MediaWiki  master
Sanitizer.php
Go to the documentation of this file.
1 <?php
28 
33 class Sanitizer {
39  '/&([A-Za-z0-9\x80-\xff]+);
40  |&\#([0-9]+);
41  |&\#[xX]([0-9A-Fa-f]+);
42  |(&)/x';
43 
48  const ELEMENT_BITS_REGEX = '!^(/?)([A-Za-z][^\t\n\v />\0]*+)([^>]*?)(/?>)([^<]*)$!';
49 
58  const EVIL_URI_PATTERN = '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i';
59  const XMLNS_ATTRIBUTE_PATTERN = "/^xmlns:[:A-Z_a-z-.0-9]+$/";
60 
66  const ID_PRIMARY = 0;
67 
74  const ID_FALLBACK = 1;
75 
81  private static $htmlEntities = [
82  'Aacute' => 193,
83  'aacute' => 225,
84  'Acirc' => 194,
85  'acirc' => 226,
86  'acute' => 180,
87  'AElig' => 198,
88  'aelig' => 230,
89  'Agrave' => 192,
90  'agrave' => 224,
91  'alefsym' => 8501,
92  'Alpha' => 913,
93  'alpha' => 945,
94  'amp' => 38,
95  'and' => 8743,
96  'ang' => 8736,
97  'apos' => 39, // New in XHTML & HTML 5; avoid in output for compatibility with IE.
98  'Aring' => 197,
99  'aring' => 229,
100  'asymp' => 8776,
101  'Atilde' => 195,
102  'atilde' => 227,
103  'Auml' => 196,
104  'auml' => 228,
105  'bdquo' => 8222,
106  'Beta' => 914,
107  'beta' => 946,
108  'brvbar' => 166,
109  'bull' => 8226,
110  'cap' => 8745,
111  'Ccedil' => 199,
112  'ccedil' => 231,
113  'cedil' => 184,
114  'cent' => 162,
115  'Chi' => 935,
116  'chi' => 967,
117  'circ' => 710,
118  'clubs' => 9827,
119  'cong' => 8773,
120  'copy' => 169,
121  'crarr' => 8629,
122  'cup' => 8746,
123  'curren' => 164,
124  'dagger' => 8224,
125  'Dagger' => 8225,
126  'darr' => 8595,
127  'dArr' => 8659,
128  'deg' => 176,
129  'Delta' => 916,
130  'delta' => 948,
131  'diams' => 9830,
132  'divide' => 247,
133  'Eacute' => 201,
134  'eacute' => 233,
135  'Ecirc' => 202,
136  'ecirc' => 234,
137  'Egrave' => 200,
138  'egrave' => 232,
139  'empty' => 8709,
140  'emsp' => 8195,
141  'ensp' => 8194,
142  'Epsilon' => 917,
143  'epsilon' => 949,
144  'equiv' => 8801,
145  'Eta' => 919,
146  'eta' => 951,
147  'ETH' => 208,
148  'eth' => 240,
149  'Euml' => 203,
150  'euml' => 235,
151  'euro' => 8364,
152  'exist' => 8707,
153  'fnof' => 402,
154  'forall' => 8704,
155  'frac12' => 189,
156  'frac14' => 188,
157  'frac34' => 190,
158  'frasl' => 8260,
159  'Gamma' => 915,
160  'gamma' => 947,
161  'ge' => 8805,
162  'gt' => 62,
163  'harr' => 8596,
164  'hArr' => 8660,
165  'hearts' => 9829,
166  'hellip' => 8230,
167  'Iacute' => 205,
168  'iacute' => 237,
169  'Icirc' => 206,
170  'icirc' => 238,
171  'iexcl' => 161,
172  'Igrave' => 204,
173  'igrave' => 236,
174  'image' => 8465,
175  'infin' => 8734,
176  'int' => 8747,
177  'Iota' => 921,
178  'iota' => 953,
179  'iquest' => 191,
180  'isin' => 8712,
181  'Iuml' => 207,
182  'iuml' => 239,
183  'Kappa' => 922,
184  'kappa' => 954,
185  'Lambda' => 923,
186  'lambda' => 955,
187  'lang' => 9001,
188  'laquo' => 171,
189  'larr' => 8592,
190  'lArr' => 8656,
191  'lceil' => 8968,
192  'ldquo' => 8220,
193  'le' => 8804,
194  'lfloor' => 8970,
195  'lowast' => 8727,
196  'loz' => 9674,
197  'lrm' => 8206,
198  'lsaquo' => 8249,
199  'lsquo' => 8216,
200  'lt' => 60,
201  'macr' => 175,
202  'mdash' => 8212,
203  'micro' => 181,
204  'middot' => 183,
205  'minus' => 8722,
206  'Mu' => 924,
207  'mu' => 956,
208  'nabla' => 8711,
209  'nbsp' => 160,
210  'ndash' => 8211,
211  'ne' => 8800,
212  'ni' => 8715,
213  'not' => 172,
214  'notin' => 8713,
215  'nsub' => 8836,
216  'Ntilde' => 209,
217  'ntilde' => 241,
218  'Nu' => 925,
219  'nu' => 957,
220  'Oacute' => 211,
221  'oacute' => 243,
222  'Ocirc' => 212,
223  'ocirc' => 244,
224  'OElig' => 338,
225  'oelig' => 339,
226  'Ograve' => 210,
227  'ograve' => 242,
228  'oline' => 8254,
229  'Omega' => 937,
230  'omega' => 969,
231  'Omicron' => 927,
232  'omicron' => 959,
233  'oplus' => 8853,
234  'or' => 8744,
235  'ordf' => 170,
236  'ordm' => 186,
237  'Oslash' => 216,
238  'oslash' => 248,
239  'Otilde' => 213,
240  'otilde' => 245,
241  'otimes' => 8855,
242  'Ouml' => 214,
243  'ouml' => 246,
244  'para' => 182,
245  'part' => 8706,
246  'permil' => 8240,
247  'perp' => 8869,
248  'Phi' => 934,
249  'phi' => 966,
