MediaWiki  master
Sanitizer.php
Go to the documentation of this file.
1 <?php
31 class Sanitizer {
37  '/&([A-Za-z0-9\x80-\xff]+);
38  |&\#([0-9]+);
39  |&\#[xX]([0-9A-Fa-f]+);
40  |(&)/x';
41 
46  const ELEMENT_BITS_REGEX = '!^(/?)([A-Za-z][^\t\n\v />\0]*+)([^>]*?)(/?>)([^<]*)$!';
47 
56  const EVIL_URI_PATTERN = '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i';
57  const XMLNS_ATTRIBUTE_PATTERN = "/^xmlns:[:A-Z_a-z-.0-9]+$/";
58 
64  private static $htmlEntities = [
65  'Aacute' => 193,
66  'aacute' => 225,
67  'Acirc' => 194,
68  'acirc' => 226,
69  'acute' => 180,
70  'AElig' => 198,
71  'aelig' => 230,
72  'Agrave' => 192,
73  'agrave' => 224,
74  'alefsym' => 8501,
75  'Alpha' => 913,
76  'alpha' => 945,
77  'amp' => 38,
78  'and' => 8743,
79  'ang' => 8736,
80  'apos' => 39, // New in XHTML & HTML 5; avoid in output for compatibility with IE.
81  'Aring' => 197,
82  'aring' => 229,
83  'asymp' => 8776,
84  'Atilde' => 195,
85  'atilde' => 227,
86  'Auml' => 196,
87  'auml' => 228,
88  'bdquo' => 8222,
89  'Beta' => 914,
90  'beta' => 946,
91  'brvbar' => 166,
92  'bull' => 8226,
93  'cap' => 8745,
94  'Ccedil' => 199,
95  'ccedil' => 231,
96  'cedil' => 184,
97  'cent' => 162,
98  'Chi' => 935,
99  'chi' => 967,
100  'circ' => 710,
101  'clubs' => 9827,
102  'cong' => 8773,
103  'copy' => 169,
104  'crarr' => 8629,
105  'cup' => 8746,
106  'curren' => 164,
107  'dagger' => 8224,
108  'Dagger' => 8225,
109  'darr' => 8595,
110  'dArr' => 8659,
111  'deg' => 176,
112  'Delta' => 916,
113  'delta' => 948,
114  'diams' => 9830,
115  'divide' => 247,
116  'Eacute' => 201,
117  'eacute' => 233,
118  'Ecirc' => 202,
119  'ecirc' => 234,
120  'Egrave' => 200,
121  'egrave' => 232,
122  'empty' => 8709,
123  'emsp' => 8195,
124  'ensp' => 8194,
125  'Epsilon' => 917,
126  'epsilon' => 949,
127  'equiv' => 8801,
128  'Eta' => 919,
129  'eta' => 951,
130  'ETH' => 208,
131  'eth' => 240,
132  'Euml' => 203,
133  'euml' => 235,
134  'euro' => 8364,
135  'exist' => 8707,
136  'fnof' => 402,
137  'forall' => 8704,
138  'frac12' => 189,
139  'frac14' => 188,
140  'frac34' => 190,
141  'frasl' => 8260,
142  'Gamma' => 915,
143  'gamma' => 947,
144  'ge' => 8805,
145  'gt' => 62,
146  'harr' => 8596,
147  'hArr' => 8660,
148  'hearts' => 9829,
149  'hellip' => 8230,
150  'Iacute' => 205,
151  'iacute' => 237,
152  'Icirc' => 206,
153  'icirc' => 238,
154  'iexcl' => 161,
155  'Igrave' => 204,
156  'igrave' => 236,
157  'image' => 8465,
158  'infin' => 8734,
159  'int' => 8747,
160  'Iota' => 921,
161  'iota' => 953,
162  'iquest' => 191,
163  'isin' => 8712,
164  'Iuml' => 207,
165  'iuml' => 239,
166  'Kappa' => 922,
167  'kappa' => 954,
168  'Lambda' => 923,
169  'lambda' => 955,
170  'lang' => 9001,
171  'laquo' => 171,
172  'larr' => 8592,
173  'lArr' => 8656,
174  'lceil' => 8968,
175  'ldquo' => 8220,
176  'le' => 8804,
177  'lfloor' => 8970,
178  'lowast' => 8727,
179  'loz' => 9674,
180  'lrm' => 8206,
181  'lsaquo' => 8249,
182  'lsquo' => 8216,
183  'lt' => 60,
184  'macr' => 175,
185  'mdash' => 8212,
186  'micro' => 181,
187  'middot' => 183,
188  'minus' => 8722,
189  'Mu' => 924,
190  'mu' => 956,
191  'nabla' => 8711,
192  'nbsp' => 160,
193  'ndash' => 8211,
194  'ne' => 8800,
195  'ni' => 8715,
196  'not' => 172,
197  'notin' => 8713,
198  'nsub' => 8836,
199  'Ntilde' => 209,
200  'ntilde' => 241,
201  'Nu' => 925,
202  'nu' => 957,
203  'Oacute' => 211,
204  'oacute' => 243,
205  'Ocirc' => 212,
206  'ocirc' => 244,
207  'OElig' => 338,
208  'oelig' => 339,
209  'Ograve' => 210,
210  'ograve' => 242,
211  'oline' => 8254,
212  'Omega' => 937,
213  'omega' => 969,
214  'Omicron' => 927,
215  'omicron' => 959,
216  'oplus' => 8853,
217  'or' => 8744,
218  'ordf' => 170,
219  'ordm' => 186,
220  'Oslash' => 216,
221  'oslash' => 248,
222  'Otilde' => 213,
223  'otilde' => 245,
224  'otimes' => 8855,
225  'Ouml' => 214,
226  'ouml' => 246,
227  'para' => 182,
228  'part' => 8706,
229  'permil' => 8240,
230  'perp' => 8869,
231  'Phi' => 934,
232  'phi' => 966,
233  'Pi' => 928,
234  'pi' => 960,
235  'piv' => 982,
236  'plusmn' => 177,
237  'pound' => 163,
238  'prime' => 8242,
239  'Prime' => 8243,
240  'prod' => 8719,
241  'prop' => 8733,
242  'Psi' => 936,
243  'psi' => 968,
244  'quot' => 34,
245  'radic' => 8730,
246  'rang' => 9002,
247  'raquo' => 187,
248  'rarr' => 8594,
249  'rArr' => 8658,
250  'rceil' => 8969,
251  'rdquo' => 8221,
252  'real' => 8476,
253  'reg' => 174,
254  'rfloor' => 8971,
255  'Rho' => 929,
256  'rho' => 961,
257  'rlm' => 8207,
258  'rsaquo' => 8250,
259  'rsquo' => 8217,
260  'sbquo' => 8218,
261  'Scaron' => 352,
262  'scaron' => 353,
263  'sdot' => 8901,
264  'sect' => 167,
265  'shy' => 173,
266  'Sigma' => 931,
267  'sigma' => 963,
268  'sigmaf' => 962,
269  'sim' => 8764,
270  'spades' => 9824,
271  'sub' => 8834,
272  'sube' => 8838,
273  'sum' => 8721,
274  'sup' => 8835,
275  'sup1' => 185,
276  'sup2' => 178,
277  'sup3' => 179,
278  'supe' => 8839,
279  'szlig' => 223,
280  'Tau' => 932,
281  'tau' => 964,
282  'there4' => 8756,
283  'Theta' => 920,
284  'theta' => 952,
285  'thetasym' => 977,
286  'thinsp' => 8201,
287  'THORN' => 222,
288  'thorn' => 254,
289  'tilde' => 732,
290  'times' => 215,
291  'trade' => 8482,
292  'Uacute' => 218,
293  'uacute' => 250,
294  'uarr' => 8593,
295  'uArr' => 8657,
296  'Ucirc' => 219,
297  'ucirc' => 251,
298  'Ugrave' => 217,
299  'ugrave' => 249,
300  'uml' => 168,
301  'upsih' => 978,
302  'Upsilon' => 933,
303  'upsilon' => 965,
304  'Uuml' => 220,
305  'uuml' => 252,
306  'weierp' => 8472,
307  'Xi' => 926,
308  'xi' => 958,
309  'Yacute' => 221,
310  'yacute' => 253,
311  'yen' => 165,
312  'Yuml' => 376,
313  'yuml' => 255,
314  'Zeta' => 918,
315  'zeta' => 950,
316  'zwj' => 8205,
317  'zwnj' => 8204
318  ];
319 
323  private static $htmlEntityAliases = [
324  'רלמ' => 'rlm',
325  'رلم' => 'rlm',
326  ];
327 
331  private static $attribsRegex;
332 
340  static function getAttribsRegex() {
341  if ( self::$attribsRegex === null ) {
342  $attribFirst = '[:A-Z_a-z0-9]';
343  $attrib = '[:A-Z_a-z-.0-9]';
344  $space = '[\x09\x0a\x0c\x0d\x20]';
345  self::$attribsRegex =
346  "/(?:^|$space)({$attribFirst}{$attrib}*)
347  ($space*=$space*
348  (?:
349  # The attribute value: quoted or alone
350  \"([^\"]*)(?:\"|\$)
351  | '([^']*)(?:'|\$)
352  | (((?!$space|>).)*)
353  )
354  )?(?=$space|\$)/sx";
355  }
356  return self::$attribsRegex;
357  }
358 
365  public static function getRecognizedTagData( $extratags = [], $removetags = [] ) {
366  global $wgAllowImageTag;
367 
368  static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
369  $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
370 
371  // Base our staticInitialised variable off of the global config state so that if the globals
372  // are changed (like in the screwed up test system) we will re-initialise the settings.
