MediaWiki  master
Sanitizer.php
Go to the documentation of this file.
1 <?php
31 class Sanitizer {
37  '/&([A-Za-z0-9\x80-\xff]+);
38  |&\#([0-9]+);
39  |&\#[xX]([0-9A-Fa-f]+);
40  |(&)/x';
41 
46  const ELEMENT_BITS_REGEX = '!^(/?)([A-Za-z][^\t\n\v />\0]*+)([^>]*?)(/?>)([^<]*)$!';
47 
56  const EVIL_URI_PATTERN = '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i';
57  const XMLNS_ATTRIBUTE_PATTERN = "/^xmlns:[:A-Z_a-z-.0-9]+$/";
58 
64  const ID_PRIMARY = 0;
65 
72  const ID_FALLBACK = 1;
73 
79  private static $htmlEntities = [
80  'Aacute' => 193,
81  'aacute' => 225,
82  'Acirc' => 194,
83  'acirc' => 226,
84  'acute' => 180,
85  'AElig' => 198,
86  'aelig' => 230,
87  'Agrave' => 192,
88  'agrave' => 224,
89  'alefsym' => 8501,
90  'Alpha' => 913,
91  'alpha' => 945,
92  'amp' => 38,
93  'and' => 8743,
94  'ang' => 8736,
95  'apos' => 39, // New in XHTML & HTML 5; avoid in output for compatibility with IE.
96  'Aring' => 197,
97  'aring' => 229,
98  'asymp' => 8776,
99  'Atilde' => 195,
100  'atilde' => 227,
101  'Auml' => 196,
102  'auml' => 228,
103  'bdquo' => 8222,
104  'Beta' => 914,
105  'beta' => 946,
106  'brvbar' => 166,
107  'bull' => 8226,
108  'cap' => 8745,
109  'Ccedil' => 199,
110  'ccedil' => 231,
111  'cedil' => 184,
112  'cent' => 162,
113  'Chi' => 935,
114  'chi' => 967,
115  'circ' => 710,
116  'clubs' => 9827,
117  'cong' => 8773,
118  'copy' => 169,
119  'crarr' => 8629,
120  'cup' => 8746,
121  'curren' => 164,
122  'dagger' => 8224,
123  'Dagger' => 8225,
124  'darr' => 8595,
125  'dArr' => 8659,
126  'deg' => 176,
127  'Delta' => 916,
128  'delta' => 948,
129  'diams' => 9830,
130  'divide' => 247,
131  'Eacute' => 201,
132  'eacute' => 233,
133  'Ecirc' => 202,
134  'ecirc' => 234,
135  'Egrave' => 200,
136  'egrave' => 232,
137  'empty' => 8709,
138  'emsp' => 8195,
139  'ensp' => 8194,
140  'Epsilon' => 917,
141  'epsilon' => 949,
142  'equiv' => 8801,
143  'Eta' => 919,
144  'eta' => 951,
145  'ETH' => 208,
146  'eth' => 240,
147  'Euml' => 203,
148  'euml' => 235,
149  'euro' => 8364,
150  'exist' => 8707,
151  'fnof' => 402,
152  'forall' => 8704,
153  'frac12' => 189,
154  'frac14' => 188,
155  'frac34' => 190,
156  'frasl' => 8260,
157  'Gamma' => 915,
158  'gamma' => 947,
159  'ge' => 8805,
160  'gt' => 62,
161  'harr' => 8596,
162  'hArr' => 8660,
163  'hearts' => 9829,
164  'hellip' => 8230,
165  'Iacute' => 205,
166  'iacute' => 237,
167  'Icirc' => 206,
168  'icirc' => 238,
169  'iexcl' => 161,
170  'Igrave' => 204,
171  'igrave' => 236,
172  'image' => 8465,
173  'infin' => 8734,
174  'int' => 8747,
175  'Iota' => 921,
176  'iota' => 953,
177  'iquest' => 191,
178  'isin' => 8712,
179  'Iuml' => 207,
180  'iuml' => 239,
181  'Kappa' => 922,
182  'kappa' => 954,
183  'Lambda' => 923,
184  'lambda' => 955,
185  'lang' => 9001,
186  'laquo' => 171,
187  'larr' => 8592,
188  'lArr' => 8656,
189  'lceil' => 8968,
190  'ldquo' => 8220,
191  'le' => 8804,
192  'lfloor' => 8970,
193  'lowast' => 8727,
194  'loz' => 9674,
195  'lrm' => 8206,
196  'lsaquo' => 8249,
197  'lsquo' => 8216,
198  'lt' => 60,
199  'macr' => 175,
200  'mdash' => 8212,
201  'micro' => 181,
202  'middot' => 183,
203  'minus' => 8722,
204  'Mu' => 924,
205  'mu' => 956,
206  'nabla' => 8711,
207  'nbsp' => 160,
208  'ndash' => 8211,
209  'ne' => 8800,
210  'ni' => 8715,
211  'not' => 172,
212  'notin' => 8713,
213  'nsub' => 8836,
214  'Ntilde' => 209,
215  'ntilde' => 241,
216  'Nu' => 925,
217  'nu' => 957,
218  'Oacute' => 211,
219  'oacute' => 243,
220  'Ocirc' => 212,
221  'ocirc' => 244,
222  'OElig' => 338,
223  'oelig' => 339,
224  'Ograve' => 210,
225  'ograve' => 242,
226  'oline' => 8254,
227  'Omega' => 937,
228  'omega' => 969,
229  'Omicron' => 927,
230  'omicron' => 959,
231  'oplus' => 8853,
232  'or' => 8744,
233  'ordf' => 170,
234  'ordm' => 186,
235  'Oslash' => 216,
236  'oslash' => 248,
237  'Otilde' => 213,
238  'otilde' => 245,
239  'otimes' => 8855,
240  'Ouml' => 214,
241  'ouml' => 246,
242  'para' => 182,
243  'part' => 8706,
244  'permil' => 8240,
245  'perp' => 8869,
246  'Phi' => 934,
247  'phi' => 966,
248  'Pi' => 928,
249  'pi' => 960,
250  'piv' => 982,
251  'plusmn' => 177,
252  'pound' => 163,
253  'prime' => 8242,
254  'Prime' => 8243,
255  'prod' => 8719,
256  'prop' => 8733,
257  'Psi' => 936,
258  'psi' => 968,
259  'quot' => 34,
260  'radic' => 8730,
261  'rang' => 9002,
262  'raquo' => 187,
263  'rarr' => 8594,
264  'rArr' => 8658,
265  'rceil' => 8969,
266  'rdquo' => 8221,
267  'real' => 8476,
268  'reg' => 174,
269  'rfloor' => 8971,
270  'Rho' => 929,
271  'rho' => 961,
272  'rlm' => 8207,
273  'rsaquo' => 8250,
274  'rsquo' => 8217,
275  'sbquo' => 8218,
276  'Scaron' => 352,
277  'scaron' => 353,
278  'sdot' => 8901,
279  'sect' => 167,
280  'shy' => 173,
281  'Sigma' => 931,
282  'sigma' => 963,
283  'sigmaf' => 962,
284  'sim' => 8764,
285  'spades' => 9824,
286  'sub' => 8834,
287  'sube' => 8838,
288  'sum' => 8721,
289  'sup' => 8835,
290  'sup1' => 185,
291  'sup2' => 178,
292  'sup3' => 179,
293  'supe' => 8839,
294  'szlig' => 223,
295  'Tau' => 932,
296  'tau' => 964,
297  'there4' => 8756,
298  'Theta' => 920,
299  'theta' => 952,
300  'thetasym' => 977,
301  'thinsp' => 8201,
302  'THORN' => 222,
303  'thorn' => 254,
304  'tilde' => 732,
305  'times' => 215,
306  'trade' => 8482,
307  'Uacute' => 218,
308  'uacute' => 250,
309  'uarr' => 8593,
310  'uArr' => 8657,
311  'Ucirc' => 219,
312  'ucirc' => 251,
313  'Ugrave' => 217,
314  'ugrave' => 249,
315  'uml' => 168,
316  'upsih' => 978,
317  'Upsilon' => 933,
318  'upsilon' => 965,
319  'Uuml' => 220,
320  'uuml' => 252,
321  'weierp' => 8472,
322  'Xi' => 926,
323  'xi' => 958,
324  'Yacute' => 221,
325  'yacute' => 253,
326  'yen' => 165,
327  'Yuml' => 376,
328  'yuml' => 255,
329  'Zeta' => 918,
330  'zeta' => 950,
331  'zwj' => 8205,
332  'zwnj' => 8204
333  ];
334 
338  private static $htmlEntityAliases = [
339  'רלמ' => 'rlm',
340  'رلم' => 'rlm',
341  ];
342 
346  private static $attribsRegex;
347 
355  static function getAttribsRegex() {
356  if ( self::$attribsRegex === null ) {
357  $attribFirst = "[:_\p{L}\p{N}]";
358  $attrib = "[:_\.\-\p{L}\p{N}]";
359  $space = '[\x09\x0a\x0c\x0d\x20]';
360  self::$attribsRegex =
361  "/(?:^|$space)({$attribFirst}{$attrib}*)
362  ($space*=$space*
363  (?:
364  # The attribute value: quoted or alone
365  \"([^\"]*)(?:\"|\$)
366  | '([^']*)(?:'|\$)
367  | (((?!$space|>).)*)
368  )
369  )?(?=$space|\$)/sxu";
370  }
371  return self::$attribsRegex;
372  }
373 
380  public static function getRecognizedTagData( $extratags = [], $removetags = [] ) {
381  global $wgAllowImageTag;
382 
383  static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
384  $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
385 
386  // Base our staticInitialised variable off of the global config state so that if the globals
387  // are changed (like in the screwed up test system) we will re-initialise the settings.