250  'Pi' => 928,
251  'pi' => 960,
252  'piv' => 982,
253  'plusmn' => 177,
254  'pound' => 163,
255  'prime' => 8242,
256  'Prime' => 8243,
257  'prod' => 8719,
258  'prop' => 8733,
259  'Psi' => 936,
260  'psi' => 968,
261  'quot' => 34,
262  'radic' => 8730,
263  'rang' => 9002,
264  'raquo' => 187,
265  'rarr' => 8594,
266  'rArr' => 8658,
267  'rceil' => 8969,
268  'rdquo' => 8221,
269  'real' => 8476,
270  'reg' => 174,
271  'rfloor' => 8971,
272  'Rho' => 929,
273  'rho' => 961,
274  'rlm' => 8207,
275  'rsaquo' => 8250,
276  'rsquo' => 8217,
277  'sbquo' => 8218,
278  'Scaron' => 352,
279  'scaron' => 353,
280  'sdot' => 8901,
281  'sect' => 167,
282  'shy' => 173,
283  'Sigma' => 931,
284  'sigma' => 963,
285  'sigmaf' => 962,
286  'sim' => 8764,
287  'spades' => 9824,
288  'sub' => 8834,
289  'sube' => 8838,
290  'sum' => 8721,
291  'sup' => 8835,
292  'sup1' => 185,
293  'sup2' => 178,
294  'sup3' => 179,
295  'supe' => 8839,
296  'szlig' => 223,
297  'Tau' => 932,
298  'tau' => 964,
299  'there4' => 8756,
300  'Theta' => 920,
301  'theta' => 952,
302  'thetasym' => 977,
303  'thinsp' => 8201,
304  'THORN' => 222,
305  'thorn' => 254,
306  'tilde' => 732,
307  'times' => 215,
308  'trade' => 8482,
309  'Uacute' => 218,
310  'uacute' => 250,
311  'uarr' => 8593,
312  'uArr' => 8657,
313  'Ucirc' => 219,
314  'ucirc' => 251,
315  'Ugrave' => 217,
316  'ugrave' => 249,
317  'uml' => 168,
318  'upsih' => 978,
319  'Upsilon' => 933,
320  'upsilon' => 965,
321  'Uuml' => 220,
322  'uuml' => 252,
323  'weierp' => 8472,
324  'Xi' => 926,
325  'xi' => 958,
326  'Yacute' => 221,
327  'yacute' => 253,
328  'yen' => 165,
329  'Yuml' => 376,
330  'yuml' => 255,
331  'Zeta' => 918,
332  'zeta' => 950,
333  'zwj' => 8205,
334  'zwnj' => 8204
335  ];
336 
340  private static $htmlEntityAliases = [
341  'רלמ' => 'rlm',
342  'رلم' => 'rlm',
343  ];
344 
348  private static $attribsRegex;
349 
356  static function getAttribsRegex() {
357  if ( self::$attribsRegex === null ) {
358  $spaceChars = '\x09\x0a\x0c\x0d\x20';
359  $space = "[{$spaceChars}]";
360  $attrib = "[^{$spaceChars}\/>=]";
361  $attribFirst = "(?:{$attrib}|=)";
362  self::$attribsRegex =
363  "/({$attribFirst}{$attrib}*)
364  ($space*=$space*
365  (?:
366  # The attribute value: quoted or alone
367  \"([^\"]*)(?:\"|\$)
368  | '([^']*)(?:'|\$)
369  | (((?!$space|>).)*)
370  )
371  )?/sxu";
372  }
373  return self::$attribsRegex;
374  }
375 
379  private static $attribNameRegex;
380 
385  static function getAttribNameRegex() {
386  if ( self::$attribNameRegex === null ) {
387  $attribFirst = "[:_\p{L}\p{N}]";
388  $attrib = "[:_\.\-\p{L}\p{N}]";
389  self::$attribNameRegex = "/^({$attribFirst}{$attrib}*)$/sxu";
390  }
391  return self::$attribNameRegex;
392  }
393 
400  public static function getRecognizedTagData( $extratags = [], $removetags = [] ) {
401  global $wgAllowImageTag;
402 
403  static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
404  $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
405 
406  // Base our staticInitialised variable off of the global config state so that if the globals
407  // are changed (like in the screwed up test system) we will re-initialise the settings.
408  $globalContext = $wgAllowImageTag;
409  if ( !$staticInitialised || $staticInitialised != $globalContext ) {
410  $htmlpairsStatic = [ # Tags that must be closed
411  'b', 'bdi', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
412  'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
413  'strike', 'strong', 'tt', 'var', 'div', 'center',
414  'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
415  'ruby', 'rb', 'rp', 'rt', 'rtc', 'p', 'span', 'abbr', 'dfn',
416  'kbd', 'samp', 'data', 'time', 'mark'
417  ];
418  $htmlsingle = [
419  'br', 'wbr', 'hr', 'li', 'dt', 'dd', 'meta', 'link'
420  ];
421 
422  # Elements that cannot have close tags. This is (not coincidentally)
423  # also the list of tags for which the HTML 5 parsing algorithm
424  # requires you to "acknowledge the token's self-closing flag", i.e.
425  # a self-closing tag like <br/> is not an HTML 5 parse error only
426  # for this list.