373  $globalContext = $wgAllowImageTag;
374  if ( !$staticInitialised || $staticInitialised != $globalContext ) {
375  $htmlpairsStatic = [ # Tags that must be closed
376  'b', 'bdi', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
377  'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
378  'strike', 'strong', 'tt', 'var', 'div', 'center',
379  'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
380  'ruby', 'rb', 'rp', 'rt', 'rtc', 'p', 'span', 'abbr', 'dfn',
381  'kbd', 'samp', 'data', 'time', 'mark'
382  ];
383  $htmlsingle = [
384  'br', 'wbr', 'hr', 'li', 'dt', 'dd', 'meta', 'link'
385  ];
386 
387  # Elements that cannot have close tags. This is (not coincidentally)
388  # also the list of tags for which the HTML 5 parsing algorithm
389  # requires you to "acknowledge the token's self-closing flag", i.e.
390  # a self-closing tag like <br/> is not an HTML 5 parse error only
391  # for this list.
392  $htmlsingleonly = [
393  'br', 'wbr', 'hr', 'meta', 'link'
394  ];
395 
396  $htmlnest = [ # Tags that can be nested--??
397  'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
398  'li', 'dl', 'dt', 'dd', 'font', 'big', 'small', 'sub', 'sup', 'span',
399  'var', 'kbd', 'samp', 'em', 'strong', 'q', 'ruby', 'bdo'
400  ];
401  $tabletags = [ # Can only appear inside table, we will close them
402  'td', 'th', 'tr',
403  ];
404  $htmllist = [ # Tags used by list
405  'ul', 'ol',
406  ];
407  $listtags = [ # Tags that can appear in a list
408  'li',
409  ];
410 
411  if ( $wgAllowImageTag ) {
412  $htmlsingle[] = 'img';
413  $htmlsingleonly[] = 'img';
414  }
415 
416  $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
417  $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
418 
419  # Convert them all to hashtables for faster lookup
420  $vars = [ 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
421  'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' ];
422  foreach ( $vars as $var ) {
423  $$var = array_flip( $$var );
424  }
425  $staticInitialised = $globalContext;
426  }
427 
428  # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
429  $extratags = array_flip( $extratags );
430  $removetags = array_flip( $removetags );
431  $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
432  $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ), $removetags );
433 
434  return [
435  'htmlpairs' => $htmlpairs,
436  'htmlsingle' => $htmlsingle,
437  'htmlsingleonly' => $htmlsingleonly,
438  'htmlnest' => $htmlnest,
439  'tabletags' => $tabletags,
440  'htmllist' => $htmllist,
441  'listtags' => $listtags,
442  'htmlsingleallowed' => $htmlsingleallowed,
443  'htmlelements' => $htmlelements,
444  ];
445  }
446 
462  public static function removeHTMLtags( $text, $processCallback = null,
463  $args = [], $extratags = [], $removetags = [], $warnCallback = null
464  ) {
465  extract( self::getRecognizedTagData( $extratags, $removetags ) );
466 
467  # Remove HTML comments
468  $text = Sanitizer::removeHTMLcomments( $text );
469  $bits = explode( '<', $text );
470  $text = str_replace( '>', '&gt;', array_shift( $bits ) );
471  if ( !MWTidy::isEnabled() ) {
472  $tagstack = $tablestack = [];
473  foreach ( $bits as $x ) {
474  $regs = [];
475  # $slash: Does the current element start with a '/'?
476  # $t: Current element name
477  # $params: String between element name and >
478  # $brace: Ending '>' or '/>'
479  # $rest: Everything until the next element of $bits
480  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
481  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
482  } else {
483  $slash = $t = $params = $brace = $rest = null;
484  }
485 
486  $badtag = false;
487  $t = strtolower( $t );
488  if ( isset( $htmlelements[$t] ) ) {
489  # Check our stack
490  if ( $slash && isset( $htmlsingleonly[$t] ) ) {
491  $badtag = true;
492  } elseif ( $slash ) {
493  # Closing a tag... is it the one we just opened?
494  MediaWiki\suppressWarnings();
495  $ot = array_pop( $tagstack );
496  MediaWiki\restoreWarnings();
497 
498  if ( $ot != $t ) {
499  if ( isset( $htmlsingleallowed[$ot] ) ) {
500  # Pop all elements with an optional close tag
501  # and see if we find a match below them
502  $optstack = [];
503  array_push( $optstack, $ot );
504  MediaWiki\suppressWarnings();
505  $ot = array_pop( $tagstack );
506  MediaWiki\restoreWarnings();
507  while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
508  array_push( $optstack, $ot );
509  MediaWiki\suppressWarnings();
510  $ot = array_pop( $tagstack );
511  MediaWiki\restoreWarnings();
512  }
513  if ( $t != $ot ) {
514  # No match. Push the optional elements back again
515  $badtag = true;
516  MediaWiki\suppressWarnings();
517  $ot = array_pop( $optstack );
518  MediaWiki\restoreWarnings();
519  while ( $ot ) {
520  array_push( $tagstack, $ot );
521  MediaWiki\suppressWarnings();
522  $ot = array_pop( $optstack );
523  MediaWiki\restoreWarnings();
524  }
525  }
526  } else {
527  MediaWiki\suppressWarnings();
528  array_push( $tagstack, $ot );
529  MediaWiki\restoreWarnings();
530 
531  # <li> can be nested in <ul> or <ol>, skip those cases:
532  if ( !isset( $htmllist[$ot] ) || !isset( $listtags[$t] ) ) {
533  $badtag = true;
534  }
535  }
536  } else {
537  if ( $t == 'table' ) {
538  $tagstack = array_pop( $tablestack );
539  }
540  }
541  $newparams = '';
542  } else {
543  # Keep track for later
544  if ( isset( $tabletags[$t] ) && !in_array( 'table', $tagstack ) ) {
545  $badtag = true;
546  } elseif ( in_array( $t, $tagstack ) && !isset( $htmlnest[$t] ) ) {
547  $badtag = true;
548  #  Is it a self closed htmlpair ? (bug 5487)
549  } elseif ( $brace == '/>' && isset( $htmlpairs[$t] ) ) {
550  // Eventually we'll just remove the self-closing
551  // slash, in order to be consistent with HTML5
552  // semantics.
553  // $brace = '>';
554  // For now, let's just warn authors to clean up.
555  if ( is_callable( $warnCallback ) ) {
556  call_user_func_array( $warnCallback, [ 'deprecated-self-close-category' ] );
557  }
558  $badtag = true;
559  } elseif ( isset( $htmlsingleonly[$t] ) ) {
560  # Hack to force empty tag for unclosable elements
561  $brace = '/>';
562  } elseif ( isset( $htmlsingle[$t] ) ) {
563  # Hack to not close $htmlsingle tags
564  $brace = null;
565  # Still need to push this optionally-closed tag to
566  # the tag stack so that we can match end tags
567  # instead of marking them as bad.
568  array_push( $tagstack, $t );
569  } elseif ( isset( $tabletags[$t] ) && in_array( $t, $tagstack ) ) {
570  // New table tag but forgot to close the previous one
571  $text .= "</$t>";
572  } else {
573  if ( $t == 'table' ) {
574  array_push( $tablestack, $tagstack );
575  $tagstack = [];
576  }
577  array_push( $tagstack, $t );
578  }
579 
580  # Replace any variables or template parameters with
581  # plaintext results.