388  $globalContext = $wgAllowImageTag;
389  if ( !$staticInitialised || $staticInitialised != $globalContext ) {
390  $htmlpairsStatic = [ # Tags that must be closed
391  'b', 'bdi', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
392  'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
393  'strike', 'strong', 'tt', 'var', 'div', 'center',
394  'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
395  'ruby', 'rb', 'rp', 'rt', 'rtc', 'p', 'span', 'abbr', 'dfn',
396  'kbd', 'samp', 'data', 'time', 'mark'
397  ];
398  $htmlsingle = [
399  'br', 'wbr', 'hr', 'li', 'dt', 'dd', 'meta', 'link'
400  ];
401 
402  # Elements that cannot have close tags. This is (not coincidentally)
403  # also the list of tags for which the HTML 5 parsing algorithm
404  # requires you to "acknowledge the token's self-closing flag", i.e.
405  # a self-closing tag like <br/> is not an HTML 5 parse error only
406  # for this list.
407  $htmlsingleonly = [
408  'br', 'wbr', 'hr', 'meta', 'link'
409  ];
410 
411  $htmlnest = [ # Tags that can be nested--??
412  'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
413  'li', 'dl', 'dt', 'dd', 'font', 'big', 'small', 'sub', 'sup', 'span',
414  'var', 'kbd', 'samp', 'em', 'strong', 'q', 'ruby', 'bdo'
415  ];
416  $tabletags = [ # Can only appear inside table, we will close them
417  'td', 'th', 'tr',
418  ];
419  $htmllist = [ # Tags used by list
420  'ul', 'ol',
421  ];
422  $listtags = [ # Tags that can appear in a list
423  'li',
424  ];
425 
426  if ( $wgAllowImageTag ) {
427  $htmlsingle[] = 'img';
428  $htmlsingleonly[] = 'img';
429  }
430 
431  $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
432  $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
433 
434  # Convert them all to hashtables for faster lookup
435  $vars = [ 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
436  'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' ];
437  foreach ( $vars as $var ) {
438  $$var = array_flip( $$var );
439  }
440  $staticInitialised = $globalContext;
441  }
442 
443  # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
444  $extratags = array_flip( $extratags );
445  $removetags = array_flip( $removetags );
446  $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
447  $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ), $removetags );
448 
449  return [
450  'htmlpairs' => $htmlpairs,
451  'htmlsingle' => $htmlsingle,
452  'htmlsingleonly' => $htmlsingleonly,
453  'htmlnest' => $htmlnest,
454  'tabletags' => $tabletags,
455  'htmllist' => $htmllist,
456  'listtags' => $listtags,
457  'htmlsingleallowed' => $htmlsingleallowed,
458  'htmlelements' => $htmlelements,
459  ];
460  }
461 
477  public static function removeHTMLtags( $text, $processCallback = null,
478  $args = [], $extratags = [], $removetags = [], $warnCallback = null
479  ) {
480  $tagData = self::getRecognizedTagData( $extratags, $removetags );
481  $htmlpairs = $tagData['htmlpairs'];
482  $htmlsingle = $tagData['htmlsingle'];
483  $htmlsingleonly = $tagData['htmlsingleonly'];
484  $htmlnest = $tagData['htmlnest'];
485  $tabletags = $tagData['tabletags'];
486  $htmllist = $tagData['htmllist'];
487  $listtags = $tagData['listtags'];
488  $htmlsingleallowed = $tagData['htmlsingleallowed'];
489  $htmlelements = $tagData['htmlelements'];
490 
491  # Remove HTML comments
492  $text = self::removeHTMLcomments( $text );
493  $bits = explode( '<', $text );
494  $text = str_replace( '>', '&gt;', array_shift( $bits ) );
495  if ( !MWTidy::isEnabled() ) {
496  $tagstack = $tablestack = [];
497  foreach ( $bits as $x ) {
498  $regs = [];
499  # $slash: Does the current element start with a '/'?
500  # $t: Current element name
501  # $params: String between element name and >
502  # $brace: Ending '>' or '/>'
503  # $rest: Everything until the next element of $bits
504  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
505  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
506  } else {
507  $slash = $t = $params = $brace = $rest = null;
508  }
509 
510  $badtag = false;
511  $t = strtolower( $t );
512  if ( isset( $htmlelements[$t] ) ) {
513  # Check our stack
514  if ( $slash && isset( $htmlsingleonly[$t] ) ) {
515  $badtag = true;
516  } elseif ( $slash ) {
517  # Closing a tag... is it the one we just opened?
518  MediaWiki\suppressWarnings();
519  $ot = array_pop( $tagstack );
520  MediaWiki\restoreWarnings();
521 
522  if ( $ot != $t ) {
523  if ( isset( $htmlsingleallowed[$ot] ) ) {
524  # Pop all elements with an optional close tag
525  # and see if we find a match below them
526  $optstack = [];
527  array_push( $optstack, $ot );
528  MediaWiki\suppressWarnings();
529  $ot = array_pop( $tagstack );
530  MediaWiki\restoreWarnings();
531  while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
532  array_push( $optstack, $ot );
533  MediaWiki\suppressWarnings();
534  $ot = array_pop( $tagstack );
535  MediaWiki\restoreWarnings();
536  }
537  if ( $t != $ot ) {
538  # No match. Push the optional elements back again
539  $badtag = true;
540  MediaWiki\suppressWarnings();
541  $ot = array_pop( $optstack );
542  MediaWiki\restoreWarnings();
543  while ( $ot ) {
544  array_push( $tagstack, $ot );
545  MediaWiki\suppressWarnings();
546  $ot = array_pop( $optstack );
547  MediaWiki\restoreWarnings();
548  }
549  }
550  } else {
551  MediaWiki\suppressWarnings();
552  array_push( $tagstack, $ot );
553  MediaWiki\restoreWarnings();
554 
555  # <li> can be nested in <ul> or <ol>, skip those cases:
556  if ( !isset( $htmllist[$ot] ) || !isset( $listtags[$t] ) ) {
557  $badtag = true;
558  }
559  }
560  } else {
561  if ( $t == 'table' ) {
562  $tagstack = array_pop( $tablestack );
563  }
564  }
565  $newparams = '';
566  } else {
567  # Keep track for later
568  if ( isset( $tabletags[$t] ) && !in_array( 'table', $tagstack ) ) {
569  $badtag = true;
570  } elseif ( in_array( $t, $tagstack ) && !isset( $htmlnest[$t] ) ) {
571  $badtag = true;
572  #  Is it a self closed htmlpair ? (T7487)
573  } elseif ( $brace == '/>' && isset( $htmlpairs[$t] ) ) {
574  // Eventually we'll just remove the self-closing
575  // slash, in order to be consistent with HTML5
576  // semantics.
577  // $brace = '>';
578  // For now, let's just warn authors to clean up.
579  if ( is_callable( $warnCallback ) ) {
580  call_user_func_array( $warnCallback, [ 'deprecated-self-close-category' ] );
581  }
582  $badtag = true;
583  } elseif ( isset( $htmlsingleonly[$t] ) ) {
584  # Hack to force empty tag for unclosable elements
585  $brace = '/>';
586  } elseif ( isset( $htmlsingle[$t] ) ) {
587  # Hack to not close $htmlsingle tags
588  $brace = null;
589  # Still need to push this optionally-closed tag to
590  # the tag stack so that we can match end tags
591  # instead of marking them as bad.
592  array_push( $tagstack, $t );
593  } elseif ( isset( $tabletags[$t] ) && in_array( $t, $tagstack ) ) {
594  // New table tag but forgot to close the previous one
595  $text .= "</$t>";
596  } else {
597  if ( $t == 'table' ) {
598  array_push( $tablestack, $tagstack );
599  $tagstack = [];
600  }
601  array_push( $tagstack, $t );
602  }
603 
604  # Replace any variables or template parameters with
605  # plaintext results.
606  if ( is_callable( $processCallback ) ) {
607  call_user_func_array( $processCallback, [ &$params, $args ] );
608  }
609 
610  if ( !self::validateTag( $params, $t ) ) {
611  $badtag = true;
612  }
613 
614  # Strip non-approved attributes from the tag
615  $newparams = self::fixTagAttributes( $params, $t );
616  }
617  if ( !$badtag ) {
618  $rest = str_replace( '>', '&gt;', $rest );
619  $close = ( $brace == '/>' && !$slash ) ? ' /' : '';
620  $text .= "<$slash$t$newparams$close>$rest";
621  continue;
622  }
623  }
624  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
625  }
626  # Close off any remaining tags
627  while ( is_array( $tagstack ) && ( $t = array_pop( $tagstack ) ) ) {
628  $text .= "</$t>\n";
629  if ( $t == 'table' ) {
630  $tagstack = array_pop( $tablestack );
631  }
632  }
633  } else {
634  # this might be possible using tidy itself
635  foreach ( $bits as $x ) {
636  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
637  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
638 
639  $badtag = false;
640  $t = strtolower( $t );
641  if ( isset( $htmlelements[$t] ) ) {
642  if ( is_callable( $processCallback ) ) {
643  call_user_func_array( $processCallback, [ &$params, $args ] );
644  }
645 
646  if ( $brace == '/>' && !( isset( $htmlsingle[$t] ) || isset( $htmlsingleonly[$t] ) ) ) {
647  // Eventually we'll just remove the self-closing
648  // slash, in order to be consistent with HTML5
649  // semantics.