427  $htmlsingleonly = [
428  'br', 'wbr', 'hr', 'meta', 'link'
429  ];
430 
431  $htmlnest = [ # Tags that can be nested--??
432  'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
433  'li', 'dl', 'dt', 'dd', 'font', 'big', 'small', 'sub', 'sup', 'span',
434  'var', 'kbd', 'samp', 'em', 'strong', 'q', 'ruby', 'bdo'
435  ];
436  $tabletags = [ # Can only appear inside table, we will close them
437  'td', 'th', 'tr',
438  ];
439  $htmllist = [ # Tags used by list
440  'ul', 'ol',
441  ];
442  $listtags = [ # Tags that can appear in a list
443  'li',
444  ];
445 
446  if ( $wgAllowImageTag ) {
447  $htmlsingle[] = 'img';
448  $htmlsingleonly[] = 'img';
449  }
450 
451  $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
452  $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
453 
454  # Convert them all to hashtables for faster lookup
455  $vars = [ 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
456  'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' ];
457  foreach ( $vars as $var ) {
458  $$var = array_flip( $$var );
459  }
460  $staticInitialised = $globalContext;
461  }
462 
463  # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
464  $extratags = array_flip( $extratags );
465  $removetags = array_flip( $removetags );
466  $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
467  $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ), $removetags );
468 
469  return [
470  'htmlpairs' => $htmlpairs,
471  'htmlsingle' => $htmlsingle,
472  'htmlsingleonly' => $htmlsingleonly,
473  'htmlnest' => $htmlnest,
474  'tabletags' => $tabletags,
475  'htmllist' => $htmllist,
476  'listtags' => $listtags,
477  'htmlsingleallowed' => $htmlsingleallowed,
478  'htmlelements' => $htmlelements,
479  ];
480  }
481 
497  public static function removeHTMLtags( $text, $processCallback = null,
498  $args = [], $extratags = [], $removetags = [], $warnCallback = null
499  ) {
500  $tagData = self::getRecognizedTagData( $extratags, $removetags );
501  $htmlpairs = $tagData['htmlpairs'];
502  $htmlsingle = $tagData['htmlsingle'];
503  $htmlsingleonly = $tagData['htmlsingleonly'];
504  $htmlnest = $tagData['htmlnest'];
505  $tabletags = $tagData['tabletags'];
506  $htmllist = $tagData['htmllist'];
507  $listtags = $tagData['listtags'];
508  $htmlsingleallowed = $tagData['htmlsingleallowed'];
509  $htmlelements = $tagData['htmlelements'];
510 
511  # Remove HTML comments
512  $text = self::removeHTMLcomments( $text );
513  $bits = explode( '<', $text );
514  $text = str_replace( '>', '&gt;', array_shift( $bits ) );
515  if ( !MWTidy::isEnabled() ) {
516  wfDeprecated( 'disabling tidy', '1.33' );
517  $tagstack = $tablestack = [];
518  foreach ( $bits as $x ) {
519  $regs = [];
520  # $slash: Does the current element start with a '/'?
521  # $t: Current element name
522  # $params: String between element name and >
523  # $brace: Ending '>' or '/>'
524  # $rest: Everything until the next element of $bits
525  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
526  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
527  } else {
528  $slash = $t = $params = $brace = $rest = null;
529  }
530 
531  $badtag = false;
532  $t = strtolower( $t );
533  if ( isset( $htmlelements[$t] ) ) {
534  # Check our stack
535  if ( $slash && isset( $htmlsingleonly[$t] ) ) {
536  $badtag = true;
537  } elseif ( $slash ) {
538  # Closing a tag... is it the one we just opened?
539  Wikimedia\suppressWarnings();
540  $ot = array_pop( $tagstack );
541  Wikimedia\restoreWarnings();
542 
543  if ( $ot != $t ) {
544  if ( isset( $htmlsingleallowed[$ot] ) ) {
545  # Pop all elements with an optional close tag
546  # and see if we find a match below them
547  $optstack = [];
548  array_push( $optstack, $ot );
549  Wikimedia\suppressWarnings();
550  $ot = array_pop( $tagstack );
551  Wikimedia\restoreWarnings();
552  while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
553  array_push( $optstack, $ot );
554  Wikimedia\suppressWarnings();
555  $ot = array_pop( $tagstack );
556  Wikimedia\restoreWarnings();
557  }
558  if ( $t != $ot ) {
559  # No match. Push the optional elements back again
560  $badtag = true;
561  Wikimedia\suppressWarnings();
562  $ot = array_pop( $optstack );
563  Wikimedia\restoreWarnings();
564  while ( $ot ) {
565  array_push( $tagstack, $ot );
566  Wikimedia\suppressWarnings();
567  $ot = array_pop( $optstack );
568  Wikimedia\restoreWarnings();
569  }
570  }
571  } else {
572  Wikimedia\suppressWarnings();
573  array_push( $tagstack, $ot );
574  Wikimedia\restoreWarnings();
575 
576  # <li> can be nested in <ul> or <ol>, skip those cases:
577  if ( !isset( $htmllist[$ot] ) || !isset( $listtags[$t] ) ) {
578  $badtag = true;
579  }
580  }
581  } elseif ( $t == 'table' ) {
582  $tagstack = array_pop( $tablestack );
583  }
584  $newparams = '';
585  } else {
586  # Keep track for later
587  if ( isset( $tabletags[$t] ) && !in_array( 'table', $tagstack ) ) {
588  $badtag = true;
589  } elseif ( in_array( $t, $tagstack ) && !isset( $htmlnest[$t] ) ) {
590  $badtag = true;
591  #  Is it a self closed htmlpair ? (T7487)
592  } elseif ( $brace == '/>' && isset( $htmlpairs[$t] ) ) {
593  // Eventually we'll just remove the self-closing
594  // slash, in order to be consistent with HTML5
595  // semantics.
