns: string

Definition at line 1047 of file Sanitizer.php.

◆ setupAttributesAllowedInternal()

static Sanitizer::setupAttributesAllowedInternal ( )

staticprivate

Foreach array key (an allowed HTML element), return an array of allowed attributes.

Returns: array An associative array: keys are HTML element names; values are associative arrays where the keys are allowed attribute names.

Definition at line 1329 of file Sanitizer.php.

◆ stripAllTags()

static Sanitizer::stripAllTags ( $html )

static

Take a fragment of (potentially invalid) HTML and return a version with any tags removed, encoded as plain text.

Warning: this return value must be further escaped for literal inclusion in HTML output as of 1.10!

Parameters

string $html HTML fragment

Returns: string; -taint tainted

Definition at line 1577 of file Sanitizer.php.

◆ validateAttributes()

static Sanitizer::validateAttributes	(	$attribs,
		$allowed
	)

static

Take an array of attribute names and values and normalize or discard illegal values.

Discards attributes not on the given list
Unsafe style attributes are discarded
Invalid id attributes are re-encoded

Parameters

array	$attribs
array	$allowed	List of allowed attribute names, as an associative array where keys give valid attribute names (since 1.34). Before 1.35, passing a sequential array of valid attribute names was permitted but that is now deprecated.

Returns: array

Todo:

Check for legal values where the DTD limits things.

Check for unique id attribute :P

Definition at line 414 of file Sanitizer.php.

References wfDeprecated(), and wfUrlProtocols().

◆ validateCodepoint()

static Sanitizer::validateCodepoint ( $codepoint )

staticprivate

Returns true if a given Unicode codepoint is a valid character in both HTML5 and XML.

Parameters

int $codepoint

Returns: bool

Definition at line 1210 of file Sanitizer.php.

◆ validateEmail()

static Sanitizer::validateEmail ( $addr )

static

Does a string look like an e-mail address?

This validates an email address using an HTML5 specification found at: http://www.whatwg.org/html/states-of-the-type-attribute.html#valid-e-mail-address Which as of 2011-01-24 says:

A valid e-mail address is a string that matches the ABNF production 1*( atext / "." ) "@" ldh-str *( "." ldh-str ) where atext is defined in RFC 5322 section 3.2.3, and ldh-str is defined in RFC 1034 section 3.5.

This function is an implementation of the specification as requested in T24449.

Client-side forms will use the same standard validation rules via JS or HTML 5 validation; additional restrictions can be enforced server-side by extensions via the 'isValidEmailAddr' hook.

Note that this validation doesn't 100% match RFC 2822, but is believed to be liberal enough for wide use. Some invalid addresses will still pass validation here.

Since: 1.18

Parameters

string $addr E-mail address

Returns: bool

Definition at line 1714 of file Sanitizer.php.

◆ validateTag()

static Sanitizer::validateTag	(	$params,
		$element
	)

staticprivate

Takes attribute names and values for a tag and the tag name and validates that the tag is allowed to be present.

This DOES NOT validate the attributes, nor does it validate the tags themselves. This method only handles the special circumstances where we may want to allow a tag within content but ONLY when it has specific attributes set.

Parameters

string	$params
string	$element

Returns: bool

Definition at line 355 of file Sanitizer.php.

◆ validateTagAttributes()

static Sanitizer::validateTagAttributes	(	$attribs,
		$element
	)

static

Take an array of attribute names and values and normalize or discard illegal values for the given element type.

Discards attributes not allowed for the given element
Unsafe style attributes are discarded
Invalid id attributes are re-encoded

Parameters

array	$attribs
string	$element

Returns: array

Todo:

Check for legal values where the DTD limits things.

Check for unique id attribute :P

Definition at line 391 of file Sanitizer.php.

Member Data Documentation

◆ $attribNameRegex

Sanitizer::$attribNameRegex

staticprivate

Lazy-initialised attribute name regex, see getAttribNameRegex()

Definition at line 124 of file Sanitizer.php.

◆ $attribsRegex

Sanitizer::$attribsRegex

staticprivate

Lazy-initialised attributes regex, see getAttribsRegex()

Definition at line 93 of file Sanitizer.php.

◆ CHAR_REFS_REGEX

const Sanitizer::CHAR_REFS_REGEX

private

Initial value:

=
        '/&([A-Za-z0-9\x80-\xff]+;)
         |&\#([0-9]+);
         |&\#[xX]([0-9A-Fa-f]+);
         |(&)/x'

Regular expression to match various types of character references in Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences.