582  if ( is_callable( $processCallback ) ) {
583  call_user_func_array( $processCallback, [ &$params, $args ] );
584  }
585 
586  if ( !Sanitizer::validateTag( $params, $t ) ) {
587  $badtag = true;
588  }
589 
590  # Strip non-approved attributes from the tag
591  $newparams = Sanitizer::fixTagAttributes( $params, $t );
592  }
593  if ( !$badtag ) {
594  $rest = str_replace( '>', '&gt;', $rest );
595  $close = ( $brace == '/>' && !$slash ) ? ' /' : '';
596  $text .= "<$slash$t$newparams$close>$rest";
597  continue;
598  }
599  }
600  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
601  }
602  # Close off any remaining tags
603  while ( is_array( $tagstack ) && ( $t = array_pop( $tagstack ) ) ) {
604  $text .= "</$t>\n";
605  if ( $t == 'table' ) {
606  $tagstack = array_pop( $tablestack );
607  }
608  }
609  } else {
610  # this might be possible using tidy itself
611  foreach ( $bits as $x ) {
612  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
613  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
614 
615  $badtag = false;
616  $t = strtolower( $t );
617  if ( isset( $htmlelements[$t] ) ) {
618  if ( is_callable( $processCallback ) ) {
619  call_user_func_array( $processCallback, [ &$params, $args ] );
620  }
621 
622  if ( $brace == '/>' && !( isset( $htmlsingle[$t] ) || isset( $htmlsingleonly[$t] ) ) ) {
623  // Eventually we'll just remove the self-closing
624  // slash, in order to be consistent with HTML5
625  // semantics.
626  // $brace = '>';
627  // For now, let's just warn authors to clean up.
628  if ( is_callable( $warnCallback ) ) {
629  call_user_func_array( $warnCallback, [ 'deprecated-self-close-category' ] );
630  }
631  }
632  if ( !Sanitizer::validateTag( $params, $t ) ) {
633  $badtag = true;
634  }
635 
636  $newparams = Sanitizer::fixTagAttributes( $params, $t );
637  if ( !$badtag ) {
638  if ( $brace === '/>' && !isset( $htmlsingleonly[$t] ) ) {
639  # Interpret self-closing tags as empty tags even when
640  # HTML 5 would interpret them as start tags. Such input
641  # is commonly seen on Wikimedia wikis with this intention.
642  $brace = "></$t>";
643  }
644 
645  $rest = str_replace( '>', '&gt;', $rest );
646  $text .= "<$slash$t$newparams$brace$rest";
647  continue;
648  }
649  }
650  }
651  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
652  }
653  }
654  return $text;
655  }
656 
666  public static function removeHTMLcomments( $text ) {
667  while ( ( $start = strpos( $text, '<!--' ) ) !== false ) {
668  $end = strpos( $text, '-->', $start + 4 );
669  if ( $end === false ) {
670  # Unterminated comment; bail out
671  break;
672  }
673 
674  $end += 3;
675 
676  # Trim space and newline if the comment is both
677  # preceded and followed by a newline
678  $spaceStart = max( $start - 1, 0 );
679  $spaceLen = $end - $spaceStart;
680  while ( substr( $text, $spaceStart, 1 ) === ' ' && $spaceStart > 0 ) {
681  $spaceStart--;
682  $spaceLen++;
683  }
684  while ( substr( $text, $spaceStart + $spaceLen, 1 ) === ' ' ) {
685  $spaceLen++;
686  }
687  if ( substr( $text, $spaceStart, 1 ) === "\n"
688  && substr( $text, $spaceStart + $spaceLen, 1 ) === "\n" ) {
689  # Remove the comment, leading and trailing
690  # spaces, and leave only one newline.
691  $text = substr_replace( $text, "\n", $spaceStart, $spaceLen + 1 );
692  } else {
693  # Remove just the comment.
694  $text = substr_replace( $text, '', $start, $end - $start );
695  }
696  }
697  return $text;
698  }
699 
712  static function validateTag( $params, $element ) {
714 
715  if ( $element == 'meta' || $element == 'link' ) {
716  if ( !isset( $params['itemprop'] ) ) {
717  // <meta> and <link> must have an itemprop="" otherwise they are not valid or safe in content
718  return false;
719  }
720  if ( $element == 'meta' && !isset( $params['content'] ) ) {
721  // <meta> must have a content="" for the itemprop
722  return false;
723  }
724  if ( $element == 'link' && !isset( $params['href'] ) ) {
725  // <link> must have an associated href=""
726  return false;
727  }
728  }
729 
730  return true;
731  }
732 
748  static function validateTagAttributes( $attribs, $element ) {
750  Sanitizer::attributeWhitelist( $element ) );
751  }
752 
768  static function validateAttributes( $attribs, $whitelist ) {
769  $whitelist = array_flip( $whitelist );
770  $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
771 
772  $out = [];
773  foreach ( $attribs as $attribute => $value ) {
774  # Allow XML namespace declaration to allow RDFa
775  if ( preg_match( self::XMLNS_ATTRIBUTE_PATTERN, $attribute ) ) {
776  if ( !preg_match( self::EVIL_URI_PATTERN, $value ) ) {
777  $out[$attribute] = $value;
778  }
779 
780  continue;
781  }
782 
783  # Allow any attribute beginning with "data-"
784  # However:
785  # * data-ooui is reserved for ooui
786  # * data-mw and data-parsoid are reserved for parsoid
787  # * data-mw-<name here> is reserved for extensions (or core) if
788  # they need to communicate some data to the client and want to be
789  # sure that it isn't coming from an untrusted user.
790  # * Ensure that the attribute is not namespaced by banning
791  # colons.
792  if ( !preg_match( '/^data-(?!ooui|mw|parsoid)[^:]*$/i', $attribute )
793  && !isset( $whitelist[$attribute] )
794  ) {
795  continue;
796  }
797 
798  # Strip javascript "expression" from stylesheets.
799  # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
800  if ( $attribute == 'style' ) {
802  }
803 
804  # Escape HTML id attributes
805  if ( $attribute === 'id' ) {
806  $value = Sanitizer::escapeId( $value, 'noninitial' );
807  }
808 
809  # Escape HTML id reference lists
810  if ( $attribute === 'aria-describedby'
811  || $attribute === 'aria-flowto'
812  || $attribute === 'aria-labelledby'
813  || $attribute === 'aria-owns'
814  ) {
816  }
817 
818  // RDFa and microdata properties allow URLs, URIs and/or CURIs.
819  // Check them for sanity.
820  if ( $attribute === 'rel' || $attribute === 'rev'
821  # RDFa
822  || $attribute === 'about' || $attribute === 'property'
823  || $attribute === 'resource' || $attribute === 'datatype'
824  || $attribute === 'typeof'
825  # HTML5 microdata
826  || $attribute === 'itemid' || $attribute === 'itemprop'
827  || $attribute === 'itemref' || $attribute === 'itemscope'
828  || $attribute === 'itemtype'
829  ) {
830  // Paranoia. Allow "simple" values but suppress javascript
831  if ( preg_match( self::EVIL_URI_PATTERN, $value ) ) {
832  continue;
833  }
834  }
835 
836  # NOTE: even though elements using href/src are not allowed directly, supply
837  # validation code that can be used by tag hook handlers, etc
838  if ( $attribute === 'href' || $attribute === 'src' ) {
839  if ( !preg_match( $hrefExp, $value ) ) {
840  continue; // drop any href or src attributes not using an allowed protocol.
841  // NOTE: this also drops all relative URLs
842  }
843  }
844 
845  // If this attribute was previously set, override it.
846  // Output should only have one attribute of each name.
847  $out[$attribute] = $value;
848  }
849 
850  # itemtype, itemid, itemref don't make sense without itemscope
851  if ( !array_key_exists( 'itemscope', $out ) ) {
852  unset( $out['itemtype'] );
853  unset( $out['itemid'] );
854  unset( $out['itemref'] );
855  }
856  # TODO: Strip itemprop if we aren't descendants of an itemscope or pointed to by an itemref.
857 
858  return $out;
859  }
860 
871  static function mergeAttributes( $a, $b ) {
872  $out = array_merge( $a, $b );
873  if ( isset( $a['class'] ) && isset( $b['class'] )
874  && is_string( $a['class'] ) && is_string( $b['class'] )
875  && $a['class'] !== $b['class']
876  ) {
877  $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
878  -1, PREG_SPLIT_NO_EMPTY );
879  $out['class'] = implode( ' ', array_unique( $classes ) );
880  }
881  return $out;
882  }
883 
893  public static function normalizeCss( $value ) {
894 
895  // Decode character references like &#123;
897 
898  // Decode escape sequences and line continuation
899  // See the grammar in the CSS 2 spec, appendix D.
900  // This has to be done AFTER decoding character references.
901  // This means it isn't possible for this function to return
902  // unsanitized escape sequences. It is possible to manufacture
903  // input that contains character references that decode to
904  // escape sequences that decode to character references, but
905  // it's OK for the return value to contain character references
906  // because the caller is supposed to escape those anyway.
