MediaWiki  master
SanitizerTest.php
Go to the documentation of this file.
1 <?php
2 
10 
11  protected function tearDown() {
13  parent::tearDown();
14  }
15 
19  public function testDecodeNamedEntities() {
20  $this->assertEquals(
21  "\xc3\xa9cole",
22  Sanitizer::decodeCharReferences( '&eacute;cole' ),
23  'decode named entities'
24  );
25  }
26 
30  public function testDecodeNumericEntities() {
31  $this->assertEquals(
32  "\xc4\x88io bonas dans l'\xc3\xa9cole!",
33  Sanitizer::decodeCharReferences( "&#x108;io bonas dans l'&#233;cole!" ),
34  'decode numeric entities'
35  );
36  }
37 
41  public function testDecodeMixedEntities() {
42  $this->assertEquals(
43  "\xc4\x88io bonas dans l'\xc3\xa9cole!",
44  Sanitizer::decodeCharReferences( "&#x108;io bonas dans l'&eacute;cole!" ),
45  'decode mixed numeric/named entities'
46  );
47  }
48 
52  public function testDecodeMixedComplexEntities() {
53  $this->assertEquals(
54  "\xc4\x88io bonas dans l'\xc3\xa9cole! (mais pas &#x108;io dans l'&eacute;cole)",
56  "&#x108;io bonas dans l'&eacute;cole! (mais pas &amp;#x108;io dans l'&#38;eacute;cole)"
57  ),
58  'decode mixed complex entities'
59  );
60  }
61 
65  public function testInvalidAmpersand() {
66  $this->assertEquals(
67  'a & b',
69  'Invalid ampersand'
70  );
71  }
72 
76  public function testInvalidEntities() {
77  $this->assertEquals(
78  '&foo;',
80  'Invalid named entity'
81  );
82  }
83 
87  public function testInvalidNumberedEntities() {
88  $this->assertEquals(
89  UtfNormal\Constants::UTF8_REPLACEMENT,
90  Sanitizer::decodeCharReferences( "&#88888888888888;" ),
91  'Invalid numbered entity'
92  );
93  }
94 
102  public function testRemovehtmltagsOnHtml5Tags( $tag, $escaped ) {
103  $this->hideDeprecated( 'disabling tidy' );
104  $this->hideDeprecated( 'MWTidy::setInstance' );
105  MWTidy::setInstance( false );
106 
107  if ( $escaped ) {
108  $this->assertEquals( "&lt;$tag&gt;",
109  Sanitizer::removeHTMLtags( "<$tag>" )
110  );
111  } else {
112  $this->assertEquals( "<$tag></$tag>\n",
113  Sanitizer::removeHTMLtags( "<$tag>" )
114  );
115  }
116  }
117 
121  public static function provideHtml5Tags() {
122  $ESCAPED = true; # We want tag to be escaped
123  $VERBATIM = false; # We want to keep the tag
124  return [
125  [ 'data', $VERBATIM ],
126  [ 'mark', $VERBATIM ],
127  [ 'time', $VERBATIM ],
128  [ 'video', $ESCAPED ],
129  ];
130  }
131 
132  function dataRemoveHTMLtags() {
133  return [
134  // former testSelfClosingTag
135  [
136  '<div>Hello world</div />',
137  '<div>Hello world</div>',
138  'Self-closing closing div'
139  ],
140  // Make sure special nested HTML5 semantics are not broken
141  // https://html.spec.whatwg.org/multipage/semantics.html#the-kbd-element
142  [
143  '<kbd><kbd>Shift</kbd>+<kbd>F3</kbd></kbd>',
144  '<kbd><kbd>Shift</kbd>+<kbd>F3</kbd></kbd>',
145  'Nested <kbd>.'
146  ],
147  // https://html.spec.whatwg.org/multipage/semantics.html#the-sub-and-sup-elements
148  [
149  '<var>x<sub><var>i</var></sub></var>, <var>y<sub><var>i</var></sub></var>',
150  '<var>x<sub><var>i</var></sub></var>, <var>y<sub><var>i</var></sub></var>',
151  'Nested <var>.'