596  // $brace = '>';
597  // For now, let's just warn authors to clean up.
598  if ( is_callable( $warnCallback ) ) {
599  call_user_func_array( $warnCallback, [ 'deprecated-self-close-category' ] );
600  }
601  $badtag = true;
602  } elseif ( isset( $htmlsingleonly[$t] ) ) {
603  # Hack to force empty tag for unclosable elements
604  $brace = '/>';
605  } elseif ( isset( $htmlsingle[$t] ) ) {
606  # Hack to not close $htmlsingle tags
607  $brace = null;
608  # Still need to push this optionally-closed tag to
609  # the tag stack so that we can match end tags
610  # instead of marking them as bad.
611  array_push( $tagstack, $t );
612  } elseif ( isset( $tabletags[$t] ) && in_array( $t, $tagstack ) ) {
613  // New table tag but forgot to close the previous one
614  $text .= "</$t>";
615  } else {
616  if ( $t == 'table' ) {
617  array_push( $tablestack, $tagstack );
618  $tagstack = [];
619  }
620  array_push( $tagstack, $t );
621  }
622 
623  # Replace any variables or template parameters with
624  # plaintext results.
625  if ( is_callable( $processCallback ) ) {
626  call_user_func_array( $processCallback, [ &$params, $args ] );
627  }
628 
629  if ( !self::validateTag( $params, $t ) ) {
630  $badtag = true;
631  }
632 
633  # Strip non-approved attributes from the tag
634  $newparams = self::fixTagAttributes( $params, $t );
635  }
636  if ( !$badtag ) {
637  $rest = str_replace( '>', '&gt;', $rest );
638  $close = ( $brace == '/>' && !$slash ) ? ' /' : '';
639  $text .= "<$slash$t$newparams$close>$rest";
640  continue;
641  }
642  }
643  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
644  }
645  # Close off any remaining tags
646  while ( is_array( $tagstack ) && ( $t = array_pop( $tagstack ) ) ) {
647  $text .= "</$t>\n";
648  if ( $t == 'table' ) {
649  $tagstack = array_pop( $tablestack );
650  }
651  }
652  } else {
653  # this might be possible using tidy itself
654  foreach ( $bits as $x ) {
655  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
656  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
657 
658  $badtag = false;
659  $t = strtolower( $t );
660  if ( isset( $htmlelements[$t] ) ) {
661  if ( is_callable( $processCallback ) ) {
662  call_user_func_array( $processCallback, [ &$params, $args ] );
663  }
664 
665  if ( $brace == '/>' && !( isset( $htmlsingle[$t] ) || isset( $htmlsingleonly[$t] ) ) ) {
666  // Eventually we'll just remove the self-closing
667  // slash, in order to be consistent with HTML5
668  // semantics.
669  // $brace = '>';
670  // For now, let's just warn authors to clean up.
671  if ( is_callable( $warnCallback ) ) {
672  call_user_func_array( $warnCallback, [ 'deprecated-self-close-category' ] );
673  }
674  }
675  if ( !self::validateTag( $params, $t ) ) {
676  $badtag = true;
677  }
678 
679  $newparams = self::fixTagAttributes( $params, $t );
680  if ( !$badtag ) {
681  if ( $brace === '/>' && !isset( $htmlsingleonly[$t] ) ) {
682  # Interpret self-closing tags as empty tags even when
683  # HTML 5 would interpret them as start tags. Such input
684  # is commonly seen on Wikimedia wikis with this intention.
685  $brace = "></$t>";
686  }
687 
688  $rest = str_replace( '>', '&gt;', $rest );
689  $text .= "<$slash$t$newparams$brace$rest";
690  continue;
691  }
692  }
693  }
694  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
695  }
696  }
697  return $text;
698  }
699 
709  public static function removeHTMLcomments( $text ) {
710  while ( ( $start = strpos( $text, '<!--' ) ) !== false ) {
711  $end = strpos( $text, '-->', $start + 4 );
712  if ( $end === false ) {
713  # Unterminated comment; bail out
714  break;
715  }
716 
717  $end += 3;
718 
719  # Trim space and newline if the comment is both
720  # preceded and followed by a newline
721  $spaceStart = max( $start - 1, 0 );
722  $spaceLen = $end - $spaceStart;
723  while ( substr( $text, $spaceStart, 1 ) === ' ' && $spaceStart > 0 ) {
724  $spaceStart--;
725  $spaceLen++;
726  }
727  while ( substr( $text, $spaceStart + $spaceLen, 1 ) === ' ' ) {
728  $spaceLen++;
729  }
730  if ( substr( $text, $spaceStart, 1 ) === "\n"
731  && substr( $text, $spaceStart + $spaceLen, 1 ) === "\n" ) {
732  # Remove the comment, leading and trailing
733  # spaces, and leave only one newline.
734  $text = substr_replace( $text, "\n", $spaceStart, $spaceLen + 1 );
735  } else {
736  # Remove just the comment.