907  static $decodeRegex;
908  if ( !$decodeRegex ) {
909  $space = '[\\x20\\t\\r\\n\\f]';
910  $nl = '(?:\\n|\\r\\n|\\r|\\f)';
911  $backslash = '\\\\';
912  $decodeRegex = "/ $backslash
913  (?:
914  ($nl) | # 1. Line continuation
915  ([0-9A-Fa-f]{1,6})$space? | # 2. character number
916  (.) | # 3. backslash cancelling special meaning
917  () | # 4. backslash at end of string
918  )/xu";
919  }
920  $value = preg_replace_callback( $decodeRegex,
921  [ __CLASS__, 'cssDecodeCallback' ], $value );
922 
923  // Normalize Halfwidth and Fullwidth Unicode block that IE6 might treat as ascii
924  $value = preg_replace_callback(
925  '/[!-[]-z]/u', // U+FF01 to U+FF5A, excluding U+FF3C (bug 58088)
926  function ( $matches ) {
928  if ( $cp === false ) {
929  return '';
930  }
931  return chr( $cp - 65248 ); // ASCII range \x21-\x7A
932  },
933  $value
934  );
935 
936  // Convert more characters IE6 might treat as ascii
937  // U+0280, U+0274, U+207F, U+029F, U+026A, U+207D, U+208D
938  $value = str_replace(
939  [ 'ʀ', 'ɴ', 'ⁿ', 'ʟ', 'ɪ', '⁽', '₍' ],
940  [ 'r', 'n', 'n', 'l', 'i', '(', '(' ],
941  $value
942  );
943 
944  // Let the value through if it's nothing but a single comment, to
945  // allow other functions which may reject it to pass some error
946  // message through.
947  if ( !preg_match( '! ^ \s* /\* [^*\\/]* \*/ \s* $ !x', $value ) ) {
948  // Remove any comments; IE gets token splitting wrong
949  // This must be done AFTER decoding character references and
950  // escape sequences, because those steps can introduce comments
951  // This step cannot introduce character references or escape
952  // sequences, because it replaces comments with spaces rather
953  // than removing them completely.
954  $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value );
955 
956  // Remove anything after a comment-start token, to guard against
957  // incorrect client implementations.
958  $commentPos = strpos( $value, '/*' );
959  if ( $commentPos !== false ) {
960  $value = substr( $value, 0, $commentPos );
961  }
962  }
963 
964  // S followed by repeat, iteration, or prolonged sound marks,
965  // which IE will treat as "ss"
966  $value = preg_replace(
967  '/s(?:
968  \xE3\x80\xB1 | # U+3031
969  \xE3\x82\x9D | # U+309D
970  \xE3\x83\xBC | # U+30FC
971  \xE3\x83\xBD | # U+30FD
972  \xEF\xB9\xBC | # U+FE7C
973  \xEF\xB9\xBD | # U+FE7D
974  \xEF\xBD\xB0 # U+FF70
975  )/ix',
976  'ss',
977  $value
978  );
979 
980  return $value;
981  }
982 
1001  static function checkCss( $value ) {
1002  $value = self::normalizeCss( $value );
1003 
1004  // Reject problematic keywords and control characters
1005  if ( preg_match( '/[\000-\010\013\016-\037\177]/', $value ) ||
1006  strpos( $value, UtfNormal\Constants::UTF8_REPLACEMENT ) !== false ) {
1007  return '/* invalid control char */';
1008  } elseif ( preg_match(
1009  '! expression
1010  | filter\s*:
1011  | accelerator\s*:
1012  | -o-link\s*:
1013  | -o-link-source\s*:
1014  | -o-replace\s*:
1015  | url\s*\(
1016  | image\s*\(
1017  | image-set\s*\(
1018  | attr\s*\([^)]+[\s,]+url
1019  !ix', $value ) ) {
1020  return '/* insecure input */';
1021  }
1022  return $value;
1023  }
1024 
1029  static function cssDecodeCallback( $matches ) {
1030  if ( $matches[1] !== '' ) {
1031  // Line continuation
1032  return '';
1033  } elseif ( $matches[2] !== '' ) {
1034  $char = UtfNormal\Utils::codepointToUtf8( hexdec( $matches[2] ) );
1035  } elseif ( $matches[3] !== '' ) {
1036  $char = $matches[3];
1037  } else {
1038  $char = '\\';
1039  }
1040  if ( $char == "\n" || $char == '"' || $char == "'" || $char == '\\' ) {
1041  // These characters need to be escaped in strings
1042  // Clean up the escape sequence to avoid parsing errors by clients
1043  return '\\' . dechex( ord( $char ) ) . ' ';
1044  } else {
1045  // Decode unnecessary escape
1046  return $char;
1047  }
1048  }
1049 
1071  static function fixTagAttributes( $text, $element, $sorted = false ) {
1072  if ( trim( $text ) == '' ) {
1073  return '';
1074  }
1075 
1076  $decoded = Sanitizer::decodeTagAttributes( $text );
1077  $stripped = Sanitizer::validateTagAttributes( $decoded, $element );
1078 
1079  if ( $sorted ) {
1080  ksort( $stripped );
1081  }
1082 
1083  return Sanitizer::safeEncodeTagAttributes( $stripped );
1084  }
1085 
1091  static function encodeAttribute( $text ) {
1092  $encValue = htmlspecialchars( $text, ENT_QUOTES );
1093 
1094  // Whitespace is normalized during attribute decoding,
1095  // so if we've been passed non-spaces we must encode them
1096  // ahead of time or they won't be preserved.
1097  $encValue = strtr( $encValue, [
1098  "\n" => '&#10;',
1099  "\r" => '&#13;',
1100  "\t" => '&#9;',
1101  ] );
1102 
1103  return $encValue;
1104  }
1105 
1112  static function safeEncodeAttribute( $text ) {
1113  $encValue = Sanitizer::encodeAttribute( $text );
1114 
1115  # Templates and links may be expanded in later parsing,
1116  # creating invalid or dangerous output. Suppress this.
1117  $encValue = strtr( $encValue, [
1118  '<' => '&lt;', // This should never happen,
1119  '>' => '&gt;', // we've received invalid input
1120  '"' => '&quot;', // which should have been escaped.
1121  '{' => '&#123;',
1122  '[' => '&#91;',
1123  "''" => '&#39;&#39;',
1124  'ISBN' => '&#73;SBN',
1125  'RFC' => '&#82;FC',
1126  'PMID' => '&#80;MID',
1127  '|' => '&#124;',
1128  '__' => '&#95;_',
1129  ] );
1130 
1131  # Stupid hack
1132  $encValue = preg_replace_callback(
1133  '/((?i)' . wfUrlProtocols() . ')/',
1134  [ 'Sanitizer', 'armorLinksCallback' ],
1135  $encValue );
1136  return $encValue;
1137  }
1138 
1170  static function escapeId( $id, $options = [] ) {
1172  $options = (array)$options;
1173 
1174  $id = Sanitizer::decodeCharReferences( $id );
1175 
1176  if ( $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) {
1177  $id = preg_replace( '/[ \t\n\r\f_\'"&#%]+/', '_', $id );
1178  $id = trim( $id, '_' );
1179  if ( $id === '' ) {
1180  // Must have been all whitespace to start with.
1181  return '_';
1182  } else {
1183  return $id;
1184  }
1185  }
1186 
1187  // HTML4-style escaping
1188  static $replace = [
1189  '%3A' => ':',
1190  '%' => '.'
1191  ];
1192 
1193  $id = urlencode( strtr( $id, ' ', '_' ) );
1194  $id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
1195 
1196  if ( !preg_match( '/^[a-zA-Z]/', $id ) && !in_array( 'noninitial', $options ) ) {
1197  // Initial character must be a letter!
1198  $id = "x$id";
1199  }
1200  return $id;
1201  }
1202 
1220  static function escapeIdReferenceList( $referenceString, $options = [] ) {
1221  # Explode the space delimited list string into an array of tokens
1222  $references = preg_split( '/\s+/', "{$referenceString}", -1, PREG_SPLIT_NO_EMPTY );
1223 
1224  # Escape each token as an id
1225  foreach ( $references as &$ref ) {
1226  $ref = Sanitizer::escapeId( $ref, $options );
1227  }
1228 
1229  # Merge the array back to a space delimited list string
1230  # If the array is empty, the result will be an empty string ('')
1231  $referenceString = implode( ' ', $references );
1232 
1233  return $referenceString;
1234  }
1235 
1247  static function escapeClass( $class ) {
1248  // Convert ugly stuff to underscores and kill underscores in ugly places
1249  return rtrim( preg_replace(
1250  [ '/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/', '/_+/' ],
1251  '_',
1252  $class ), '_' );
1253  }
1254 
1262  static function escapeHtmlAllowEntities( $html ) {
1264  # It seems wise to escape ' as well as ", as a matter of course. Can't
1265  # hurt. Use ENT_SUBSTITUTE so that incorrectly truncated multibyte characters
1266  # don't cause the entire string to disappear.