650  // $brace = '>';
651  // For now, let's just warn authors to clean up.
652  if ( is_callable( $warnCallback ) ) {
653  call_user_func_array( $warnCallback, [ 'deprecated-self-close-category' ] );
654  }
655  }
656  if ( !self::validateTag( $params, $t ) ) {
657  $badtag = true;
658  }
659 
660  $newparams = self::fixTagAttributes( $params, $t );
661  if ( !$badtag ) {
662  if ( $brace === '/>' && !isset( $htmlsingleonly[$t] ) ) {
663  # Interpret self-closing tags as empty tags even when
664  # HTML 5 would interpret them as start tags. Such input
665  # is commonly seen on Wikimedia wikis with this intention.
666  $brace = "></$t>";
667  }
668 
669  $rest = str_replace( '>', '&gt;', $rest );
670  $text .= "<$slash$t$newparams$brace$rest";
671  continue;
672  }
673  }
674  }
675  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
676  }
677  }
678  return $text;
679  }
680 
690  public static function removeHTMLcomments( $text ) {
691  while ( ( $start = strpos( $text, '<!--' ) ) !== false ) {
692  $end = strpos( $text, '-->', $start + 4 );
693  if ( $end === false ) {
694  # Unterminated comment; bail out
695  break;
696  }
697 
698  $end += 3;
699 
700  # Trim space and newline if the comment is both
701  # preceded and followed by a newline
702  $spaceStart = max( $start - 1, 0 );
703  $spaceLen = $end - $spaceStart;
704  while ( substr( $text, $spaceStart, 1 ) === ' ' && $spaceStart > 0 ) {
705  $spaceStart--;
706  $spaceLen++;
707  }
708  while ( substr( $text, $spaceStart + $spaceLen, 1 ) === ' ' ) {
709  $spaceLen++;
710  }
711  if ( substr( $text, $spaceStart, 1 ) === "\n"
712  && substr( $text, $spaceStart + $spaceLen, 1 ) === "\n" ) {
713  # Remove the comment, leading and trailing
714  # spaces, and leave only one newline.
715  $text = substr_replace( $text, "\n", $spaceStart, $spaceLen + 1 );
716  } else {
717  # Remove just the comment.
718  $text = substr_replace( $text, '', $start, $end - $start );
719  }
720  }
721  return $text;
722  }
723 
736  static function validateTag( $params, $element ) {
737  $params = self::decodeTagAttributes( $params );
738 
739  if ( $element == 'meta' || $element == 'link' ) {
740  if ( !isset( $params['itemprop'] ) ) {
741  // <meta> and <link> must have an itemprop="" otherwise they are not valid or safe in content
742  return false;
743  }
744  if ( $element == 'meta' && !isset( $params['content'] ) ) {
745  // <meta> must have a content="" for the itemprop
746  return false;
747  }
748  if ( $element == 'link' && !isset( $params['href'] ) ) {
749  // <link> must have an associated href=""
750  return false;
751  }
752  }
753 
754  return true;
755  }
756 
772  static function validateTagAttributes( $attribs, $element ) {
773  return self::validateAttributes( $attribs,
774  self::attributeWhitelist( $element ) );
775  }
776 
792  static function validateAttributes( $attribs, $whitelist ) {
793  $whitelist = array_flip( $whitelist );
794  $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
795 
796  $out = [];
797  foreach ( $attribs as $attribute => $value ) {
798  # Allow XML namespace declaration to allow RDFa
799  if ( preg_match( self::XMLNS_ATTRIBUTE_PATTERN, $attribute ) ) {
800  if ( !preg_match( self::EVIL_URI_PATTERN, $value ) ) {
801  $out[$attribute] = $value;
802  }
803 
804  continue;
805  }
806 
807  # Allow any attribute beginning with "data-"
808  # However:
809  # * Disallow data attributes used by MediaWiki code
810  # * Ensure that the attribute is not namespaced by banning
811  # colons.
812  if ( !preg_match( '/^data-[^:]*$/i', $attribute )
813  && !isset( $whitelist[$attribute] )
814  || self::isReservedDataAttribute( $attribute )
815  ) {
816  continue;
817  }
818 
819  # Strip javascript "expression" from stylesheets.
820  # https://msdn.microsoft.com/en-us/library/ms537634.aspx
821  if ( $attribute == 'style' ) {
822  $value = self::checkCss( $value );
823  }
824 
825  # Escape HTML id attributes
826  if ( $attribute === 'id' ) {
827  $value = self::escapeIdForAttribute( $value, self::ID_PRIMARY );
828  }
829 
830  # Escape HTML id reference lists
831  if ( $attribute === 'aria-describedby'
832  || $attribute === 'aria-flowto'
833  || $attribute === 'aria-labelledby'
834  || $attribute === 'aria-owns'
835  ) {
836  $value = self::escapeIdReferenceList( $value );
837  }
838 
839  // RDFa and microdata properties allow URLs, URIs and/or CURIs.
840  // Check them for sanity.
841  if ( $attribute === 'rel' || $attribute === 'rev'
842  # RDFa
843  || $attribute === 'about' || $attribute === 'property'
844  || $attribute === 'resource' || $attribute === 'datatype'
845  || $attribute === 'typeof'
846  # HTML5 microdata
847  || $attribute === 'itemid' || $attribute === 'itemprop'
848  || $attribute === 'itemref' || $attribute === 'itemscope'
849  || $attribute === 'itemtype'
850  ) {
851  // Paranoia. Allow "simple" values but suppress javascript
852  if ( preg_match( self::EVIL_URI_PATTERN, $value ) ) {
853  continue;
854  }
855  }
856 
857  # NOTE: even though elements using href/src are not allowed directly, supply
858  # validation code that can be used by tag hook handlers, etc
859  if ( $attribute === 'href' || $attribute === 'src' || $attribute === 'poster' ) {
860  if ( !preg_match( $hrefExp, $value ) ) {
861  continue; // drop any href or src attributes not using an allowed protocol.
862  // NOTE: this also drops all relative URLs
863  }
864  }
865 
866  // If this attribute was previously set, override it.
867  // Output should only have one attribute of each name.
868  $out[$attribute] = $value;
869  }
870 
871  # itemtype, itemid, itemref don't make sense without itemscope
872  if ( !array_key_exists( 'itemscope', $out ) ) {
873  unset( $out['itemtype'] );
874  unset( $out['itemid'] );
875  unset( $out['itemref'] );
876  }
877  # TODO: Strip itemprop if we aren't descendants of an itemscope or pointed to by an itemref.
878 
879  return $out;
880  }
881 
889  public static function isReservedDataAttribute( $attr ) {
890  // data-ooui is reserved for ooui.
891  // data-mw and data-parsoid are reserved for parsoid.
892  // data-mw-<name here> is reserved for extensions (or core) if
893  // they need to communicate some data to the client and want to be
894  // sure that it isn't coming from an untrusted user.
895  // We ignore the possibility of namespaces since user-generated HTML
896  // can't use them anymore.
897  return (bool)preg_match( '/^data-(ooui|mw|parsoid)/i', $attr );
898  }
899 
910  static function mergeAttributes( $a, $b ) {
911  $out = array_merge( $a, $b );
912  if ( isset( $a['class'] ) && isset( $b['class'] )
913  && is_string( $a['class'] ) && is_string( $b['class'] )
914  && $a['class'] !== $b['class']
915  ) {
916  $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
917  -1, PREG_SPLIT_NO_EMPTY );
918  $out['class'] = implode( ' ', array_unique( $classes ) );
919  }
920  return $out;
921  }
922 
932  public static function normalizeCss( $value ) {
933  // Decode character references like &#123;
934  $value = self::decodeCharReferences( $value );
935 
936  // Decode escape sequences and line continuation
937  // See the grammar in the CSS 2 spec, appendix D.
938  // This has to be done AFTER decoding character references.
939  // This means it isn't possible for this function to return
940  // unsanitized escape sequences. It is possible to manufacture
941  // input that contains character references that decode to
942  // escape sequences that decode to character references, but
943  // it's OK for the return value to contain character references
944  // because the caller is supposed to escape those anyway.
945  static $decodeRegex;
946  if ( !$decodeRegex ) {
947  $space = '[\\x20\\t\\r\\n\\f]';
948  $nl = '(?:\\n|\\r\\n|\\r|\\f)';
949  $backslash = '\\\\';
950  $decodeRegex = "/ $backslash
951  (?:
952  ($nl) | # 1. Line continuation
953  ([0-9A-Fa-f]{1,6})$space? | # 2. character number
954  (.) | # 3. backslash cancelling special meaning
955  () | # 4. backslash at end of string
956  )/xu";
957  }
958  $value = preg_replace_callback( $decodeRegex,
959  [ __CLASS__, 'cssDecodeCallback' ], $value );
960 
961  // Normalize Halfwidth and Fullwidth Unicode block that IE6 might treat as ascii
962  $value = preg_replace_callback(
963  '/[!-[]-z]/u', // U+FF01 to U+FF5A, excluding U+FF3C (T60088)
964  function ( $matches ) {
966  if ( $cp === false ) {
967  return '';
968  }
969  return chr( $cp - 65248 ); // ASCII range \x21-\x7A
970  },
971  $value
972  );
973 
974  // Convert more characters IE6 might treat as ascii
975  // U+0280, U+0274, U+207F, U+029F, U+026A, U+207D, U+208D
976  $value = str_replace(
977  [ 'ʀ', 'ɴ', 'ⁿ', 'ʟ', 'ɪ', '⁽', '₍' ],
978  [ 'r', 'n', 'n', 'l', 'i', '(', '(' ],
979  $value
980  );
981 
982  // Let the value through if it's nothing but a single comment, to
983  // allow other functions which may reject it to pass some error
984  // message through.