737  $text = substr_replace( $text, '', $start, $end - $start );
738  }
739  }
740  return $text;
741  }
742 
755  static function validateTag( $params, $element ) {
756  $params = self::decodeTagAttributes( $params );
757 
758  if ( $element == 'meta' || $element == 'link' ) {
759  if ( !isset( $params['itemprop'] ) ) {
760  // <meta> and <link> must have an itemprop="" otherwise they are not valid or safe in content
761  return false;
762  }
763  if ( $element == 'meta' && !isset( $params['content'] ) ) {
764  // <meta> must have a content="" for the itemprop
765  return false;
766  }
767  if ( $element == 'link' && !isset( $params['href'] ) ) {
768  // <link> must have an associated href=""
769  return false;
770  }
771  }
772 
773  return true;
774  }
775 
791  static function validateTagAttributes( $attribs, $element ) {
792  return self::validateAttributes( $attribs,
793  self::attributeWhitelist( $element ) );
794  }
795 
811  static function validateAttributes( $attribs, $whitelist ) {
812  $whitelist = array_flip( $whitelist );
813  $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
814 
815  $out = [];
816  foreach ( $attribs as $attribute => $value ) {
817  # Allow XML namespace declaration to allow RDFa
818  if ( preg_match( self::XMLNS_ATTRIBUTE_PATTERN, $attribute ) ) {
819  if ( !preg_match( self::EVIL_URI_PATTERN, $value ) ) {
820  $out[$attribute] = $value;
821  }
822 
823  continue;
824  }
825 
826  # Allow any attribute beginning with "data-"
827  # However:
828  # * Disallow data attributes used by MediaWiki code
829  # * Ensure that the attribute is not namespaced by banning
830  # colons.
831  if ( !preg_match( '/^data-[^:]*$/i', $attribute )
832  && !isset( $whitelist[$attribute] )
833  || self::isReservedDataAttribute( $attribute )
834  ) {
835  continue;
836  }
837 
838  # Strip javascript "expression" from stylesheets.
839  # https://msdn.microsoft.com/en-us/library/ms537634.aspx
840  if ( $attribute == 'style' ) {
841  $value = self::checkCss( $value );
842  }
843 
844  # Escape HTML id attributes
845  if ( $attribute === 'id' ) {
846  $value = self::escapeIdForAttribute( $value, self::ID_PRIMARY );
847  }
848 
849  # Escape HTML id reference lists
850  if ( $attribute === 'aria-describedby'
851  || $attribute === 'aria-flowto'
852  || $attribute === 'aria-labelledby'
853  || $attribute === 'aria-owns'
854  ) {
855  $value = self::escapeIdReferenceList( $value );
856  }
857 
858  // RDFa and microdata properties allow URLs, URIs and/or CURIs.
859  // Check them for sanity.
860  if ( $attribute === 'rel' || $attribute === 'rev'
861  # RDFa
862  || $attribute === 'about' || $attribute === 'property'
863  || $attribute === 'resource' || $attribute === 'datatype'
864  || $attribute === 'typeof'
865  # HTML5 microdata
866  || $attribute === 'itemid' || $attribute === 'itemprop'
867  || $attribute === 'itemref' || $attribute === 'itemscope'
868  || $attribute === 'itemtype'
869  ) {
870  // Paranoia. Allow "simple" values but suppress javascript
871  if ( preg_match( self::EVIL_URI_PATTERN, $value ) ) {
872  continue;
873  }
874  }
875 
876  # NOTE: even though elements using href/src are not allowed directly, supply
877  # validation code that can be used by tag hook handlers, etc
878  if ( $attribute === 'href' || $attribute === 'src' || $attribute === 'poster' ) {
879  if ( !preg_match( $hrefExp, $value ) ) {
880  continue; // drop any href or src attributes not using an allowed protocol.
881  // NOTE: this also drops all relative URLs
882  }
883  }
884 
885  // If this attribute was previously set, override it.
886  // Output should only have one attribute of each name.
887  $out[$attribute] = $value;
888  }
889 
890  # itemtype, itemid, itemref don't make sense without itemscope
891  if ( !array_key_exists( 'itemscope', $out ) ) {
892  unset( $out['itemtype'] );
893  unset( $out['itemid'] );
894  unset( $out['itemref'] );
895  }
896  # TODO: Strip itemprop if we aren't descendants of an itemscope or pointed to by an itemref.
897 
898  return $out;
899  }
900 
908  public static function isReservedDataAttribute( $attr ) {
909  // data-ooui is reserved for ooui.
910  // data-mw and data-parsoid are reserved for parsoid.
911  // data-mw-<name here> is reserved for extensions (or core) if
912  // they need to communicate some data to the client and want to be
913  // sure that it isn't coming from an untrusted user.
914  // We ignore the possibility of namespaces since user-generated HTML
915  // can't use them anymore.
916  return (bool)preg_match( '/^data-(ooui|mw|parsoid)/i', $attr );
917  }
918 
929  static function mergeAttributes( $a, $b ) {
930  $out = array_merge( $a, $b );
931  if ( isset( $a['class'] ) && isset( $b['class'] )
932  && is_string( $a['class'] ) && is_string( $b['class'] )
933  && $a['class'] !== $b['class']
934  ) {
935  $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
936  -1, PREG_SPLIT_NO_EMPTY );
937  $out['class'] = implode( ' ', array_unique( $classes ) );
938  }
939  return $out;
940  }
941 
951  public static function normalizeCss( $value ) {
952  // Decode character references like &#123;
953  $value = self::decodeCharReferences( $value );
954 
955  // Decode escape sequences and line continuation
956  // See the grammar in the CSS 2 spec, appendix D.
957  // This has to be done AFTER decoding character references.
958  // This means it isn't possible for this function to return
959  // unsanitized escape sequences. It is possible to manufacture
960  // input that contains character references that decode to
961  // escape sequences that decode to character references, but
962  // it's OK for the return value to contain character references
963  // because the caller is supposed to escape those anyway.