1267  $html = htmlspecialchars( $html, ENT_QUOTES | ENT_SUBSTITUTE );
1268  return $html;
1269  }
1270 
1276  private static function armorLinksCallback( $matches ) {
1277  return str_replace( ':', '&#58;', $matches[1] );
1278  }
1279 
1288  public static function decodeTagAttributes( $text ) {
1289  if ( trim( $text ) == '' ) {
1290  return [];
1291  }
1292 
1293  $attribs = [];
1294  $pairs = [];
1295  if ( !preg_match_all(
1296  self::getAttribsRegex(),
1297  $text,
1298  $pairs,
1299  PREG_SET_ORDER ) ) {
1300  return $attribs;
1301  }
1302 
1303  foreach ( $pairs as $set ) {
1304  $attribute = strtolower( $set[1] );
1306 
1307  // Normalize whitespace
1308  $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1309  $value = trim( $value );
1310 
1311  // Decode character references
1313  }
1314  return $attribs;
1315  }
1316 
1324  public static function safeEncodeTagAttributes( $assoc_array ) {
1325  $attribs = [];
1326  foreach ( $assoc_array as $attribute => $value ) {
1327  $encAttribute = htmlspecialchars( $attribute );
1328  $encValue = Sanitizer::safeEncodeAttribute( $value );
1329 
1330  $attribs[] = "$encAttribute=\"$encValue\"";
1331  }
1332  return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : '';
1333  }
1334 
1343  private static function getTagAttributeCallback( $set ) {
1344  if ( isset( $set[5] ) ) {
1345  # No quotes.
1346  return $set[5];
1347  } elseif ( isset( $set[4] ) ) {
1348  # Single-quoted
1349  return $set[4];
1350  } elseif ( isset( $set[3] ) ) {
1351  # Double-quoted
1352  return $set[3];
1353  } elseif ( !isset( $set[2] ) ) {
1354  # In XHTML, attributes must have a value so return an empty string.
1355  # See "Empty attribute syntax",
1356  # https://www.w3.org/TR/html5/syntax.html#syntax-attribute-name
1357  return "";
1358  } else {
1359  throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1360  }
1361  }
1362 
1367  private static function normalizeWhitespace( $text ) {
1368  return preg_replace(
1369  '/\r\n|[\x20\x0d\x0a\x09]/',
1370  ' ',
1371  $text );
1372  }
1373 
1383  return trim( preg_replace( '/[ _]+/', ' ', $section ) );
1384  }
1385 
1401  static function normalizeCharReferences( $text ) {
1402  return preg_replace_callback(
1403  self::CHAR_REFS_REGEX,
1404  [ 'Sanitizer', 'normalizeCharReferencesCallback' ],
1405  $text );
1406  }
1407 
1413  $ret = null;
1414  if ( $matches[1] != '' ) {
1416  } elseif ( $matches[2] != '' ) {
1418  } elseif ( $matches[3] != '' ) {
1420  }
1421  if ( is_null( $ret ) ) {
1422  return htmlspecialchars( $matches[0] );
1423  } else {
1424  return $ret;
1425  }
1426  }
1427 
1438  static function normalizeEntity( $name ) {
1439  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1440  return '&' . self::$htmlEntityAliases[$name] . ';';
1441  } elseif ( in_array( $name, [ 'lt', 'gt', 'amp', 'quot' ] ) ) {
1442  return "&$name;";
1443  } elseif ( isset( self::$htmlEntities[$name] ) ) {
1444  return '&#' . self::$htmlEntities[$name] . ';';
1445  } else {
1446  return "&amp;$name;";
1447  }
1448  }
1449 
1454  static function decCharReference( $codepoint ) {
1455  $point = intval( $codepoint );
1456  if ( Sanitizer::validateCodepoint( $point ) ) {
1457  return sprintf( '&#%d;', $point );
1458  } else {
1459  return null;
1460  }
1461  }
1462 
1467  static function hexCharReference( $codepoint ) {
1468  $point = hexdec( $codepoint );
1469  if ( Sanitizer::validateCodepoint( $point ) ) {
1470  return sprintf( '&#x%x;', $point );
1471  } else {
1472  return null;
1473  }
1474  }
1475 
1482  private static function validateCodepoint( $codepoint ) {
1483  # U+000C is valid in HTML5 but not allowed in XML.
1484  # U+000D is valid in XML but not allowed in HTML5.
1485  # U+007F - U+009F are disallowed in HTML5 (control characters).
1486  return $codepoint == 0x09
1487  || $codepoint == 0x0a
1488  || ( $codepoint >= 0x20 && $codepoint <= 0x7e )
1489  || ( $codepoint >= 0xa0 && $codepoint <= 0xd7ff )
1490  || ( $codepoint >= 0xe000 && $codepoint <= 0xfffd )
1491  || ( $codepoint >= 0x10000 && $codepoint <= 0x10ffff );
1492  }
1493 
1501  public static function decodeCharReferences( $text ) {
1502  return preg_replace_callback(
1503  self::CHAR_REFS_REGEX,
1504  [ 'Sanitizer', 'decodeCharReferencesCallback' ],
1505  $text );
1506  }
1507 
1518  public static function decodeCharReferencesAndNormalize( $text ) {
1520  $text = preg_replace_callback(
1521  self::CHAR_REFS_REGEX,
1522  [ 'Sanitizer', 'decodeCharReferencesCallback' ],
1523  $text, /* limit */ -1, $count );
1524 
1525  if ( $count ) {
1526  return $wgContLang->normalize( $text );
1527  } else {
1528  return $text;
1529  }
1530  }
1531 
1537  if ( $matches[1] != '' ) {
1538  return Sanitizer::decodeEntity( $matches[1] );
1539  } elseif ( $matches[2] != '' ) {
1540  return Sanitizer::decodeChar( intval( $matches[2] ) );
1541  } elseif ( $matches[3] != '' ) {
1542  return Sanitizer::decodeChar( hexdec( $matches[3] ) );
1543  }
1544  # Last case should be an ampersand by itself
1545  return $matches[0];
1546  }
1547 
1555  static function decodeChar( $codepoint ) {
1556  if ( Sanitizer::validateCodepoint( $codepoint ) ) {
1557  return UtfNormal\Utils::codepointToUtf8( $codepoint );
1558  } else {
1560  }
1561  }
1562 
1571  static function decodeEntity( $name ) {
1572  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1573  $name = self::$htmlEntityAliases[$name];
1574  }
1575  if ( isset( self::$htmlEntities[$name] ) ) {
1576  return UtfNormal\Utils::codepointToUtf8( self::$htmlEntities[$name] );
1577  } else {
1578  return "&$name;";
1579  }
1580  }
1581 
1588  static function attributeWhitelist( $element ) {
1590  return isset( $list[$element] )
1591  ? $list[$element]
1592  : [];
1593  }
1594 
1600  static function setupAttributeWhitelist() {
1601  static $whitelist;
1602 
1603  if ( $whitelist !== null ) {
1604  return $whitelist;
1605  }
1606 
1607  $common = [
1608  # HTML
1609  'id',
1610  'class',
1611  'style',
1612  'lang',
1613  'dir',
1614  'title',
1615 
1616  # WAI-ARIA
1617  'aria-describedby',
1618  'aria-flowto',
1619  'aria-label',
1620  'aria-labelledby',
1621  'aria-owns',
1622  'role',
1623 
1624  # RDFa
1625  # These attributes are specified in section 9 of
1626  # https://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1627  'about',
1628  'property',
1629  'resource',
1630  'datatype',
1631  'typeof',
1632 
1633  # Microdata. These are specified by
1634  # https://html.spec.whatwg.org/multipage/microdata.html#the-microdata-model
1635  'itemid',
1636  'itemprop',
1637  'itemref',
1638  'itemscope',
1639  'itemtype',
1640  ];
1641 
1642  $block = array_merge( $common, [ 'align' ] );
1643  $tablealign = [ 'align', 'valign' ];
1644  $tablecell = [
1645  'abbr',
1646  'axis',
1647  'headers',
1648  'scope',
1649  'rowspan',
1650  'colspan',
1651  'nowrap', # deprecated
1652  'width', # deprecated
1653  'height', # deprecated
1654  'bgcolor', # deprecated
1655  ];
1656 
1657  # Numbers refer to sections in HTML 4.01 standard describing the element.