152  ],
153  // https://html.spec.whatwg.org/multipage/semantics.html#the-dfn-element
154  [
155  '<dfn><abbr title="Garage Door Opener">GDO</abbr></dfn>',
156  '<dfn><abbr title="Garage Door Opener">GDO</abbr></dfn>',
157  '<abbr> inside <dfn>',
158  ],
159  ];
160  }
161 
166  public function testRemoveHTMLtags( $input, $output, $msg = null ) {
167  $this->hideDeprecated( 'disabling tidy' );
168  $this->hideDeprecated( 'MWTidy::setInstance' );
169  MWTidy::setInstance( false );
170  $this->assertEquals( $output, Sanitizer::removeHTMLtags( $input ), $msg );
171  }
172 
177  public function testDecodeTagAttributes( $expected, $attributes, $message = '' ) {
178  $this->assertEquals( $expected,
179  Sanitizer::decodeTagAttributes( $attributes ),
180  $message
181  );
182  }
183 
184  public static function provideTagAttributesToDecode() {
185  return [
186  [ [ 'foo' => 'bar' ], 'foo=bar', 'Unquoted attribute' ],
187  [ [ 'עברית' => 'bar' ], 'עברית=bar', 'Non-Latin attribute' ],
188  [ [ '६' => 'bar' ], '६=bar', 'Devanagari number' ],
189  [ [ '搭𨋢' => 'bar' ], '搭𨋢=bar', 'Non-BMP character' ],
190  [ [], 'ńgh=bar', 'Combining accent is not allowed' ],
191  [ [ 'foo' => 'bar' ], ' foo = bar ', 'Spaced attribute' ],
192  [ [ 'foo' => 'bar' ], 'foo="bar"', 'Double-quoted attribute' ],
193  [ [ 'foo' => 'bar' ], 'foo=\'bar\'', 'Single-quoted attribute' ],
194  [
195  [ 'foo' => 'bar', 'baz' => 'foo' ],
196  'foo=\'bar\' baz="foo"',
197  'Several attributes'
198  ],
199  [
200  [ 'foo' => 'bar', 'baz' => 'foo' ],
201  'foo=\'bar\' baz="foo"',
202  'Several attributes'
203  ],
204  [
205  [ 'foo' => 'bar', 'baz' => 'foo' ],
206  'foo=\'bar\' baz="foo"',
207  'Several attributes'
208  ],
209  [ [ ':foo' => 'bar' ], ':foo=\'bar\'', 'Leading :' ],
210  [ [ '_foo' => 'bar' ], '_foo=\'bar\'', 'Leading _' ],
211  [ [ 'foo' => 'bar' ], 'Foo=\'bar\'', 'Leading capital' ],
212  [ [ 'foo' => 'BAR' ], 'FOO=BAR', 'Attribute keys are normalized to lowercase' ],
213 
214  # Invalid beginning
215  [ [], '-foo=bar', 'Leading - is forbidden' ],
216  [ [], '.foo=bar', 'Leading . is forbidden' ],
217  [ [ 'foo-bar' => 'bar' ], 'foo-bar=bar', 'A - is allowed inside the attribute' ],
218  [ [ 'foo-' => 'bar' ], 'foo-=bar', 'A - is allowed inside the attribute' ],
219  [ [ 'foo.bar' => 'baz' ], 'foo.bar=baz', 'A . is allowed inside the attribute' ],
220  [ [ 'foo.' => 'baz' ], 'foo.=baz', 'A . is allowed as last character' ],
221  [ [ 'foo6' => 'baz' ], 'foo6=baz', 'Numbers are allowed' ],
222 
223  # This bit is more relaxed than XML rules, but some extensions use
224  # it, like ProofreadPage (see T29539)
225  [ [ '1foo' => 'baz' ], '1foo=baz', 'Leading numbers are allowed' ],
226  [ [], 'foo$=baz', 'Symbols are not allowed' ],
227  [ [], 'foo@=baz', 'Symbols are not allowed' ],
228  [ [], 'foo~=baz', 'Symbols are not allowed' ],
229  [
230  [ 'foo' => '1[#^`*%w/(' ],
231  'foo=1[#^`*%w/(',
232  'All kind of characters are allowed as values'
233  ],
234  [
235  [ 'foo' => '1[#^`*%\'w/(' ],
236  'foo="1[#^`*%\'w/("',
237  'Double quotes are allowed if quoted by single quotes'
238  ],
239  [
240  [ 'foo' => '1[#^`*%"w/(' ],
241  'foo=\'1[#^`*%"w/(\'',
242  'Single quotes are allowed if quoted by double quotes'
243  ],
244  [ [ 'foo' => '&"' ], 'foo=&amp;&quot;', 'Special chars can be provided as entities' ],
245  [ [ 'foo' => '&foobar;' ], 'foo=&foobar;', 'Entity-like items are accepted' ],
246  ];
247  }
248 
253  public function testDeprecatedAttributesUnaltered( $inputAttr, $inputEl, $message = '' ) {