985  if ( !preg_match( '! ^ \s* /\* [^*\\/]* \*/ \s* $ !x', $value ) ) {
986  // Remove any comments; IE gets token splitting wrong
987  // This must be done AFTER decoding character references and
988  // escape sequences, because those steps can introduce comments
989  // This step cannot introduce character references or escape
990  // sequences, because it replaces comments with spaces rather
991  // than removing them completely.
992  $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value );
993 
994  // Remove anything after a comment-start token, to guard against
995  // incorrect client implementations.
996  $commentPos = strpos( $value, '/*' );
997  if ( $commentPos !== false ) {
998  $value = substr( $value, 0, $commentPos );
999  }
1000  }
1001 
1002  // S followed by repeat, iteration, or prolonged sound marks,
1003  // which IE will treat as "ss"
1004  $value = preg_replace(
1005  '/s(?:
1006  \xE3\x80\xB1 | # U+3031
1007  \xE3\x82\x9D | # U+309D
1008  \xE3\x83\xBC | # U+30FC
1009  \xE3\x83\xBD | # U+30FD
1010  \xEF\xB9\xBC | # U+FE7C
1011  \xEF\xB9\xBD | # U+FE7D
1012  \xEF\xBD\xB0 # U+FF70
1013  )/ix',
1014  'ss',
1015  $value
1016  );
1017 
1018  return $value;
1019  }
1020 
1039  static function checkCss( $value ) {
1040  $value = self::normalizeCss( $value );
1041 
1042  // Reject problematic keywords and control characters
1043  if ( preg_match( '/[\000-\010\013\016-\037\177]/', $value ) ||
1044  strpos( $value, UtfNormal\Constants::UTF8_REPLACEMENT ) !== false ) {
1045  return '/* invalid control char */';
1046  } elseif ( preg_match(
1047  '! expression
1048  | filter\s*:
1049  | accelerator\s*:
1050  | -o-link\s*:
1051  | -o-link-source\s*:
1052  | -o-replace\s*:
1053  | url\s*\(
1054  | image\s*\(
1055  | image-set\s*\(
1056  | attr\s*\([^)]+[\s,]+url
1057  !ix', $value ) ) {
1058  return '/* insecure input */';
1059  }
1060  return $value;
1061  }
1062 
1067  static function cssDecodeCallback( $matches ) {
1068  if ( $matches[1] !== '' ) {
1069  // Line continuation
1070  return '';
1071  } elseif ( $matches[2] !== '' ) {
1072  $char = UtfNormal\Utils::codepointToUtf8( hexdec( $matches[2] ) );
1073  } elseif ( $matches[3] !== '' ) {
1074  $char = $matches[3];
1075  } else {
1076  $char = '\\';
1077  }
1078  if ( $char == "\n" || $char == '"' || $char == "'" || $char == '\\' ) {
1079  // These characters need to be escaped in strings
1080  // Clean up the escape sequence to avoid parsing errors by clients
1081  return '\\' . dechex( ord( $char ) ) . ' ';
1082  } else {
1083  // Decode unnecessary escape
1084  return $char;
1085  }
1086  }
1087 
1109  static function fixTagAttributes( $text, $element, $sorted = false ) {
1110  if ( trim( $text ) == '' ) {
1111  return '';
1112  }
1113 
1114  $decoded = self::decodeTagAttributes( $text );
1115  $stripped = self::validateTagAttributes( $decoded, $element );
1116 
1117  if ( $sorted ) {
1118  ksort( $stripped );
1119  }
1120 
1121  return self::safeEncodeTagAttributes( $stripped );
1122  }
1123 
1129  static function encodeAttribute( $text ) {
1130  $encValue = htmlspecialchars( $text, ENT_QUOTES );
1131 
1132  // Whitespace is normalized during attribute decoding,
1133  // so if we've been passed non-spaces we must encode them
1134  // ahead of time or they won't be preserved.
1135  $encValue = strtr( $encValue, [
1136  "\n" => '&#10;',
1137  "\r" => '&#13;',
1138  "\t" => '&#9;',
1139  ] );
1140 
1141  return $encValue;
1142  }
1143 
1150  static function safeEncodeAttribute( $text ) {
1151  $encValue = self::encodeAttribute( $text );
1152 
1153  # Templates and links may be expanded in later parsing,
1154  # creating invalid or dangerous output. Suppress this.
1155  $encValue = strtr( $encValue, [
1156  '<' => '&lt;', // This should never happen,
1157  '>' => '&gt;', // we've received invalid input
1158  '"' => '&quot;', // which should have been escaped.
1159  '{' => '&#123;',
1160  '}' => '&#125;', // prevent unpaired language conversion syntax
1161  '[' => '&#91;',
1162  ']' => '&#93;',
1163  "''" => '&#39;&#39;',
1164  'ISBN' => '&#73;SBN',
1165  'RFC' => '&#82;FC',
1166  'PMID' => '&#80;MID',
1167  '|' => '&#124;',
1168  '__' => '&#95;_',
1169  ] );
1170 
1171  # Stupid hack
1172  $encValue = preg_replace_callback(
1173  '/((?i)' . wfUrlProtocols() . ')/',
1174  [ 'Sanitizer', 'armorLinksCallback' ],
1175  $encValue );
1176  return $encValue;
1177  }
1178 
1212  static function escapeId( $id, $options = [] ) {
1214  $options = (array)$options;
1215 
1216  if ( $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) {
1217  $id = preg_replace( '/[ \t\n\r\f_\'"&#%]+/', '_', $id );
1218  $id = trim( $id, '_' );
1219  if ( $id === '' ) {
1220  // Must have been all whitespace to start with.
1221  return '_';
1222  } else {
1223  return $id;
1224  }
1225  }
1226 
1227  // HTML4-style escaping
1228  static $replace = [
1229  '%3A' => ':',
1230  '%' => '.'
1231  ];
1232 
1233  $id = urlencode( strtr( $id, ' ', '_' ) );
1234  $id = strtr( $id, $replace );
1235 
1236  if ( !preg_match( '/^[a-zA-Z]/', $id ) && !in_array( 'noninitial', $options ) ) {
1237  // Initial character must be a letter!
1238  $id = "x$id";
1239  }
1240  return $id;
1241  }
1242 
1258  public static function escapeIdForAttribute( $id, $mode = self::ID_PRIMARY ) {
1260 
1261  if ( !isset( $wgFragmentMode[$mode] ) ) {
1262  if ( $mode === self::ID_PRIMARY ) {
1263  throw new UnexpectedValueException( '$wgFragmentMode is configured with no primary mode' );
1264  }
1265  return false;
1266  }
1267 
1268  $internalMode = $wgFragmentMode[$mode];
1269 
1270  return self::escapeIdInternal( $id, $internalMode );
1271  }
1272 
1285  public static function escapeIdForLink( $id ) {
1287 
1288  if ( !isset( $wgFragmentMode[self::ID_PRIMARY] ) ) {
1289  throw new UnexpectedValueException( '$wgFragmentMode is configured with no primary mode' );
1290  }
1291 
1292  $mode = $wgFragmentMode[self::ID_PRIMARY];
1293 
1294  $id = self::escapeIdInternal( $id, $mode );
1295 
1296  return $id;
1297  }
1298 
1308  public static function escapeIdForExternalInterwiki( $id ) {
1310 
1311  $id = self::escapeIdInternal( $id, $wgExternalInterwikiFragmentMode );
1312 
1313  return $id;
1314  }
1315 
1323  private static function escapeIdInternal( $id, $mode ) {
1324  switch ( $mode ) {
1325  case 'html5':
1326  $id = str_replace( ' ', '_', $id );
1327  break;
1328  case 'legacy':
1329  // This corresponds to 'noninitial' mode of the old escapeId()
1330  static $replace = [
1331  '%3A' => ':',
1332  '%' => '.'
1333  ];
1334 
1335  $id = urlencode( str_replace( ' ', '_', $id ) );
1336  $id = strtr( $id, $replace );
1337  break;
1338  case 'html5-legacy':
1339  $id = preg_replace( '/[ \t\n\r\f_\'"&#%]+/', '_', $id );
1340  $id = trim( $id, '_' );
1341  if ( $id === '' ) {
1342  // Must have been all whitespace to start with.