1658  # See: https://www.w3.org/TR/html4/
1659  $whitelist = [
1660  # 7.5.4
1661  'div' => $block,
1662  'center' => $common, # deprecated
1663  'span' => $common,
1664 
1665  # 7.5.5
1666  'h1' => $block,
1667  'h2' => $block,
1668  'h3' => $block,
1669  'h4' => $block,
1670  'h5' => $block,
1671  'h6' => $block,
1672 
1673  # 7.5.6
1674  # address
1675 
1676  # 8.2.4
1677  'bdo' => $common,
1678 
1679  # 9.2.1
1680  'em' => $common,
1681  'strong' => $common,
1682  'cite' => $common,
1683  'dfn' => $common,
1684  'code' => $common,
1685  'samp' => $common,
1686  'kbd' => $common,
1687  'var' => $common,
1688  'abbr' => $common,
1689  # acronym
1690 
1691  # 9.2.2
1692  'blockquote' => array_merge( $common, [ 'cite' ] ),
1693  'q' => array_merge( $common, [ 'cite' ] ),
1694 
1695  # 9.2.3
1696  'sub' => $common,
1697  'sup' => $common,
1698 
1699  # 9.3.1
1700  'p' => $block,
1701 
1702  # 9.3.2
1703  'br' => array_merge( $common, [ 'clear' ] ),
1704 
1705  # https://www.w3.org/TR/html5/text-level-semantics.html#the-wbr-element
1706  'wbr' => $common,
1707 
1708  # 9.3.4
1709  'pre' => array_merge( $common, [ 'width' ] ),
1710 
1711  # 9.4
1712  'ins' => array_merge( $common, [ 'cite', 'datetime' ] ),
1713  'del' => array_merge( $common, [ 'cite', 'datetime' ] ),
1714 
1715  # 10.2
1716  'ul' => array_merge( $common, [ 'type' ] ),
1717  'ol' => array_merge( $common, [ 'type', 'start', 'reversed' ] ),
1718  'li' => array_merge( $common, [ 'type', 'value' ] ),
1719 
1720  # 10.3
1721  'dl' => $common,
1722  'dd' => $common,
1723  'dt' => $common,
1724 
1725  # 11.2.1
1726  'table' => array_merge( $common,
1727  [ 'summary', 'width', 'border', 'frame',
1728  'rules', 'cellspacing', 'cellpadding',
1729  'align', 'bgcolor',
1730  ] ),
1731 
1732  # 11.2.2
1733  'caption' => $block,
1734 
1735  # 11.2.3
1736  'thead' => $common,
1737  'tfoot' => $common,
1738  'tbody' => $common,
1739 
1740  # 11.2.4
1741  'colgroup' => array_merge( $common, [ 'span' ] ),
1742  'col' => array_merge( $common, [ 'span' ] ),
1743 
1744  # 11.2.5
1745  'tr' => array_merge( $common, [ 'bgcolor' ], $tablealign ),
1746 
1747  # 11.2.6
1748  'td' => array_merge( $common, $tablecell, $tablealign ),
1749  'th' => array_merge( $common, $tablecell, $tablealign ),
1750 
1751  # 12.2
1752  # NOTE: <a> is not allowed directly, but the attrib
1753  # whitelist is used from the Parser object
1754  'a' => array_merge( $common, [ 'href', 'rel', 'rev' ] ), # rel/rev esp. for RDFa
1755 
1756  # 13.2
1757  # Not usually allowed, but may be used for extension-style hooks
1758  # such as <math> when it is rasterized, or if $wgAllowImageTag is
1759  # true
1760  'img' => array_merge( $common, [ 'alt', 'src', 'width', 'height' ] ),
1761 
1762  # 15.2.1
1763  'tt' => $common,
1764  'b' => $common,
1765  'i' => $common,
1766  'big' => $common,
1767  'small' => $common,
1768  'strike' => $common,
1769  's' => $common,
1770  'u' => $common,
1771 
1772  # 15.2.2
1773  'font' => array_merge( $common, [ 'size', 'color', 'face' ] ),
1774  # basefont
1775 
1776  # 15.3
1777  'hr' => array_merge( $common, [ 'width' ] ),
1778 
1779  # HTML Ruby annotation text module, simple ruby only.
1780  # https://www.w3.org/TR/html5/text-level-semantics.html#the-ruby-element
1781  'ruby' => $common,
1782  # rbc
1783  'rb' => $common,
1784  'rp' => $common,
1785  'rt' => $common, # array_merge( $common, array( 'rbspan' ) ),
1786  'rtc' => $common,
1787 
1788  # MathML root element, where used for extensions
1789  # 'title' may not be 100% valid here; it's XHTML
1790  # https://www.w3.org/TR/REC-MathML/
1791  'math' => [ 'class', 'style', 'id', 'title' ],
1792 
1793  # HTML 5 section 4.6
1794  'bdi' => $common,
1795 
1796  # HTML5 elements, defined by:
1797  # https://html.spec.whatwg.org/multipage/semantics.html#the-data-element
1798  'data' => array_merge( $common, [ 'value' ] ),
1799  'time' => array_merge( $common, [ 'datetime' ] ),
1800  'mark' => $common,
1801 
1802  // meta and link are only permitted by removeHTMLtags when Microdata
1803  // is enabled so we don't bother adding a conditional to hide these
1804  // Also meta and link are only valid in WikiText as Microdata elements
1805  // (ie: validateTag rejects tags missing the attributes needed for Microdata)
1806  // So we don't bother including $common attributes that have no purpose.
1807  'meta' => [ 'itemprop', 'content' ],
1808  'link' => [ 'itemprop', 'href' ],
1809  ];
1810 
1811  return $whitelist;
1812  }
1813 
1824  static function stripAllTags( $text ) {
1825  # Actual <tags>
1826  $text = StringUtils::delimiterReplace( '<', '>', '', $text );
1827 
1828  # Normalize &entities and whitespace
1829  $text = self::decodeCharReferences( $text );
1830  $text = self::normalizeWhitespace( $text );
1831 
1832  return $text;
1833  }
1834 
1844  static function hackDocType() {
1845  $out = "<!DOCTYPE html [\n";
1846  foreach ( self::$htmlEntities as $entity => $codepoint ) {
1847  $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1848  }
1849  $out .= "]>\n";
1850  return $out;
1851  }
1852 
1857  static function cleanUrl( $url ) {
1858  # Normalize any HTML entities in input. They will be
1859  # re-escaped by makeExternalLink().
1860  $url = Sanitizer::decodeCharReferences( $url );
1861 
1862  # Escape any control characters introduced by the above step
1863  $url = preg_replace_callback( '/[\][<>"\\x00-\\x20\\x7F\|]/',
1864  [ __CLASS__, 'cleanUrlCallback' ], $url );
1865 
1866  # Validate hostname portion
1867  $matches = [];
1868  if ( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1869  list( /* $whole */, $protocol, $host, $rest ) = $matches;
1870 
1871  // Characters that will be ignored in IDNs.
1872  // https://tools.ietf.org/html/rfc3454#section-3.1
1873  // Strip them before further processing so blacklists and such work.
1874  $strip = "/
1875  \\s| # general whitespace
1876  \xc2\xad| # 00ad SOFT HYPHEN
1877  \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1878  \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1879  \xe2\x81\xa0| # 2060 WORD JOINER
1880  \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1881  \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
1882  \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1883  \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1884  \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1885  \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1886  \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1887  [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe0f VARIATION SELECTOR-1-16
1888  /xuD";
1889 
1890  $host = preg_replace( $strip, '', $host );
1891 
1892  // IPv6 host names are bracketed with []. Url-decode these.
1893  if ( substr_compare( "//%5B", $host, 0, 5 ) === 0 &&
1894  preg_match( '!^//%5B([0-9A-Fa-f:.]+)%5D((:\d+)?)$!', $host, $matches )
1895  ) {
1896  $host = '//[' . $matches[1] . ']' . $matches[2];
1897  }
1898 
1899  // @todo FIXME: Validate hostnames here
1900 
1901  return $protocol . $host . $rest;
1902  } else {
1903  return $url;
1904  }
1905  }
1906 
1911  static function cleanUrlCallback( $matches ) {
1912  return urlencode( $matches[0] );
1913  }
1914 
1943  public static function validateEmail( $addr ) {
1944  $result = null;
1945  if ( !Hooks::run( 'isValidEmailAddr', [ $addr, &$result ] ) ) {
1946  return $result;
1947  }
1948 
1949  // Please note strings below are enclosed in brackets [], this make the
1950  // hyphen "-" a range indicator. Hence it is double backslashed below.