254  $this->assertEquals( " $inputAttr",
255  Sanitizer::fixTagAttributes( $inputAttr, $inputEl ),
256  $message
257  );
258  }
259 
260  public static function provideDeprecatedAttributes() {
262  return [
263  [ 'clear="left"', 'br' ],
264  [ 'clear="all"', 'br' ],
265  [ 'width="100"', 'td' ],
266  [ 'nowrap="true"', 'td' ],
267  [ 'nowrap=""', 'td' ],
268  [ 'align="right"', 'td' ],
269  [ 'align="center"', 'table' ],
270  [ 'align="left"', 'tr' ],
271  [ 'align="center"', 'div' ],
272  [ 'align="left"', 'h1' ],
273  [ 'align="left"', 'p' ],
274  ];
275  }
276 
281  public function testCssCommentsChecking( $expected, $css, $message = '' ) {
282  $this->assertEquals( $expected,
284  $message
285  );
286  }
287 
288  public static function provideCssCommentsFixtures() {
290  return [
291  // Valid comments spanning entire input
292  [ '/**/', '/**/' ],
293  [ '/* comment */', '/* comment */' ],
294  // Weird stuff
295  [ ' ', '/****/' ],
296  [ ' ', '/* /* */' ],
297  [ 'display: block;', "display:/* foo */block;" ],
298  [ 'display: block;', "display:\\2f\\2a foo \\2a\\2f block;",
299  'Backslash-escaped comments must be stripped (T30450)' ],
300  [ '', '/* unfinished comment structure',
301  'Remove anything after a comment-start token' ],
302  [ '', "\\2f\\2a unifinished comment'",
303  'Remove anything after a backslash-escaped comment-start token' ],
304  [
305  '/* insecure input */',
306  'filter: progid:DXImageTransform.Microsoft.AlphaImageLoader'
307  . '(src=\'asdf.png\',sizingMethod=\'scale\');'
308  ],
309  [
310  '/* insecure input */',
311  '-ms-filter: "progid:DXImageTransform.Microsoft.AlphaImageLoader'
312  . '(src=\'asdf.png\',sizingMethod=\'scale\')";'
313  ],
314  [ '/* insecure input */', 'width: expression(1+1);' ],
315  [ '/* insecure input */', 'background-image: image(asdf.png);' ],
316  [ '/* insecure input */', 'background-image: -webkit-image(asdf.png);' ],
317  [ '/* insecure input */', 'background-image: -moz-image(asdf.png);' ],
318  [ '/* insecure input */', 'background-image: image-set("asdf.png" 1x, "asdf.png" 2x);' ],
319  [
320  '/* insecure input */',
321  'background-image: -webkit-image-set("asdf.png" 1x, "asdf.png" 2x);'
322  ],
323  [
324  '/* insecure input */',
325  'background-image: -moz-image-set("asdf.png" 1x, "asdf.png" 2x);'
326  ],
327  [ '/* insecure input */', 'foo: attr( title, url );' ],
328  [ '/* insecure input */', 'foo: attr( title url );' ],
329  ];
330  }
331 
336  public function testEscapeHtmlAllowEntities( $expected, $html ) {
337  $this->assertEquals(
338  $expected,
340  );
341  }
342 
343  public static function provideEscapeHtmlAllowEntities() {
344  return [
345  [ 'foo', 'foo' ],
346  [ 'a¡b', 'a&#161;b' ],
347  [ 'foo&#039;bar', "foo'bar" ],
348  [ '&lt;script&gt;foo&lt;/script&gt;', '<script>foo</script>' ],
349  ];
350  }
351 
358  public function testEscapeId( $input, $output ) {
359  $this->assertEquals(
360  $output,
361  Sanitizer::escapeId( $input, [ 'noninitial', 'legacy' ] )
362  );
363  }
364 
365  public static function provideEscapeId() {
366  return [
367  [ '+', '.2B' ],
368  [ '&', '.26' ],
369  [ '=', '.3D' ],
370  [ ':', ':' ],
371  [ ';', '.3B' ],
372  [ '@', '.40' ],
373  [ '$', '.24' ],
374  [ '-_.', '-_.' ],
375  [ '!', '.21' ],
376  [ '*', '.2A' ],
377  [ '/', '.2F' ],
378  [ '[]', '.5B.5D' ],
379  [ '<>', '.3C.3E' ],
380  [ '\'', '.27' ],
381  [ '§', '.C2.A7' ],
382  [ 'Test:A & B/Here', 'Test:A_.26_B.2FHere' ],
383  [ 'A&B&amp;C&amp;amp;D&amp;amp;amp;E', 'A.26B.26amp.3BC.26amp.3Bamp.3BD.26amp.3Bamp.3Bamp.3BE' ],