1343  $id = '_';
1344  }
1345  break;
1346  default:
1347  throw new InvalidArgumentException( "Invalid mode '$mode' passed to '" . __METHOD__ );
1348  }
1349 
1350  return $id;
1351  }
1352 
1365  static function escapeIdReferenceList( $referenceString, $options = [] ) {
1366  if ( $options ) {
1367  wfDeprecated( __METHOD__ . ' with $options', '1.31' );
1368  }
1369  # Explode the space delimited list string into an array of tokens
1370  $references = preg_split( '/\s+/', "{$referenceString}", -1, PREG_SPLIT_NO_EMPTY );
1371 
1372  # Escape each token as an id
1373  foreach ( $references as &$ref ) {
1374  $ref = self::escapeIdForAttribute( $ref );
1375  }
1376 
1377  # Merge the array back to a space delimited list string
1378  # If the array is empty, the result will be an empty string ('')
1379  $referenceString = implode( ' ', $references );
1380 
1381  return $referenceString;
1382  }
1383 
1395  static function escapeClass( $class ) {
1396  // Convert ugly stuff to underscores and kill underscores in ugly places
1397  return rtrim( preg_replace(
1398  [ '/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/', '/_+/' ],
1399  '_',
1400  $class ), '_' );
1401  }
1402 
1410  static function escapeHtmlAllowEntities( $html ) {
1411  $html = self::decodeCharReferences( $html );
1412  # It seems wise to escape ' as well as ", as a matter of course. Can't
1413  # hurt. Use ENT_SUBSTITUTE so that incorrectly truncated multibyte characters
1414  # don't cause the entire string to disappear.
1415  $html = htmlspecialchars( $html, ENT_QUOTES | ENT_SUBSTITUTE );
1416  return $html;
1417  }
1418 
1424  private static function armorLinksCallback( $matches ) {
1425  return str_replace( ':', '&#58;', $matches[1] );
1426  }
1427 
1436  public static function decodeTagAttributes( $text ) {
1437  if ( trim( $text ) == '' ) {
1438  return [];
1439  }
1440 
1441  $attribs = [];
1442  $pairs = [];
1443  if ( !preg_match_all(
1444  self::getAttribsRegex(),
1445  $text,
1446  $pairs,
1447  PREG_SET_ORDER ) ) {
1448  return $attribs;
1449  }
1450 
1451  foreach ( $pairs as $set ) {
1452  $attribute = strtolower( $set[1] );
1453  $value = self::getTagAttributeCallback( $set );
1454 
1455  // Normalize whitespace
1456  $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1457  $value = trim( $value );
1458 
1459  // Decode character references
1460  $attribs[$attribute] = self::decodeCharReferences( $value );
1461  }
1462  return $attribs;
1463  }
1464 
1472  public static function safeEncodeTagAttributes( $assoc_array ) {
1473  $attribs = [];
1474  foreach ( $assoc_array as $attribute => $value ) {
1475  $encAttribute = htmlspecialchars( $attribute );
1476  $encValue = self::safeEncodeAttribute( $value );
1477 
1478  $attribs[] = "$encAttribute=\"$encValue\"";
1479  }
1480  return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : '';
1481  }
1482 
1491  private static function getTagAttributeCallback( $set ) {
1492  if ( isset( $set[5] ) ) {
1493  # No quotes.
1494  return $set[5];
1495  } elseif ( isset( $set[4] ) ) {
1496  # Single-quoted
1497  return $set[4];
1498  } elseif ( isset( $set[3] ) ) {
1499  # Double-quoted
1500  return $set[3];
1501  } elseif ( !isset( $set[2] ) ) {
1502  # In XHTML, attributes must have a value so return an empty string.
1503  # See "Empty attribute syntax",
1504  # https://www.w3.org/TR/html5/syntax.html#syntax-attribute-name
1505  return "";
1506  } else {
1507  throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1508  }
1509  }
1510 
1515  private static function normalizeWhitespace( $text ) {
1516  return preg_replace(
1517  '/\r\n|[\x20\x0d\x0a\x09]/',
1518  ' ',
1519  $text );
1520  }
1521 
1531  return trim( preg_replace( '/[ _]+/', ' ', $section ) );
1532  }
1533 
1549  static function normalizeCharReferences( $text ) {
1550  return preg_replace_callback(
1551  self::CHAR_REFS_REGEX,
1552  [ 'Sanitizer', 'normalizeCharReferencesCallback' ],
1553  $text );
1554  }
1555 
1561  $ret = null;
1562  if ( $matches[1] != '' ) {
1563  $ret = self::normalizeEntity( $matches[1] );
1564  } elseif ( $matches[2] != '' ) {
1565  $ret = self::decCharReference( $matches[2] );
1566  } elseif ( $matches[3] != '' ) {
1567  $ret = self::hexCharReference( $matches[3] );
1568  }
1569  if ( is_null( $ret ) ) {
1570  return htmlspecialchars( $matches[0] );
1571  } else {
1572  return $ret;
1573  }
1574  }
1575 
1586  static function normalizeEntity( $name ) {
1587  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1588  return '&' . self::$htmlEntityAliases[$name] . ';';
1589  } elseif ( in_array( $name, [ 'lt', 'gt', 'amp', 'quot' ] ) ) {
1590  return "&$name;";
1591  } elseif ( isset( self::$htmlEntities[$name] ) ) {
1592  return '&#' . self::$htmlEntities[$name] . ';';
1593  } else {
1594  return "&amp;$name;";
1595  }
1596  }
1597 
1602  static function decCharReference( $codepoint ) {
1603  $point = intval( $codepoint );
1604  if ( self::validateCodepoint( $point ) ) {
1605  return sprintf( '&#%d;', $point );
1606  } else {
1607  return null;
1608  }
1609  }
1610 
1615  static function hexCharReference( $codepoint ) {
1616  $point = hexdec( $codepoint );
1617  if ( self::validateCodepoint( $point ) ) {
1618  return sprintf( '&#x%x;', $point );
1619  } else {
1620  return null;
1621  }
1622  }
1623 
1630  private static function validateCodepoint( $codepoint ) {
1631  # U+000C is valid in HTML5 but not allowed in XML.
1632  # U+000D is valid in XML but not allowed in HTML5.
1633  # U+007F - U+009F are disallowed in HTML5 (control characters).
1634  return $codepoint == 0x09
1635  || $codepoint == 0x0a
1636  || ( $codepoint >= 0x20 && $codepoint <= 0x7e )
1637  || ( $codepoint >= 0xa0 && $codepoint <= 0xd7ff )
1638  || ( $codepoint >= 0xe000 && $codepoint <= 0xfffd )
1639  || ( $codepoint >= 0x10000 && $codepoint <= 0x10ffff );
1640  }
1641 
1649  public static function decodeCharReferences( $text ) {
1650  return preg_replace_callback(
1651  self::CHAR_REFS_REGEX,
1652  [ 'Sanitizer', 'decodeCharReferencesCallback' ],
1653  $text );
1654  }
1655 
1666  public static function decodeCharReferencesAndNormalize( $text ) {
1668  $text = preg_replace_callback(
1669  self::CHAR_REFS_REGEX,
1670  [ 'Sanitizer', 'decodeCharReferencesCallback' ],
1671  $text,
1672  -1, //limit
1673  $count
1674  );
1675 
1676  if ( $count ) {
1677  return $wgContLang->normalize( $text );
1678  } else {
1679  return $text;
1680  }
1681  }
1682 
1688  if ( $matches[1] != '' ) {
1689  return self::decodeEntity( $matches[1] );
1690  } elseif ( $matches[2] != '' ) {
1691  return self::decodeChar( intval( $matches[2] ) );
1692  } elseif ( $matches[3] != '' ) {
1693  return self::decodeChar( hexdec( $matches[3] ) );
1694  }
1695  # Last case should be an ampersand by itself
1696  return $matches[0];
1697  }
1698 
1706  static function decodeChar( $codepoint ) {
1707  if ( self::validateCodepoint( $codepoint ) ) {
1708  return UtfNormal\Utils::codepointToUtf8( $codepoint );
1709  } else {
1711  }
1712  }
1713 
1722  static function decodeEntity( $name ) {
1723  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1724  $name = self::$htmlEntityAliases[$name];
1725  }
1726  if ( isset( self::$htmlEntities[$name] ) ) {
1727  return UtfNormal\Utils::codepointToUtf8( self::$htmlEntities[$name] );
1728  } else {
1729  return "&$name;";
1730  }
1731  }
1732 
1739  static function attributeWhitelist( $element ) {
1740  $list = self::setupAttributeWhitelist();
1741  return isset( $list[$element] )
1742  ? $list[$element]
1743  : [];
1744  }
1745 
1751  static function setupAttributeWhitelist() {
1752  static $whitelist;
1753 
1754  if ( $whitelist !== null ) {
1755  return $whitelist;
1756  }
1757 
1758  $common = [
1759  # HTML
1760  'id',
1761  'class',
1762  'style',
1763  'lang',
1764  'dir',
1765  'title',
1766 
1767  # WAI-ARIA
1768  'aria-describedby',
1769  'aria-flowto',
1770  'aria-label',
1771  'aria-labelledby',
1772  'aria-owns',
1773  'role',
1774 
1775  # RDFa
1776  # These attributes are specified in section 9 of
1777  # https://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1778  'about',
1779  'property',
1780  'resource',
1781  'datatype',
1782  'typeof',
1783 
1784  # Microdata. These are specified by
1785  # https://html.spec.whatwg.org/multipage/microdata.html#the-microdata-model
1786  'itemid',
1787  'itemprop',
1788  'itemref',
1789  'itemscope',
1790  'itemtype',
1791  ];
1792 
1793  $block = array_merge( $common, [ 'align' ] );
1794  $tablealign = [ 'align', 'valign' ];
1795  $tablecell = [
1796  'abbr',
1797  'axis',
1798  'headers',
1799  'scope',
1800  'rowspan',
1801  'colspan',
1802  'nowrap', # deprecated
1803  'width', # deprecated
1804  'height', # deprecated
1805  'bgcolor', # deprecated
1806  ];
1807 
1808  # Numbers refer to sections in HTML 4.01 standard describing the element.