964  static $decodeRegex;
965  if ( !$decodeRegex ) {
966  $space = '[\\x20\\t\\r\\n\\f]';
967  $nl = '(?:\\n|\\r\\n|\\r|\\f)';
968  $backslash = '\\\\';
969  $decodeRegex = "/ $backslash
970  (?:
971  ($nl) | # 1. Line continuation
972  ([0-9A-Fa-f]{1,6})$space? | # 2. character number
973  (.) | # 3. backslash cancelling special meaning
974  () | # 4. backslash at end of string
975  )/xu";
976  }
977  $value = preg_replace_callback( $decodeRegex,
978  [ __CLASS__, 'cssDecodeCallback' ], $value );
979 
980  // Normalize Halfwidth and Fullwidth Unicode block that IE6 might treat as ascii
981  $value = preg_replace_callback(
982  '/[!-[]-z]/u', // U+FF01 to U+FF5A, excluding U+FF3C (T60088)
983  function ( $matches ) {
984  $cp = UtfNormal\Utils::utf8ToCodepoint( $matches[0] );
985  if ( $cp === false ) {
986  return '';
987  }
988  return chr( $cp - 65248 ); // ASCII range \x21-\x7A
989  },
990  $value
991  );
992 
993  // Convert more characters IE6 might treat as ascii
994  // U+0280, U+0274, U+207F, U+029F, U+026A, U+207D, U+208D
995  $value = str_replace(
996  [ 'ʀ', 'ɴ', 'ⁿ', 'ʟ', 'ɪ', '⁽', '₍' ],
997  [ 'r', 'n', 'n', 'l', 'i', '(', '(' ],
998  $value
999  );
1000 
1001  // Let the value through if it's nothing but a single comment, to
1002  // allow other functions which may reject it to pass some error
1003  // message through.
1004  if ( !preg_match( '! ^ \s* /\* [^*\\/]* \*/ \s* $ !x', $value ) ) {
1005  // Remove any comments; IE gets token splitting wrong
1006  // This must be done AFTER decoding character references and
1007  // escape sequences, because those steps can introduce comments
1008  // This step cannot introduce character references or escape
1009  // sequences, because it replaces comments with spaces rather
1010  // than removing them completely.
1011  $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value );
1012 
1013  // Remove anything after a comment-start token, to guard against
1014  // incorrect client implementations.
1015  $commentPos = strpos( $value, '/*' );
1016  if ( $commentPos !== false ) {
1017  $value = substr( $value, 0, $commentPos );
1018  }
1019  }
1020 
1021  // S followed by repeat, iteration, or prolonged sound marks,
1022  // which IE will treat as "ss"
1023  $value = preg_replace(
1024  '/s(?:
1025  \xE3\x80\xB1 | # U+3031
1026  \xE3\x82\x9D | # U+309D
1027  \xE3\x83\xBC | # U+30FC
1028  \xE3\x83\xBD | # U+30FD
1029  \xEF\xB9\xBC | # U+FE7C
1030  \xEF\xB9\xBD | # U+FE7D
1031  \xEF\xBD\xB0 # U+FF70
1032  )/ix',
1033  'ss',
1034  $value
1035  );
1036 
1037  return $value;
1038  }
1039 
1058  static function checkCss( $value ) {
1059  $value = self::normalizeCss( $value );
1060 
1061  // Reject problematic keywords and control characters
1062  if ( preg_match( '/[\000-\010\013\016-\037\177]/', $value ) ||
1063  strpos( $value, UtfNormal\Constants::UTF8_REPLACEMENT ) !== false ) {
1064  return '/* invalid control char */';
1065  } elseif ( preg_match(
1066  '! expression
1067  | filter\s*:
1068  | accelerator\s*:
1069  | -o-link\s*:
1070  | -o-link-source\s*:
1071  | -o-replace\s*:
1072  | url\s*\(
1073  | image\s*\(
1074  | image-set\s*\(
1075  | attr\s*\([^)]+[\s,]+url
1076  | var\s*\(
1077  !ix', $value ) ) {
1078  return '/* insecure input */';
1079  }
1080  return $value;
1081  }
1082 
1087  static function cssDecodeCallback( $matches ) {
1088  if ( $matches[1] !== '' ) {
1089  // Line continuation
1090  return '';
1091  } elseif ( $matches[2] !== '' ) {
1092  $char = UtfNormal\Utils::codepointToUtf8( hexdec( $matches[2] ) );
1093  } elseif ( $matches[3] !== '' ) {
1094  $char = $matches[3];
1095  } else {
1096  $char = '\\';
1097  }
1098  if ( $char == "\n" || $char == '"' || $char == "'" || $char == '\\' ) {
1099  // These characters need to be escaped in strings
1100  // Clean up the escape sequence to avoid parsing errors by clients
1101  return '\\' . dechex( ord( $char ) ) . ' ';
1102  } else {
1103  // Decode unnecessary escape
1104  return $char;
1105  }
1106  }
1107 
1129  static function fixTagAttributes( $text, $element, $sorted = false ) {
1130  if ( trim( $text ) == '' ) {
1131  return '';
1132  }
1133 
1134  $decoded = self::decodeTagAttributes( $text );
1135  $stripped = self::validateTagAttributes( $decoded, $element );
1136 
1137  if ( $sorted ) {
1138  ksort( $stripped );
1139  }
1140 
1141  return self::safeEncodeTagAttributes( $stripped );
1142  }
1143 
1149  static function encodeAttribute( $text ) {
1150  $encValue = htmlspecialchars( $text, ENT_QUOTES );
1151 
1152  // Whitespace is normalized during attribute decoding,
1153  // so if we've been passed non-spaces we must encode them
1154  // ahead of time or they won't be preserved.