384  ];
385  }
386 
393  public function testEscapeIdReferenceList( $referenceList, $id1, $id2 ) {
394  $this->assertEquals(
395  Sanitizer::escapeIdReferenceList( $referenceList ),
397  . ' '
399  );
400  }
401 
402  public static function provideEscapeIdReferenceList() {
404  return [
405  [ 'foo bar', 'foo', 'bar' ],
406  [ '#1 #2', '#1', '#2' ],
407  [ '+1 +2', '+1', '+2' ],
408  ];
409  }
410 
415  public function testIsReservedDataAttribute( $attr, $expected ) {
416  $this->assertSame( $expected, Sanitizer::isReservedDataAttribute( $attr ) );
417  }
418 
419  public static function provideIsReservedDataAttribute() {
420  return [
421  [ 'foo', false ],
422  [ 'data', false ],
423  [ 'data-foo', false ],
424  [ 'data-mw', true ],
425  [ 'data-ooui', true ],
426  [ 'data-parsoid', true ],
427  [ 'data-mw-foo', true ],
428  [ 'data-ooui-foo', true ],
429  [ 'data-mwfoo', true ], // could be false but this is how it's implemented currently
430  ];
431  }
432 
447  public function testEscapeIdForStuff( $stuff, array $config, $id, $expected, $mode = null ) {
448  $func = "Sanitizer::escapeIdFor{$stuff}";
449  $iwFlavor = array_pop( $config );
450  $this->setMwGlobals( [
451  'wgFragmentMode' => $config,
452  'wgExternalInterwikiFragmentMode' => $iwFlavor,
453  ] );
454  $escaped = call_user_func( $func, $id, $mode );
455  self::assertEquals( $expected, $escaped );
456  }
457 
458  public function provideEscapeIdForStuff() {
459  // Test inputs and outputs
460  $text = 'foo тест_#%!\'()[]:<>&&amp;&amp;amp;';
461  $legacyEncoded = 'foo_.D1.82.D0.B5.D1.81.D1.82_.23.25.21.27.28.29.5B.5D:.3C.3E' .
462  '.26.26amp.3B.26amp.3Bamp.3B';
463  $html5Encoded = 'foo_тест_#%!\'()[]:<>&&amp;&amp;amp;';
464 
465  // Settings: last element is $wgExternalInterwikiFragmentMode, the rest is $wgFragmentMode
466  $legacy = [ 'legacy', 'legacy' ];
467  $legacyNew = [ 'legacy', 'html5', 'legacy' ];
468  $newLegacy = [ 'html5', 'legacy', 'legacy' ];
469  $new = [ 'html5', 'legacy' ];
470  $allNew = [ 'html5', 'html5' ];
471 
472  return [
473  // Pure legacy: how MW worked before 2017
474  [ 'Attribute', $legacy, $text, $legacyEncoded, Sanitizer::ID_PRIMARY ],
475  [ 'Attribute', $legacy, $text, false, Sanitizer::ID_FALLBACK ],
476  [ 'Link', $legacy, $text, $legacyEncoded ],
477  [ 'ExternalInterwiki', $legacy, $text, $legacyEncoded ],
478 
479  // Transition to a new world: legacy links with HTML5 fallback
480  [ 'Attribute', $legacyNew, $text, $legacyEncoded, Sanitizer::ID_PRIMARY ],
481  [ 'Attribute', $legacyNew, $text, $html5Encoded, Sanitizer::ID_FALLBACK ],
482  [ 'Link', $legacyNew, $text, $legacyEncoded ],
483  [ 'ExternalInterwiki', $legacyNew, $text, $legacyEncoded ],
484 
485  // New world: HTML5 links, legacy fallbacks
486  [ 'Attribute', $newLegacy, $text, $html5Encoded, Sanitizer::ID_PRIMARY ],
487  [ 'Attribute', $newLegacy, $text, $legacyEncoded, Sanitizer::ID_FALLBACK ],
488  [ 'Link', $newLegacy, $text, $html5Encoded ],
489  [ 'ExternalInterwiki', $newLegacy, $text, $legacyEncoded ],
490 
491  // Distant future: no legacy fallbacks, but still linking to leagacy wikis
492  [ 'Attribute', $new, $text, $html5Encoded, Sanitizer::ID_PRIMARY ],
493  [ 'Attribute', $new, $text, false, Sanitizer::ID_FALLBACK ],
494  [ 'Link', $new, $text, $html5Encoded ],
495  [ 'ExternalInterwiki', $new, $text, $legacyEncoded ],
496 
497  // Just before the heat death of universe: external interwikis are also HTML5 \m/
498  [ 'Attribute', $allNew, $text, $html5Encoded, Sanitizer::ID_PRIMARY ],