1809  # See: https://www.w3.org/TR/html4/
1810  $whitelist = [
1811  # 7.5.4
1812  'div' => $block,
1813  'center' => $common, # deprecated
1814  'span' => $common,
1815 
1816  # 7.5.5
1817  'h1' => $block,
1818  'h2' => $block,
1819  'h3' => $block,
1820  'h4' => $block,
1821  'h5' => $block,
1822  'h6' => $block,
1823 
1824  # 7.5.6
1825  # address
1826 
1827  # 8.2.4
1828  'bdo' => $common,
1829 
1830  # 9.2.1
1831  'em' => $common,
1832  'strong' => $common,
1833  'cite' => $common,
1834  'dfn' => $common,
1835  'code' => $common,
1836  'samp' => $common,
1837  'kbd' => $common,
1838  'var' => $common,
1839  'abbr' => $common,
1840  # acronym
1841 
1842  # 9.2.2
1843  'blockquote' => array_merge( $common, [ 'cite' ] ),
1844  'q' => array_merge( $common, [ 'cite' ] ),
1845 
1846  # 9.2.3
1847  'sub' => $common,
1848  'sup' => $common,
1849 
1850  # 9.3.1
1851  'p' => $block,
1852 
1853  # 9.3.2
1854  'br' => array_merge( $common, [ 'clear' ] ),
1855 
1856  # https://www.w3.org/TR/html5/text-level-semantics.html#the-wbr-element
1857  'wbr' => $common,
1858 
1859  # 9.3.4
1860  'pre' => array_merge( $common, [ 'width' ] ),
1861 
1862  # 9.4
1863  'ins' => array_merge( $common, [ 'cite', 'datetime' ] ),
1864  'del' => array_merge( $common, [ 'cite', 'datetime' ] ),
1865 
1866  # 10.2
1867  'ul' => array_merge( $common, [ 'type' ] ),
1868  'ol' => array_merge( $common, [ 'type', 'start', 'reversed' ] ),
1869  'li' => array_merge( $common, [ 'type', 'value' ] ),
1870 
1871  # 10.3
1872  'dl' => $common,
1873  'dd' => $common,
1874  'dt' => $common,
1875 
1876  # 11.2.1
1877  'table' => array_merge( $common,
1878  [ 'summary', 'width', 'border', 'frame',
1879  'rules', 'cellspacing', 'cellpadding',
1880  'align', 'bgcolor',
1881  ] ),
1882 
1883  # 11.2.2
1884  'caption' => $block,
1885 
1886  # 11.2.3
1887  'thead' => $common,
1888  'tfoot' => $common,
1889  'tbody' => $common,
1890 
1891  # 11.2.4
1892  'colgroup' => array_merge( $common, [ 'span' ] ),
1893  'col' => array_merge( $common, [ 'span' ] ),
1894 
1895  # 11.2.5
1896  'tr' => array_merge( $common, [ 'bgcolor' ], $tablealign ),
1897 
1898  # 11.2.6
1899  'td' => array_merge( $common, $tablecell, $tablealign ),
1900  'th' => array_merge( $common, $tablecell, $tablealign ),
1901 
1902  # 12.2
1903  # NOTE: <a> is not allowed directly, but the attrib
1904  # whitelist is used from the Parser object
1905  'a' => array_merge( $common, [ 'href', 'rel', 'rev' ] ), # rel/rev esp. for RDFa
1906 
1907  # 13.2
1908  # Not usually allowed, but may be used for extension-style hooks
1909  # such as <math> when it is rasterized, or if $wgAllowImageTag is
1910  # true
1911  'img' => array_merge( $common, [ 'alt', 'src', 'width', 'height', 'srcset' ] ),
1912 
1913  'video' => array_merge( $common, [ 'poster', 'controls', 'preload', 'width', 'height' ] ),
1914  'source' => array_merge( $common, [ 'type', 'src' ] ),
1915  'track' => array_merge( $common, [ 'type', 'src', 'srclang', 'kind', 'label' ] ),
1916 
1917  # 15.2.1
1918  'tt' => $common,
1919  'b' => $common,
1920  'i' => $common,
1921  'big' => $common,
1922  'small' => $common,
1923  'strike' => $common,
1924  's' => $common,
1925  'u' => $common,
1926 
1927  # 15.2.2
1928  'font' => array_merge( $common, [ 'size', 'color', 'face' ] ),
1929  # basefont
1930 
1931  # 15.3
1932  'hr' => array_merge( $common, [ 'width' ] ),
1933 
1934  # HTML Ruby annotation text module, simple ruby only.
1935  # https://www.w3.org/TR/html5/text-level-semantics.html#the-ruby-element
1936  'ruby' => $common,
1937  # rbc
1938  'rb' => $common,
1939  'rp' => $common,
1940  'rt' => $common, # array_merge( $common, array( 'rbspan' ) ),
1941  'rtc' => $common,
1942 
1943  # MathML root element, where used for extensions
1944  # 'title' may not be 100% valid here; it's XHTML
1945  # https://www.w3.org/TR/REC-MathML/
1946  'math' => [ 'class', 'style', 'id', 'title' ],
1947 
1948  // HTML 5 section 4.5
1949  'figure' => $common,
1950  'figcaption' => $common,
1951 
1952  # HTML 5 section 4.6
1953  'bdi' => $common,
1954 
1955  # HTML5 elements, defined by:
1956  # https://html.spec.whatwg.org/multipage/semantics.html#the-data-element
1957  'data' => array_merge( $common, [ 'value' ] ),
1958  'time' => array_merge( $common, [ 'datetime' ] ),
1959  'mark' => $common,
1960 
1961  // meta and link are only permitted by removeHTMLtags when Microdata
1962  // is enabled so we don't bother adding a conditional to hide these
1963  // Also meta and link are only valid in WikiText as Microdata elements
1964  // (ie: validateTag rejects tags missing the attributes needed for Microdata)
1965  // So we don't bother including $common attributes that have no purpose.
1966  'meta' => [ 'itemprop', 'content' ],
1967  'link' => [ 'itemprop', 'href', 'title' ],
1968  ];
1969 
1970  return $whitelist;
1971  }
1972 
1983  static function stripAllTags( $html ) {
1984  // Use RemexHtml to tokenize $html and extract the text
1986  $tokenizer = new RemexHtml\Tokenizer\Tokenizer( $handler, $html, [
1987  'ignoreErrors' => true,
1988  // don't ignore char refs, we want them to be decoded
1989  'ignoreNulls' => true,
1990  'skipPreprocess' => true,
1991  ] );
1992  $tokenizer->execute();
1993  $text = $handler->getResult();
1994 
1995  $text = self::normalizeWhitespace( $text );
1996  return $text;
1997  }
1998 
2008  static function hackDocType() {
2009  $out = "<!DOCTYPE html [\n";
2010  foreach ( self::$htmlEntities as $entity => $codepoint ) {
2011  $out .= "<!ENTITY $entity \"&#$codepoint;\">";
2012  }
2013  $out .= "]>\n";
2014  return $out;
2015  }
2016 
2021  static function cleanUrl( $url ) {
2022  # Normalize any HTML entities in input. They will be
2023  # re-escaped by makeExternalLink().
2024  $url = self::decodeCharReferences( $url );
2025 
2026  # Escape any control characters introduced by the above step
2027  $url = preg_replace_callback( '/[\][<>"\\x00-\\x20\\x7F\|]/',
2028  [ __CLASS__, 'cleanUrlCallback' ], $url );
2029 
2030  # Validate hostname portion
2031  $matches = [];
2032  if ( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
2033  list( /* $whole */, $protocol, $host, $rest ) = $matches;
2034 
2035  // Characters that will be ignored in IDNs.
2036  // https://tools.ietf.org/html/rfc3454#section-3.1
2037  // Strip them before further processing so blacklists and such work.
2038  $strip = "/
2039  \\s| # general whitespace
2040  \xc2\xad| # 00ad SOFT HYPHEN
2041  \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
2042  \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
2043  \xe2\x81\xa0| # 2060 WORD JOINER
2044  \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
2045  \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
2046  \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
2047  \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
2048  \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
2049  \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
2050  \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
2051  [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe0f VARIATION SELECTOR-1-16
2052  /xuD";
2053 
2054  $host = preg_replace( $strip, '', $host );
2055 
2056  // IPv6 host names are bracketed with []. Url-decode these.
2057  if ( substr_compare( "//%5B", $host, 0, 5 ) === 0 &&
2058  preg_match( '!^//%5B([0-9A-Fa-f:.]+)%5D((:\d+)?)$!', $host, $matches )
2059  ) {
2060  $host = '//[' . $matches[1] . ']' . $matches[2];
2061  }
2062 
2063  // @todo FIXME: Validate hostnames here
2064 
2065  return $protocol . $host . $rest;
2066  } else {
2067  return $url;
2068  }
2069  }
2070 
2075  static function cleanUrlCallback( $matches ) {
2076  return urlencode( $matches[0] );
2077  }
2078 
2107  public static function validateEmail( $addr ) {
2108  $result = null;
2109  if ( !Hooks::run( 'isValidEmailAddr', [ $addr, &$result ] ) ) {
2110  return $result;
2111  }
2112 
2113  // Please note strings below are enclosed in brackets [], this make the
2114  // hyphen "-" a range indicator. Hence it is double backslashed below.