Note that HTML5 allows some named entities to omit the trailing semicolon; wikitext entities must have a trailing semicolon.

Definition at line 42 of file Sanitizer.php.

◆ ELEMENT_BITS_REGEX

const Sanitizer::ELEMENT_BITS_REGEX = '!^(/?)([A-Za-z][^\t\n\v />\0]*+)([^>]*?)(/?>)([^<]*)$!'

private

Acceptable tag name charset from HTML5 parsing spec https://www.w3.org/TR/html5/syntax.html#tag-open-state.

Definition at line 52 of file Sanitizer.php.

◆ EVIL_URI_PATTERN

const Sanitizer::EVIL_URI_PATTERN = '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i'

private

Pattern matching evil uris like javascript: WARNING: DO NOT use this in any place that actually requires denying certain URIs for security reasons.

There are NUMEROUS1 ways to bypass pattern-based deny lists; the only way to be secure from javascript: uri based xss vectors is to allow only things that you know are safe and deny everything else.

Definition at line 63 of file Sanitizer.php.

◆ ID_FALLBACK

const Sanitizer::ID_FALLBACK = 1

Tells escapeUrlForHtml() to encode the ID using the fallback encoding, or return false if no fallback is configured.

Since: 1.30

Definition at line 79 of file Sanitizer.php.

◆ ID_PRIMARY

const Sanitizer::ID_PRIMARY = 0

Tells escapeUrlForHtml() to encode the ID using the wiki's primary encoding.

Since: 1.30

Definition at line 71 of file Sanitizer.php.

◆ MW_ENTITY_ALIASES

const Sanitizer::MW_ENTITY_ALIASES

private

Initial value:

= [
        'רלמ;' => 'rlm;',
        'رلم;' => 'rlm;',
    ]

Character entity aliases accepted by MediaWiki in wikitext.

These are not part of the HTML standard.

Definition at line 85 of file Sanitizer.php.

◆ XMLNS_ATTRIBUTE_PATTERN

const Sanitizer::XMLNS_ATTRIBUTE_PATTERN = "/^xmlns:[:A-Z_a-z-.0-9]+$/"

private

Definition at line 64 of file Sanitizer.php.

The documentation for this class was generated from the following file:

includes/parser/Sanitizer.php

Static Public Member Functions

Public Attributes

Static Private Member Functions

Private Attributes

Static Private Attributes

Detailed Description

Member Function Documentation

◆ armorFrenchSpaces()

◆ attributesAllowedInternal()

◆ checkCss()

◆ cleanUrl()

◆ cleanUrlCallback()

◆ cssDecodeCallback()

◆ decCharReference()

◆ decodeChar()

◆ decodeCharReferences()

◆ decodeCharReferencesAndNormalize()

◆ decodeCharReferencesCallback()

◆ decodeEntity()

◆ decodeTagAttributes()

◆ encodeAttribute()

◆ escapeClass()

◆ escapeHtmlAllowEntities()

◆ escapeIdForAttribute()

◆ escapeIdForExternalInterwiki()

◆ escapeIdForLink()

◆ escapeIdInternal()

◆ escapeIdInternalUrl()

◆ escapeIdReferenceList()

◆ escapeIdReferenceListInternal()

◆ fixTagAttributes()

◆ getAttribNameRegex()

◆ getAttribsRegex()

◆ getRecognizedTagData()

◆ getTagAttributeCallback()

◆ hackDocType()

◆ hexCharReference()

◆ isReservedDataAttribute()

◆ mergeAttributes()

◆ normalizeCharReferences()

◆ normalizeCharReferencesCallback()

◆ normalizeCss()

◆ normalizeEntity()

◆ normalizeSectionNameWhitespace()

◆ normalizeWhitespace()

◆ removeHTMLcomments()

◆ removeHTMLtags()

◆ safeEncodeAttribute()

◆ safeEncodeTagAttributes()

◆ setupAttributesAllowedInternal()

◆ stripAllTags()

◆ validateAttributes()

◆ validateCodepoint()

◆ validateEmail()

◆ validateTag()

◆ validateTagAttributes()

Member Data Documentation

◆ $attribNameRegex

◆ $attribsRegex

◆ CHAR_REFS_REGEX

◆ ELEMENT_BITS_REGEX

◆ EVIL_URI_PATTERN

◆ ID_FALLBACK

◆ ID_PRIMARY

◆ MW_ENTITY_ALIASES

◆ XMLNS_ATTRIBUTE_PATTERN