1155  $encValue = strtr( $encValue, [
1156  "\n" => '&#10;',
1157  "\r" => '&#13;',
1158  "\t" => '&#9;',
1159  ] );
1160 
1161  return $encValue;
1162  }
1163 
1172  public static function armorFrenchSpaces( $text, $space = '&#160;' ) {
1173  // Replace $ with \$ and \ with \\
1174  $space = preg_replace( '#(?<!\\\\)(\\$|\\\\)#', '\\\\$1', $space );
1175  $fixtags = [
1176  # French spaces, last one Guillemet-left
1177  # only if there is something before the space
1178  # and a non-word character after the punctuation.
1179  '/(\S) (?=[?:;!%»›](?!\w))/u' => "\\1$space",
1180  # French spaces, Guillemet-right
1181  '/([«‹]) /u' => "\\1$space",
1182  ];
1183  return preg_replace( array_keys( $fixtags ), array_values( $fixtags ), $text );
1184  }
1185 
1192  static function safeEncodeAttribute( $text ) {
1193  $encValue = self::encodeAttribute( $text );
1194 
1195  # Templates and links may be expanded in later parsing,
1196  # creating invalid or dangerous output. Suppress this.
1197  $encValue = strtr( $encValue, [
1198  '<' => '&lt;', // This should never happen,
1199  '>' => '&gt;', // we've received invalid input
1200  '"' => '&quot;', // which should have been escaped.
1201  '{' => '&#123;',
1202  '}' => '&#125;', // prevent unpaired language conversion syntax
1203  '[' => '&#91;',
1204  ']' => '&#93;',
1205  "''" => '&#39;&#39;',
1206  'ISBN' => '&#73;SBN',
1207  'RFC' => '&#82;FC',
1208  'PMID' => '&#80;MID',
1209  '|' => '&#124;',
1210  '__' => '&#95;_',
1211  ] );
1212 
1213  # Armor against French spaces detection (T5158)
1214  $encValue = self::armorFrenchSpaces( $encValue, '&#32;' );
1215 
1216  # Stupid hack
1217  $encValue = preg_replace_callback(
1218  '/((?i)' . wfUrlProtocols() . ')/',
1219  function ( $matches ) {
1220  return str_replace( ':', '&#58;', $matches[1] );
1221  },
1222  $encValue );
1223  return $encValue;
1224  }
1225 
1254  static function escapeId( $id, $options = [] ) {
1255  $options = (array)$options;
1256 
1257  // HTML4-style escaping
1258  static $replace = [
1259  '%3A' => ':',
1260  '%' => '.'
1261  ];
1262 
1263  $id = urlencode( strtr( $id, ' ', '_' ) );
1264  $id = strtr( $id, $replace );
1265 
1266  if ( !preg_match( '/^[a-zA-Z]/', $id ) && !in_array( 'noninitial', $options ) ) {
1267  // Initial character must be a letter!
1268  $id = "x$id";
1269  }
1270  return $id;
1271  }
1272 
1288  public static function escapeIdForAttribute( $id, $mode = self::ID_PRIMARY ) {
1289  global $wgFragmentMode;
1290 
1291  if ( !isset( $wgFragmentMode[$mode] ) ) {
1292  if ( $mode === self::ID_PRIMARY ) {
1293  throw new UnexpectedValueException( '$wgFragmentMode is configured with no primary mode' );
1294  }
1295  return false;
1296  }
1297 
1298  $internalMode = $wgFragmentMode[$mode];
1299 
1300  return self::escapeIdInternal( $id, $internalMode );
1301  }
1302 
1315  public static function escapeIdForLink( $id ) {
1316  global $wgFragmentMode;
1317 
1318  if ( !isset( $wgFragmentMode[self::ID_PRIMARY] ) ) {
1319  throw new UnexpectedValueException( '$wgFragmentMode is configured with no primary mode' );
1320  }
1321 
1322  $mode = $wgFragmentMode[self::ID_PRIMARY];
1323 
1324  $id = self::escapeIdInternal( $id, $mode );
1325 
1326  return $id;
1327  }
1328 
1338  public static function escapeIdForExternalInterwiki( $id ) {
1340 
1341  $id = self::escapeIdInternal( $id, $wgExternalInterwikiFragmentMode );
1342 
1343  return $id;
1344  }
1345 
1353  private static function escapeIdInternal( $id, $mode ) {
1354  switch ( $mode ) {
1355  case 'html5':
1356  $id = str_replace( ' ', '_', $id );
1357  break;
1358  case 'legacy':
1359  // This corresponds to 'noninitial' mode of the old escapeId()
1360  static $replace = [
1361  '%3A' => ':',
1362  '%' => '.'
1363  ];
1364 
1365  $id = urlencode( str_replace( ' ', '_', $id ) );
1366  $id = strtr( $id, $replace );
1367  break;
1368  default:
1369  throw new InvalidArgumentException( "Invalid mode '$mode' passed to '" . __METHOD__ );
1370  }
1371 
1372  return $id;
1373  }
1374 
1384  public static function escapeIdReferenceList( $referenceString ) {
1385  # Explode the space delimited list string into an array of tokens
1386  $references = preg_split( '/\s+/', "{$referenceString}", -1, PREG_SPLIT_NO_EMPTY );
1387 
1388  # Escape each token as an id
1389  foreach ( $references as &$ref ) {
1390  $ref = self::escapeIdForAttribute( $ref );
1391  }
1392 
1393  # Merge the array back to a space delimited list string
1394  # If the array is empty, the result will be an empty string ('')
1395  $referenceString = implode( ' ', $references );
1396 
1397  return $referenceString;
1398  }
1399 
1411  static function escapeClass( $class ) {
1412  // Convert ugly stuff to underscores and kill underscores in ugly places
1413  return rtrim( preg_replace(
1414  [ '/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/', '/_+/' ],
1415  '_',
1416  $class ), '_' );
1417  }
1418 
1426  static function escapeHtmlAllowEntities( $html ) {
1427  $html = self::decodeCharReferences( $html );
1428  # It seems wise to escape ' as well as ", as a matter of course. Can't
1429  # hurt. Use ENT_SUBSTITUTE so that incorrectly truncated multibyte characters
1430  # don't cause the entire string to disappear.