2115  // See T28948
2116  $rfc5322_atext = "a-z0-9!#$%&'*+\\-\/=?^_`{|}~";
2117  $rfc1034_ldh_str = "a-z0-9\\-";
2118 
2119  $html5_email_regexp = "/
2120  ^ # start of string
2121  [$rfc5322_atext\\.]+ # user part which is liberal :p
2122  @ # 'apostrophe'
2123  [$rfc1034_ldh_str]+ # First domain part
2124  (\\.[$rfc1034_ldh_str]+)* # Following part prefixed with a dot
2125  $ # End of string
2126  /ix"; // case Insensitive, eXtended
2127 
2128  return (bool)preg_match( $html5_email_regexp, $addr );
2129  }
2130 }
utf8ToCodepoint($char)
Determine the Unicode codepoint of a single-character UTF-8 sequence.
$wgExternalInterwikiFragmentMode
Which ID escaping mode should be used for external interwiki links? See documentation for $wgFragment...
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if that
Definition: deferred.txt:11
static decCharReference($codepoint)
Definition: Sanitizer.php:1602
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses & $html
Definition: hooks.txt:1973
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global list
Definition: deferred.txt:11
static decodeTagAttributes($text)
Return an associative array of attribute names and values from a partial tag string.
Definition: Sanitizer.php:1436
this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that probably a stub it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output $out
Definition: hooks.txt:784
static normalizeEntity($name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the equivalent numeric entity re...
Definition: Sanitizer.php:1586
the array() calling protocol came about after MediaWiki 1.4rc1.
static safeEncodeTagAttributes($assoc_array)
Build a partial tag string from an associative array of attribute names and values as returned by dec...
Definition: Sanitizer.php:1472
static normalizeCharReferencesCallback($matches)
Definition: Sanitizer.php:1560
const ID_PRIMARY
Tells escapeUrlForHtml() to encode the ID using the wiki's primary encoding.
Definition: Sanitizer.php:64
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses & $ret
Definition: hooks.txt:1973
static setupAttributeWhitelist()
Foreach array key (an allowed HTML element), return an array of allowed attributes.
Definition: Sanitizer.php:1751
static isEnabled()
Definition: MWTidy.php:79
static fixTagAttributes($text, $element, $sorted=false)
Take a tag soup fragment listing an HTML element's attributes and normalize it to well-formed XML...
Definition: Sanitizer.php:1109
static decodeCharReferencesCallback($matches)
Definition: Sanitizer.php:1687
static cssDecodeCallback($matches)
Definition: Sanitizer.php:1067
you don t have to do a grep find to see where the $wgReverseTitle variable is used
Definition: hooks.txt:115
null for the local wiki Added in
Definition: hooks.txt:1584
$value
static escapeClass($class)
Given a value, escape it so that it can be used as a CSS class and return it.
Definition: Sanitizer.php:1395
static hackDocType()
Hack up a private DOCTYPE with HTML's standard entity declarations.
Definition: Sanitizer.php:2008
static cleanUrl($url)
Definition: Sanitizer.php:2021
when a variable name is used in a it is silently declared as a new local masking the global
Definition: design.txt:93
const UTF8_REPLACEMENT
static hexCharReference($codepoint)
Definition: Sanitizer.php:1615
static validateTagAttributes($attribs, $element)
Take an array of attribute names and values and normalize or discard illegal values for the given ele...
Definition: Sanitizer.php:772
static normalizeWhitespace($text)
Definition: Sanitizer.php:1515
static isReservedDataAttribute($attr)
Given an attribute name, checks whether it is a reserved data attribute (such as data-mw-foo) which i...
Definition: Sanitizer.php:889
static static static $attribsRegex
Lazy-initialised attributes regex, see getAttribsRegex()
Definition: Sanitizer.php:340
The index of the header message $result[1]=The index of the body text message $result[2 through n]=Parameters passed to body text message.Please note the header message cannot receive/use parameters. 'ImportHandleLogItemXMLTag':When parsing a XML tag in a log item.Return false to stop further processing of the tag $reader:XMLReader object $logInfo:Array of information 'ImportHandlePageXMLTag':When parsing a XML tag in a page.Return false to stop further processing of the tag $reader:XMLReader object &$pageInfo:Array of information 'ImportHandleRevisionXMLTag':When parsing a XML tag in a page revision.Return false to stop further processing of the tag $reader:XMLReader object $pageInfo:Array of page information $revisionInfo:Array of revision information 'ImportHandleToplevelXMLTag':When parsing a top level XML tag.Return false to stop further processing of the tag $reader:XMLReader object 'ImportHandleUnknownUser':When a user doesn't exist locally, this hook is called to give extensions an opportunity to auto-create it.If the auto-creation is successful, return false.$name:User name 'ImportHandleUploadXMLTag':When parsing a XML tag in a file upload.Return false to stop further processing of the tag $reader:XMLReader object $revisionInfo:Array of information 'ImportLogInterwikiLink':Hook to change the interwiki link used in log entries and edit summaries for transwiki imports.&$fullInterwikiPrefix:Interwiki prefix, may contain colons.&$pageTitle:String that contains page title. 'ImportSources':Called when reading from the $wgImportSources configuration variable.Can be used to lazy-load the import sources list.&$importSources:The value of $wgImportSources.Modify as necessary.See the comment in DefaultSettings.php for the detail of how to structure this array. 'InfoAction':When building information to display on the action=info page.$context:IContextSource object &$pageInfo:Array of information 'InitializeArticleMaybeRedirect':MediaWiki check to see if title is a redirect.&$title:Title object for the current page &$request:WebRequest &$ignoreRedirect:boolean to skip redirect check &$target:Title/string of redirect target &$article:Article object 'InternalParseBeforeLinks':during Parser's internalParse method before links but after nowiki/noinclude/includeonly/onlyinclude and other processings.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InternalParseBeforeSanitize':during Parser's internalParse method just before the parser removes unwanted/dangerous HTML tags and after nowiki/noinclude/includeonly/onlyinclude and other processings.Ideal for syntax-extensions after template/parser function execution which respect nowiki and HTML-comments.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InterwikiLoadPrefix':When resolving if a given prefix is an interwiki or not.Return true without providing an interwiki to continue interwiki search.$prefix:interwiki prefix we are looking for.&$iwData:output array describing the interwiki with keys iw_url, iw_local, iw_trans and optionally iw_api and iw_wikiid. 'InvalidateEmailComplete':Called after a user's email has been invalidated successfully.$user:user(object) whose email is being invalidated 'IRCLineURL':When constructing the URL to use in an IRC notification.Callee may modify $url and $query, URL will be constructed as $url.$query &$url:URL to index.php &$query:Query string $rc:RecentChange object that triggered url generation 'IsFileCacheable':Override the result of Article::isFileCacheable()(if true) &$article:article(object) being checked 'IsTrustedProxy':Override the result of IP::isTrustedProxy() &$ip:IP being check &$result:Change this value to override the result of IP::isTrustedProxy() 'IsUploadAllowedFromUrl':Override the result of UploadFromUrl::isAllowedUrl() $url:URL used to upload from &$allowed:Boolean indicating if uploading is allowed for given URL 'isValidEmailAddr':Override the result of Sanitizer::validateEmail(), for instance to return false if the domain name doesn't match your organization.$addr:The e-mail address entered by the user &$result:Set this and return false to override the internal checks 'isValidPassword':Override the result of User::isValidPassword() $password:The password entered by the user &$result:Set this and return false to override the internal checks $user:User the password is being validated for 'Language::getMessagesFileName':$code:The language code or the language we're looking for a messages file for &$file:The messages file path, you can override this to change the location. 'LanguageGetMagic':DEPRECATED!Use $magicWords in a file listed in $wgExtensionMessagesFiles instead.Use this to define synonyms of magic words depending of the language &$magicExtensions:associative array of magic words synonyms $lang:language code(string) 'LanguageGetNamespaces':Provide custom ordering for namespaces or remove namespaces.Do not use this hook to add namespaces.Use CanonicalNamespaces for that.&$namespaces:Array of namespaces indexed by their numbers 'LanguageGetSpecialPageAliases':DEPRECATED!Use $specialPageAliases in a file listed in $wgExtensionMessagesFiles instead.Use to define aliases of special pages names depending of the language &$specialPageAliases:associative array of magic words synonyms $lang:language code(string) 'LanguageGetTranslatedLanguageNames':Provide translated language names.&$names:array of language code=> language name $code:language of the preferred translations 'LanguageLinks':Manipulate a page's language links.This is called in various places to allow extensions to define the effective language links for a page.$title:The page's Title.&$links:Array with elements of the form"language:title"in the order that they will be output.&$linkFlags:Associative array mapping prefixed links to arrays of flags.Currently unused, but planned to provide support for marking individual language links in the UI, e.g.for featured articles. 'LanguageSelector':Hook to change the language selector available on a page.$out:The output page.$cssClassName:CSS class name of the language selector. 'LinkBegin':DEPRECATED!Use HtmlPageLinkRendererBegin instead.Used when generating internal and interwiki links in Linker::link(), before processing starts.Return false to skip default processing and return $ret.See documentation for Linker::link() for details on the expected meanings of parameters.$skin:the Skin object $target:the Title that the link is pointing to &$html:the contents that the< a > tag should have(raw HTML) $result
Definition: hooks.txt:1971
if($line===false) $args
Definition: cdb.php:64
const ID_FALLBACK
Tells escapeUrlForHtml() to encode the ID using the fallback encoding, or return false if no fallback...
Definition: Sanitizer.php:72
static decodeCharReferences($text)
Decode any character references, numeric or named entities, in the text and return a UTF-8 string...