499  [ 'Attribute', $allNew, $text, false, Sanitizer::ID_FALLBACK ],
500  [ 'Link', $allNew, $text, $html5Encoded ],
501  [ 'ExternalInterwiki', $allNew, $text, $html5Encoded ],
502  ];
503  }
504 
514  public function testStripAllTags( $input, $expected ) {
515  $this->assertEquals( $expected, Sanitizer::stripAllTags( $input ) );
516  }
517 
518  public function provideStripAllTags() {
519  return [
520  [ '<p>Foo</p>', 'Foo' ],
521  [ '<p id="one">Foo</p><p id="two">Bar</p>', 'Foo Bar' ],
522  [ "<p>Foo</p>\n<p>Bar</p>", 'Foo Bar' ],
523  [ '<p>Hello &lt;strong&gt; wor&#x6c;&#100; caf&eacute;</p>', 'Hello <strong> world café' ],
524  [
525  '<p><small data-foo=\'bar"&lt;baz>quux\'><a href="./Foo">Bar</a></small> Whee!</p>',
526  'Bar Whee!'
527  ],
528  [ '1<span class="<?php">2</span>3', '123' ],
529  [ '1<span class="<?">2</span>3', '123' ],
530  [ '<th>1</th><td>2</td>', '1 2' ],
531  ];
532  }
533 
538  public function testInvalidFragmentThrows() {
539  $this->setMwGlobals( 'wgFragmentMode', [ 'boom!' ] );
540  Sanitizer::escapeIdForAttribute( 'This should throw' );
541  }
542 
548  $this->setMwGlobals( 'wgFragmentMode', [ 666 => 'html5' ] );
549  Sanitizer::escapeIdForAttribute( 'This should throw' );
550  }
551 
557  $this->setMwGlobals( 'wgFragmentMode', [ 666 => 'html5' ] );
558  Sanitizer::escapeIdForLink( 'This should throw' );
559  }
560 }
The wiki should then use memcached to cache various data To use multiple just add more items to the array To increase the weight of a make its entry a array("192.168.0.1:11211", 2))
testStripAllTags( $input, $expected)
provideStripAllTags
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses & $html
Definition: hooks.txt:1982
testInvalidEntities()
Sanitizer::decodeCharReferences.
static escapeId( $id, $options=[])
Given a value, escape it so that it can be used in an id attribute and return it. ...
Definition: Sanitizer.php:1253
static setInstance( $instance)
Set the driver to be used.
Definition: MWTidy.php:85
static provideEscapeId()
if(is_array( $mode)) switch( $mode) $input
processing should stop and the error should be shown to the user * false
Definition: hooks.txt:187
const ID_PRIMARY
Tells escapeUrlForHtml() to encode the ID using the wiki&#39;s primary encoding.
Definition: Sanitizer.php:66
testRemovehtmltagsOnHtml5Tags( $tag, $escaped)
Sanitizer::removeHTMLtags provideHtml5Tags.
testDecodeNumericEntities()
Sanitizer::decodeCharReferences.
static escapeIdReferenceList( $referenceString)
Given a string containing a space delimited list of ids, escape each id to match ids escaped by the e...
Definition: Sanitizer.php:1383
static isReservedDataAttribute( $attr)
Given an attribute name, checks whether it is a reserved data attribute (such as data-mw-foo) which i...
Definition: Sanitizer.php:908
static provideCssCommentsFixtures()
testNoPrimaryFragmentModeThrows()
UnexpectedValueException Sanitizer::escapeIdForAttribute()
testInvalidFragmentThrows()
InvalidArgumentException Sanitizer::escapeIdInternal()
static configuration should be added through ResourceLoaderGetConfigVars instead can be used to get the real title e g db for database replication lag or jobqueue for job queue size converted to pseudo seconds It is possible to add more fields and they will be returned to the user in the API response after the basic globals have been set but before ordinary actions take place $output
Definition: hooks.txt:2217
const ID_FALLBACK
Tells escapeUrlForHtml() to encode the ID using the fallback encoding, or return false if no fallback...