1951  // See bug 26948
1952  $rfc5322_atext = "a-z0-9!#$%&'*+\\-\/=?^_`{|}~";
1953  $rfc1034_ldh_str = "a-z0-9\\-";
1954 
1955  $html5_email_regexp = "/
1956  ^ # start of string
1957  [$rfc5322_atext\\.]+ # user part which is liberal :p
1958  @ # 'apostrophe'
1959  [$rfc1034_ldh_str]+ # First domain part
1960  (\\.[$rfc1034_ldh_str]+)* # Following part prefixed with a dot
1961  $ # End of string
1962  /ix"; // case Insensitive, eXtended
1963 
1964  return (bool)preg_match( $html5_email_regexp, $addr );
1965  }
1966 }
utf8ToCodepoint($char)
Determine the Unicode codepoint of a single-character UTF-8 sequence.
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if that
Definition: deferred.txt:11
static decCharReference($codepoint)
Definition: Sanitizer.php:1454
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses & $html
Definition: hooks.txt:1909
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global list
Definition: deferred.txt:11
static decodeTagAttributes($text)
Return an associative array of attribute names and values from a partial tag string.
Definition: Sanitizer.php:1288
this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that probably a stub it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output $out
Definition: hooks.txt:772
static normalizeEntity($name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the equivalent numeric entity re...
Definition: Sanitizer.php:1438
the array() calling protocol came about after MediaWiki 1.4rc1.
static safeEncodeTagAttributes($assoc_array)
Build a partial tag string from an associative array of attribute names and values as returned by dec...
Definition: Sanitizer.php:1324
static normalizeCharReferencesCallback($matches)
Definition: Sanitizer.php:1412
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses & $ret
Definition: hooks.txt:1909
static setupAttributeWhitelist()
Foreach array key (an allowed HTML element), return an array of allowed attributes.
Definition: Sanitizer.php:1600
static isEnabled()
Definition: MWTidy.php:79
static fixTagAttributes($text, $element, $sorted=false)
Take a tag soup fragment listing an HTML element's attributes and normalize it to well-formed XML...
Definition: Sanitizer.php:1071
static decodeCharReferencesCallback($matches)
Definition: Sanitizer.php:1536
static cssDecodeCallback($matches)
Definition: Sanitizer.php:1029
null for the local wiki Added in
Definition: hooks.txt:1528
$value
static escapeClass($class)
Given a value, escape it so that it can be used as a CSS class and return it.
Definition: Sanitizer.php:1247
static hackDocType()
Hack up a private DOCTYPE with HTML's standard entity declarations.
Definition: Sanitizer.php:1844
static cleanUrl($url)
Definition: Sanitizer.php:1857
static stripAllTags($text)
Take a fragment of (potentially invalid) HTML and return a version with any tags removed, encoded as plain text.
Definition: Sanitizer.php:1824
when a variable name is used in a it is silently declared as a new local masking the global
Definition: design.txt:93
const UTF8_REPLACEMENT
static hexCharReference($codepoint)
Definition: Sanitizer.php:1467
static validateTagAttributes($attribs, $element)
Take an array of attribute names and values and normalize or discard illegal values for the given ele...
Definition: Sanitizer.php:748
static normalizeWhitespace($text)
Definition: Sanitizer.php:1367
static static static $attribsRegex
Lazy-initialised attributes regex, see getAttribsRegex()
Definition: Sanitizer.php:325
The index of the header message $result[1]=The index of the body text message $result[2 through n]=Parameters passed to body text message.Please note the header message cannot receive/use parameters. 'ImportHandleLogItemXMLTag':When parsing a XML tag in a log item.Return false to stop further processing of the tag $reader:XMLReader object $logInfo:Array of information 'ImportHandlePageXMLTag':When parsing a XML tag in a page.Return false to stop further processing of the tag $reader:XMLReader object &$pageInfo:Array of information 'ImportHandleRevisionXMLTag':When parsing a XML tag in a page revision.Return false to stop further processing of the tag $reader:XMLReader object $pageInfo:Array of page information $revisionInfo:Array of revision information 'ImportHandleToplevelXMLTag':When parsing a top level XML tag.Return false to stop further processing of the tag $reader:XMLReader object 'ImportHandleUploadXMLTag':When parsing a XML tag in a file upload.Return false to stop further processing of the tag $reader:XMLReader object $revisionInfo:Array of information 'ImportLogInterwikiLink':Hook to change the interwiki link used in log entries and edit summaries for transwiki imports.&$fullInterwikiPrefix:Interwiki prefix, may contain colons.&$pageTitle:String that contains page title. 'ImportSources':Called when reading from the $wgImportSources configuration variable.Can be used to lazy-load the import sources list.&$importSources:The value of $wgImportSources.Modify as necessary.See the comment in DefaultSettings.php for the detail of how to structure this array. 'InfoAction':When building information to display on the action=info page.$context:IContextSource object &$pageInfo:Array of information 'InitializeArticleMaybeRedirect':MediaWiki check to see if title is a redirect.&$title:Title object for the current page &$request:WebRequest &$ignoreRedirect:boolean to skip redirect check &$target:Title/string of redirect target &$article:Article object 'InternalParseBeforeLinks':during Parser's internalParse method before links but after nowiki/noinclude/includeonly/onlyinclude and other processings.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InternalParseBeforeSanitize':during Parser's internalParse method just before the parser removes unwanted/dangerous HTML tags and after nowiki/noinclude/includeonly/onlyinclude and other processings.Ideal for syntax-extensions after template/parser function execution which respect nowiki and HTML-comments.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InterwikiLoadPrefix':When resolving if a given prefix is an interwiki or not.Return true without providing an interwiki to continue interwiki search.$prefix:interwiki prefix we are looking for.&$iwData:output array describing the interwiki with keys iw_url, iw_local, iw_trans and optionally iw_api and iw_wikiid. 'InvalidateEmailComplete':Called after a user's email has been invalidated successfully.$user:user(object) whose email is being invalidated 'IRCLineURL':When constructing the URL to use in an IRC notification.Callee may modify $url and $query, URL will be constructed as $url.$query &$url:URL to index.php &$query:Query string $rc:RecentChange object that triggered url generation 'IsFileCacheable':Override the result of Article::isFileCacheable()(if true) &$article:article(object) being checked 'IsTrustedProxy':Override the result of IP::isTrustedProxy() &$ip:IP being check &$result:Change this value to override the result of IP::isTrustedProxy() 'IsUploadAllowedFromUrl':Override the result of UploadFromUrl::isAllowedUrl() $url:URL used to upload from &$allowed:Boolean indicating if uploading is allowed for given URL 'isValidEmailAddr':Override the result of Sanitizer::validateEmail(), for instance to return false if the domain name doesn't match your organization.$addr:The e-mail address entered by the user &$result:Set this and return false to override the internal checks 'isValidPassword':Override the result of User::isValidPassword() $password:The password entered by the user &$result:Set this and return false to override the internal checks $user:User the password is being validated for 'Language::getMessagesFileName':$code:The language code or the language we're looking for a messages file for &$file:The messages file path, you can override this to change the location. 'LanguageGetMagic':DEPRECATED!Use $magicWords in a file listed in $wgExtensionMessagesFiles instead.Use this to define synonyms of magic words depending of the language &$magicExtensions:associative array of magic words synonyms $lang:language code(string) 'LanguageGetNamespaces':Provide custom ordering for namespaces or remove namespaces.Do not use this hook to add namespaces.Use CanonicalNamespaces for that.&$namespaces:Array of namespaces indexed by their numbers 'LanguageGetSpecialPageAliases':DEPRECATED!Use $specialPageAliases in a file listed in $wgExtensionMessagesFiles instead.Use to define aliases of special pages names depending of the language &$specialPageAliases:associative array of magic words synonyms $lang:language code(string) 'LanguageGetTranslatedLanguageNames':Provide translated language names.&$names:array of language code=> language name $code:language of the preferred translations 'LanguageLinks':Manipulate a page's language links.This is called in various places to allow extensions to define the effective language links for a page.$title:The page's Title.&$links:Array with elements of the form"language:title"in the order that they will be output.&$linkFlags:Associative array mapping prefixed links to arrays of flags.Currently unused, but planned to provide support for marking individual language links in the UI, e.g.for featured articles. 'LanguageSelector':Hook to change the language selector available on a page.$out:The output page.$cssClassName:CSS class name of the language selector. 'LinkBegin':DEPRECATED!Use HtmlPageLinkRendererBegin instead.Used when generating internal and interwiki links in Linker::link(), before processing starts.Return false to skip default processing and return $ret.See documentation for Linker::link() for details on the expected meanings of parameters.$skin:the Skin object $target:the Title that the link is pointing to &$html:the contents that the< a > tag should have(raw HTML) $result
Definition: hooks.txt:1907
if($line===false) $args
Definition: cdb.php:63
static decodeCharReferences($text)
Decode any character references, numeric or named entities, in the text and return a UTF-8 string...