Definition: Sanitizer.php:1649
static validateCodepoint($codepoint)
Returns true if a given Unicode codepoint is a valid character in both HTML5 and XML.
Definition: Sanitizer.php:1630
const EVIL_URI_PATTERN
Blacklist for evil uris like javascript: WARNING: DO NOT use this in any place that actually requires...
Definition: Sanitizer.php:56
static escapeIdForExternalInterwiki($id)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid URL...
Definition: Sanitizer.php:1308
const ELEMENT_BITS_REGEX
Acceptable tag name charset from HTML5 parsing spec https://www.w3.org/TR/html5/syntax.html#tag-open-state.
Definition: Sanitizer.php:46
Unicode normalization routines for working with UTF-8 strings.
Definition: UtfNormal.php:48
static decodeChar($codepoint)
Return UTF-8 string for a codepoint if that is a valid character reference, otherwise U+FFFD REPLACEM...
Definition: Sanitizer.php:1706
static normalizeSectionNameWhitespace($section)
Normalizes whitespace in a section name, such as might be returned by Parser::stripSectionName(), for use in the id's that are used for section links.
Definition: Sanitizer.php:1530
static delimiterReplace($startDelim, $endDelim, $replace, $subject, $flags= '')
Perform an operation equivalent to preg_replace() with flags.
static $htmlEntities
List of all named character entities defined in HTML 4.01 https://www.w3.org/TR/html4/sgml/entities.html As well as ' which is only defined starting in XHTML1.
Definition: Sanitizer.php:79
static attributeWhitelist($element)
Fetch the whitelist of acceptable attributes for a given element name.
Definition: Sanitizer.php:1739
static escapeHtmlAllowEntities($html)
Given HTML input, escape with htmlspecialchars but un-escape entities.
Definition: Sanitizer.php:1410
static validateTag($params, $element)
Takes attribute names and values for a tag and the tag name and validates that the tag is allowed to ...
Definition: Sanitizer.php:736
static mergeAttributes($a, $b)
Merge two sets of HTML attributes.
Definition: Sanitizer.php:910
const CHAR_REFS_REGEX
Regular expression to match various types of character references in Sanitizer::normalizeCharReferenc...
Definition: Sanitizer.php:36
static getRecognizedTagData($extratags=[], $removetags=[])
Return the various lists of recognized tags.
Definition: Sanitizer.php:380
$params
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped & $options
Definition: hooks.txt:1973
$wgFragmentMode
How should section IDs be encoded? This array can contain 1 or 2 elements, each of them can be one of...
static validateAttributes($attribs, $whitelist)
Take an array of attribute names and values and normalize or discard illegal values for the given whi...
Definition: Sanitizer.php:792
wfDeprecated($function, $version=false, $component=false, $callerOffset=2)
Throws a warning that $function is deprecated.
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses after processing & $attribs
Definition: hooks.txt:1973
static decodeCharReferencesAndNormalize($text)
Decode any character references, numeric or named entities, in the next and normalize the resulting s...
Definition: Sanitizer.php:1666
static run($event, array $args=[], $deprecatedVersion=null)
Call hook functions defined in Hooks::register and $wgHooks.
Definition: Hooks.php:203
static static $htmlEntityAliases
Character entity aliases accepted by MediaWiki.
Definition: Sanitizer.php:338
static escapeIdReferenceList($referenceString, $options=[])
Given a string containing a space delimited list of ids, escape each id to match ids escaped by the e...
Definition: Sanitizer.php:1365
Apache License January AND DISTRIBUTION Definitions License shall mean the terms and conditions for and distribution as defined by Sections through of this document Licensor shall mean the copyright owner or entity authorized by the copyright owner that is granting the License Legal Entity shall mean the union of the acting entity and all other entities that control are controlled by or are under common control with that entity For the purposes of this definition control direct or to cause the direction or management of such whether by contract or including but not limited to software source documentation and configuration files Object form shall mean any form resulting from mechanical transformation or translation of a Source including but not limited to compiled object generated and conversions to other media types Work shall mean the work of whether in Source or Object made available under the as indicated by a copyright notice that is included in or attached to the whether in Source or Object that is based or other modifications as a an original work of authorship For the purposes of this Derivative Works shall not include works that remain separable or merely the Work and Derivative Works thereof Contribution shall mean any work of including the original version of the Work and any modifications or additions to that Work or Derivative Works that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner For the purposes of this submitted means any form of or written communication sent to the Licensor or its including but not limited to communication on electronic mailing source code control and issue tracking systems that are managed by
static cleanUrlCallback($matches)
Definition: Sanitizer.php:2075
This document is intended to provide useful advice for parties seeking to redistribute MediaWiki to end users It s targeted particularly at maintainers for Linux since it s been observed that distribution packages of MediaWiki often break We ve consistently had to recommend that users seeking support use official tarballs instead of their distribution s and this often solves whatever problem the user is having It would be nice if this could such as
Definition: distributors.txt:9
this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist Do not use this to implement individual filters if they are compatible with the ChangesListFilter and ChangesListFilterGroup structure use sub classes of those in conjunction with the ChangesListSpecialPageStructuredFilters hook This hook can be used to implement filters that do not implement that or custom behavior that is not an individual filter e g Watchlist and Watchlist you will want to construct new ChangesListBooleanFilter or ChangesListStringOptionsFilter objects When constructing them
Definition: hooks.txt:991
usually copyright or history_copyright This message must be in HTML not wikitext if the section is included from a template $section
Definition: hooks.txt:2997
static armorLinksCallback($matches)
Regex replace callback for armoring links against further processing.
Definition: Sanitizer.php:1424
static escapeId($id, $options=[])
Given a value, escape it so that it can be used in an id attribute and return it. ...
Definition: Sanitizer.php:1212
wfUrlProtocols($includeProtocolRelative=true)
Returns a regular expression of url protocols.
static normalizeCss($value)
Normalize CSS into a format we can easily search for hostile input.
Definition: Sanitizer.php:932
const XMLNS_ATTRIBUTE_PATTERN
Definition: Sanitizer.php:57
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency which acts as the top level factory for services in MediaWiki which can be used to gain access to default instances of various services MediaWikiServices however also allows new services to be defined and default services to be redefined Services are defined or redefined by providing a callback the instantiator that will return a new instance of the service When it will create an instance of MediaWikiServices and populate it with the services defined in the files listed by thereby bootstrapping the DI framework Per $wgServiceWiringFiles lists includes ServiceWiring php
Definition: injection.txt:35
static escapeIdForAttribute($id, $mode=self::ID_PRIMARY)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid HTM...
Definition: Sanitizer.php:1258
static removeHTMLtags($text, $processCallback=null, $args=[], $extratags=[], $removetags=[], $warnCallback=null)
Cleans up HTML, removes dangerous tags and attributes, and removes HTML comments. ...
Definition: Sanitizer.php:477
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if so it s not worth the trouble Since there is a job queue in the jobs table
Definition: deferred.txt:11
static normalizeCharReferences($text)
Ensure that any entities and character references are legal for XML and XHTML specifically.
Definition: Sanitizer.php:1549
static escapeIdForLink($id)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid URL...
Definition: Sanitizer.php:1285
this class mediates it Skin Encapsulates a look and feel for the wiki All of the functions that render HTML and make choices about how to render it are here and are called from various other places when and is meant to be subclassed with other skins that may override some of its functions The User object contains a reference to a and so rather than having a global skin object we just rely on the global User and get the skin with $wgUser and also has some character encoding functions and other locale stuff The current user interface language is instantiated as and the local content language as $wgContLang
Definition: design.txt:56
$wgExperimentalHtmlIds
Abandoned experiment with HTML5-style ID escaping.
Allows to change the fields on the form that will be generated $name
Definition: hooks.txt:302
static removeHTMLcomments($text)
Remove '', and everything between.
Definition: Sanitizer.php:690
static getAttribsRegex()
Regular expression to match HTML/XML attribute pairs within a tag.
Definition: Sanitizer.php:355
codepointToUtf8($codepoint)
Return UTF-8 sequence for a given Unicode code point.
static validateEmail($addr)
Does a string look like an e-mail address?
Definition: Sanitizer.php:2107
static checkCss($value)
Pick apart some CSS and check it for forbidden or unsafe structures.
Definition: Sanitizer.php:1039
static stripAllTags($html)
Take a fragment of (potentially invalid) HTML and return a version with any tags removed, encoded as plain text.
Definition: Sanitizer.php:1983
static getTagAttributeCallback($set)
Pick the appropriate attribute value from a match set from the attribs regex matches.
Definition: Sanitizer.php:1491
</td >< td > &</td >< td > t want your writing to be edited mercilessly and redistributed at will
static escapeIdInternal($id, $mode)
Helper for escapeIdFor*() functions.
Definition: Sanitizer.php:1323
this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that probably a stub it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output modifiable modifiable after all normalizations have been except for the $wgMaxImageArea check set to true or false to override the $wgMaxImageArea check result gives extension the possibility to transform it themselves $handler
Definition: hooks.txt:784
static decodeEntity($name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the UTF-8 encoding of that chara...
Definition: Sanitizer.php:1722
static safeEncodeAttribute($text)
Encode an attribute value for HTML tags, with extra armoring against further wiki processing...
Definition: Sanitizer.php:1150
static configuration should be added through ResourceLoaderGetConfigVars instead & $vars
Definition: hooks.txt:2206
static encodeAttribute($text)
Encode an attribute value for HTML output.
Definition: Sanitizer.php:1129
$matches