Definition: Sanitizer.php:74
static provideIsReservedDataAttribute()
testEscapeHtmlAllowEntities( $expected, $html)
provideEscapeHtmlAllowEntities Sanitizer::escapeHtmlAllowEntities
static provideHtml5Tags()
Provide HTML5 tags.
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return true
Definition: hooks.txt:1982
static destroySingleton()
Destroy the current singleton instance.
Definition: MWTidy.php:93
testInvalidNumberedEntities()
Sanitizer::decodeCharReferences.
static stripAllTags( $html)
Take a fragment of (potentially invalid) HTML and return a version with any tags removed, encoded as plain text.
Definition: Sanitizer.php:1992
testDeprecatedAttributesUnaltered( $inputAttr, $inputEl, $message='')
provideDeprecatedAttributes Sanitizer::fixTagAttributes
$css
testDecodeNamedEntities()
Sanitizer::decodeCharReferences.
testEscapeIdReferenceList( $referenceList, $id1, $id2)
Test escapeIdReferenceList for consistency with escapeIdForAttribute.
static escapeIdForAttribute( $id, $mode=self::ID_PRIMARY)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid HTM...
Definition: Sanitizer.php:1287
testIsReservedDataAttribute( $attr, $expected)
provideIsReservedDataAttribute Sanitizer::isReservedDataAttribute
this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that When $user is not null
Definition: hooks.txt:780
static provideDeprecatedAttributes()
static decodeTagAttributes( $text)
Return an associative array of attribute names and values from a partial tag string.
Definition: Sanitizer.php:1442
setMwGlobals( $pairs, $value=null)
Sets a global, maintaining a stashed version of the previous global to be restored in tearDown...
hideDeprecated( $function)
Don&#39;t throw a warning if $function is deprecated and called later.
testDecodeTagAttributes( $expected, $attributes, $message='')
provideTagAttributesToDecode Sanitizer::decodeTagAttributes
testDecodeMixedEntities()
Sanitizer::decodeCharReferences.
testCssCommentsChecking( $expected, $css, $message='')
provideCssCommentsFixtures Sanitizer::checkCss
testDecodeMixedComplexEntities()
Sanitizer::decodeCharReferences.
testEscapeIdForStuff( $stuff, array $config, $id, $expected, $mode=null)
provideEscapeIdForStuff
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency which acts as the top level factory for services in MediaWiki which can be used to gain access to default instances of various services MediaWikiServices however also allows new services to be defined and default services to be redefined Services are defined or redefined by providing a callback the instantiator that will return a new instance of the service When it will create an instance of MediaWikiServices and populate it with the services defined in the files listed by thereby bootstrapping the DI framework Per $wgServiceWiringFiles lists includes ServiceWiring php
Definition: injection.txt:35
static escapeIdForLink( $id)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid URL...
Definition: Sanitizer.php:1314
static decodeCharReferences( $text)
Decode any character references, numeric or named entities, in the text and return a UTF-8 string...
Definition: Sanitizer.php:1661
static provideEscapeIdReferenceList()
testNoPrimaryFragmentModeThrows2()
UnexpectedValueException Sanitizer::escapeIdForLink()
static checkCss( $value)
Pick apart some CSS and check it for forbidden or unsafe structures.
Definition: Sanitizer.php:1058
static fixTagAttributes( $text, $element, $sorted=false)
Take a tag soup fragment listing an HTML element&#39;s attributes and normalize it to well-formed XML...
Definition: Sanitizer.php:1128
static escapeHtmlAllowEntities( $html)
Given HTML input, escape with htmlspecialchars but un-escape entities.
Definition: Sanitizer.php:1425
static removeHTMLtags( $text, $processCallback=null, $args=[], $extratags=[], $removetags=[], $warnCallback=null)
Cleans up HTML, removes dangerous tags and attributes, and removes HTML comments. ...
Definition: Sanitizer.php:497
static provideEscapeHtmlAllowEntities()
static provideTagAttributesToDecode()
testInvalidAmpersand()
Sanitizer::decodeCharReferences.
testEscapeId( $input, $output)
Test Sanitizer::escapeId.
testRemoveHTMLtags( $input, $output, $msg=null)
dataRemoveHTMLtags Sanitizer::removeHTMLtags