Definition: Sanitizer.php:1501
static validateCodepoint($codepoint)
Returns true if a given Unicode codepoint is a valid character in both HTML5 and XML.
Definition: Sanitizer.php:1482
const EVIL_URI_PATTERN
Blacklist for evil uris like javascript: WARNING: DO NOT use this in any place that actually requires...
Definition: Sanitizer.php:56
const ELEMENT_BITS_REGEX
Acceptable tag name charset from HTML5 parsing spec https://www.w3.org/TR/html5/syntax.html#tag-open-state.
Definition: Sanitizer.php:46
Unicode normalization routines for working with UTF-8 strings.
Definition: UtfNormal.php:48
static decodeChar($codepoint)
Return UTF-8 string for a codepoint if that is a valid character reference, otherwise U+FFFD REPLACEM...
Definition: Sanitizer.php:1555
static normalizeSectionNameWhitespace($section)
Normalizes whitespace in a section name, such as might be returned by Parser::stripSectionName(), for use in the id's that are used for section links.
Definition: Sanitizer.php:1382
static delimiterReplace($startDelim, $endDelim, $replace, $subject, $flags= '')
Perform an operation equivalent to preg_replace() with flags.
static $htmlEntities
List of all named character entities defined in HTML 4.01 https://www.w3.org/TR/html4/sgml/entities.html As well as ' which is only defined starting in XHTML1.
Definition: Sanitizer.php:64
static attributeWhitelist($element)
Fetch the whitelist of acceptable attributes for a given element name.
Definition: Sanitizer.php:1588
this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist e g Watchlist removed from all revisions and log entries to which it was applied This gives extensions a chance to take it off their books as the deletion has already been partly carried out by this point or something similar the user will be unable to create the tag set and then return false from the hook function Ensure you consume the ChangeTagAfterDelete hook to carry out custom deletion actions as context called by AbstractContent::getParserOutput May be used to override the normal model specific rendering of page content as context as context $options
Definition: hooks.txt:1016
static escapeHtmlAllowEntities($html)
Given HTML input, escape with htmlspecialchars but un-escape entities.
Definition: Sanitizer.php:1262
static validateTag($params, $element)
Takes attribute names and values for a tag and the tag name and validates that the tag is allowed to ...
Definition: Sanitizer.php:712
static mergeAttributes($a, $b)
Merge two sets of HTML attributes.
Definition: Sanitizer.php:871
const CHAR_REFS_REGEX
Regular expression to match various types of character references in Sanitizer::normalizeCharReferenc...
Definition: Sanitizer.php:36
static getRecognizedTagData($extratags=[], $removetags=[])
Return the various lists of recognized tags.
Definition: Sanitizer.php:365
$params
static validateAttributes($attribs, $whitelist)
Take an array of attribute names and values and normalize or discard illegal values for the given whi...
Definition: Sanitizer.php:768
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses after processing & $attribs
Definition: hooks.txt:1909
you don t have to do a grep find to see where the $wgReverseTitle variable is used
Definition: hooks.txt:117
static decodeCharReferencesAndNormalize($text)
Decode any character references, numeric or named entities, in the next and normalize the resulting s...
Definition: Sanitizer.php:1518
static run($event, array $args=[], $deprecatedVersion=null)
Call hook functions defined in Hooks::register and $wgHooks.
Definition: Hooks.php:131
static static $htmlEntityAliases
Character entity aliases accepted by MediaWiki.
Definition: Sanitizer.php:323
static escapeIdReferenceList($referenceString, $options=[])
Given a string containing a space delimited list of ids, escape each id to match ids escaped by the e...
Definition: Sanitizer.php:1220
Apache License January AND DISTRIBUTION Definitions License shall mean the terms and conditions for and distribution as defined by Sections through of this document Licensor shall mean the copyright owner or entity authorized by the copyright owner that is granting the License Legal Entity shall mean the union of the acting entity and all other entities that control are controlled by or are under common control with that entity For the purposes of this definition control direct or to cause the direction or management of such whether by contract or including but not limited to software source documentation and configuration files Object form shall mean any form resulting from mechanical transformation or translation of a Source including but not limited to compiled object generated and conversions to other media types Work shall mean the work of whether in Source or Object made available under the as indicated by a copyright notice that is included in or attached to the whether in Source or Object that is based or other modifications as a an original work of authorship For the purposes of this Derivative Works shall not include works that remain separable or merely the Work and Derivative Works thereof Contribution shall mean any work of including the original version of the Work and any modifications or additions to that Work or Derivative Works that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner For the purposes of this submitted means any form of or written communication sent to the Licensor or its including but not limited to communication on electronic mailing source code control and issue tracking systems that are managed by
static cleanUrlCallback($matches)
Definition: Sanitizer.php:1911
This document is intended to provide useful advice for parties seeking to redistribute MediaWiki to end users It s targeted particularly at maintainers for Linux since it s been observed that distribution packages of MediaWiki often break We ve consistently had to recommend that users seeking support use official tarballs instead of their distribution s and this often solves whatever problem the user is having It would be nice if this could such as
Definition: distributors.txt:9
usually copyright or history_copyright This message must be in HTML not wikitext if the section is included from a template $section
Definition: hooks.txt:2871
static armorLinksCallback($matches)
Regex replace callback for armoring links against further processing.
Definition: Sanitizer.php:1276
static escapeId($id, $options=[])
Given a value, escape it so that it can be used in an id attribute and return it. ...
Definition: Sanitizer.php:1170
wfUrlProtocols($includeProtocolRelative=true)
Returns a regular expression of url protocols.
static normalizeCss($value)
Normalize CSS into a format we can easily search for hostile input.
Definition: Sanitizer.php:893
const XMLNS_ATTRIBUTE_PATTERN
Definition: Sanitizer.php:57
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency which acts as the top level factory for services in MediaWiki which can be used to gain access to default instances of various services MediaWikiServices however also allows new services to be defined and default services to be redefined Services are defined or redefined by providing a callback the instantiator that will return a new instance of the service When it will create an instance of MediaWikiServices and populate it with the services defined in the files listed by thereby bootstrapping the DI framework Per $wgServiceWiringFiles lists includes ServiceWiring php
Definition: injection.txt:35
static removeHTMLtags($text, $processCallback=null, $args=[], $extratags=[], $removetags=[], $warnCallback=null)
Cleans up HTML, removes dangerous tags and attributes, and removes HTML comments. ...
Definition: Sanitizer.php:462
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if so it s not worth the trouble Since there is a job queue in the jobs table
Definition: deferred.txt:11
static normalizeCharReferences($text)
Ensure that any entities and character references are legal for XML and XHTML specifically.
Definition: Sanitizer.php:1401
this class mediates it Skin Encapsulates a look and feel for the wiki All of the functions that render HTML and make choices about how to render it are here and are called from various other places when and is meant to be subclassed with other skins that may override some of its functions The User object contains a reference to a and so rather than having a global skin object we just rely on the global User and get the skin with $wgUser and also has some character encoding functions and other locale stuff The current user interface language is instantiated as and the local content language as $wgContLang
Definition: design.txt:56
$wgExperimentalHtmlIds
Should we allow a broader set of characters in id attributes, per HTML5? If not, use only HTML 4-comp...
static removeHTMLcomments($text)
Remove '', and everything between.
Definition: Sanitizer.php:666
static getAttribsRegex()
Regular expression to match HTML/XML attribute pairs within a tag.
Definition: Sanitizer.php:340
codepointToUtf8($codepoint)
Return UTF-8 sequence for a given Unicode code point.
static validateEmail($addr)
Does a string look like an e-mail address?
Definition: Sanitizer.php:1943
static checkCss($value)
Pick apart some CSS and check it for forbidden or unsafe structures.
Definition: Sanitizer.php:1001
static getTagAttributeCallback($set)
Pick the appropriate attribute value from a match set from the attribs regex matches.
Definition: Sanitizer.php:1343
</td >< td > &</td >< td > t want your writing to be edited mercilessly and redistributed at will
static decodeEntity($name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the UTF-8 encoding of that chara...
Definition: Sanitizer.php:1571
static safeEncodeAttribute($text)
Encode an attribute value for HTML tags, with extra armoring against further wiki processing...
Definition: Sanitizer.php:1112
static configuration should be added through ResourceLoaderGetConfigVars instead & $vars
Definition: hooks.txt:2132
static encodeAttribute($text)
Encode an attribute value for HTML output.
Definition: Sanitizer.php:1091
$matches
Allows to change the fields on the form that will be generated $name
Definition: hooks.txt:300