1431  $html = htmlspecialchars( $html, ENT_QUOTES | ENT_SUBSTITUTE );
1432  return $html;
1433  }
1434 
1443  public static function decodeTagAttributes( $text ) {
1444  if ( trim( $text ) == '' ) {
1445  return [];
1446  }
1447 
1448  $pairs = [];
1449  if ( !preg_match_all(
1450  self::getAttribsRegex(),
1451  $text,
1452  $pairs,
1453  PREG_SET_ORDER ) ) {
1454  return [];
1455  }
1456 
1457  $attribs = [];
1458  foreach ( $pairs as $set ) {
1459  $attribute = strtolower( $set[1] );
1460 
1461  // Filter attribute names with unacceptable characters
1462  if ( !preg_match( self::getAttribNameRegex(), $attribute ) ) {
1463  continue;
1464  }
1465 
1466  $value = self::getTagAttributeCallback( $set );
1467 
1468  // Normalize whitespace
1469  $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1470  $value = trim( $value );
1471 
1472  // Decode character references
1473  $attribs[$attribute] = self::decodeCharReferences( $value );
1474  }
1475  return $attribs;
1476  }
1477 
1485  public static function safeEncodeTagAttributes( $assoc_array ) {
1486  $attribs = [];
1487  foreach ( $assoc_array as $attribute => $value ) {
1488  $encAttribute = htmlspecialchars( $attribute );
1489  $encValue = self::safeEncodeAttribute( $value );
1490 
1491  $attribs[] = "$encAttribute=\"$encValue\"";
1492  }
1493  return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : '';
1494  }
1495 
1504  private static function getTagAttributeCallback( $set ) {
1505  if ( isset( $set[5] ) ) {
1506  # No quotes.
1507  return $set[5];
1508  } elseif ( isset( $set[4] ) ) {
1509  # Single-quoted
1510  return $set[4];
1511  } elseif ( isset( $set[3] ) ) {
1512  # Double-quoted
1513  return $set[3];
1514  } elseif ( !isset( $set[2] ) ) {
1515  # In XHTML, attributes must have a value so return an empty string.
1516  # See "Empty attribute syntax",
1517  # https://www.w3.org/TR/html5/syntax.html#syntax-attribute-name
1518  return "";
1519  } else {
1520  throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1521  }
1522  }
1523 
1528  private static function normalizeWhitespace( $text ) {
1529  return trim( preg_replace(
1530  '/(?:\r\n|[\x20\x0d\x0a\x09])+/',
1531  ' ',
1532  $text ) );
1533  }
1534 
1544  return trim( preg_replace( '/[ _]+/', ' ', $section ) );
1545  }
1546 
1562  static function normalizeCharReferences( $text ) {
1563  return preg_replace_callback(
1564  self::CHAR_REFS_REGEX,
1565  [ self::class, 'normalizeCharReferencesCallback' ],
1566  $text );
1567  }
1568 
1574  $ret = null;
1575  if ( $matches[1] != '' ) {
1576  $ret = self::normalizeEntity( $matches[1] );
1577  } elseif ( $matches[2] != '' ) {
1578  $ret = self::decCharReference( $matches[2] );
1579  } elseif ( $matches[3] != '' ) {
1580  $ret = self::hexCharReference( $matches[3] );
1581  }
1582  if ( is_null( $ret ) ) {
1583  return htmlspecialchars( $matches[0] );
1584  } else {
1585  return $ret;
1586  }
1587  }
1588 
1599  static function normalizeEntity( $name ) {
1600  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1601  return '&' . self::$htmlEntityAliases[$name] . ';';
1602  } elseif ( in_array( $name, [ 'lt', 'gt', 'amp', 'quot' ] ) ) {
1603  return "&$name;";
1604  } elseif ( isset( self::$htmlEntities[$name] ) ) {
1605  return '&#' . self::$htmlEntities[$name] . ';';
1606  } else {
1607  return "&amp;$name;";
1608  }
1609  }
1610 
1615  static function decCharReference( $codepoint ) {
1616  $point = intval( $codepoint );
1617  if ( self::validateCodepoint( $point ) ) {
1618  return sprintf( '&#%d;', $point );
1619  } else {
1620  return null;
1621  }
1622  }
1623 
1628  static function hexCharReference( $codepoint ) {
1629  $point = hexdec( $codepoint );
1630  if ( self::validateCodepoint( $point ) ) {
1631  return sprintf( '&#x%x;', $point );
1632  } else {
1633  return null;
1634  }
1635  }
1636 
1643  private static function validateCodepoint( $codepoint ) {
1644  # U+000C is valid in HTML5 but not allowed in XML.
1645  # U+000D is valid in XML but not allowed in HTML5.
1646  # U+007F - U+009F are disallowed in HTML5 (control characters).
1647  return $codepoint == 0x09
1648  || $codepoint == 0x0a
1649  || ( $codepoint >= 0x20 && $codepoint <= 0x7e )
1650  || ( $codepoint >= 0xa0 && $codepoint <= 0xd7ff )
1651  || ( $codepoint >= 0xe000 && $codepoint <= 0xfffd )
1652  || ( $codepoint >= 0x10000 && $codepoint <= 0x10ffff );
1653  }
1654 
1662  public static function decodeCharReferences( $text ) {
1663  return preg_replace_callback(
1664  self::CHAR_REFS_REGEX,
1665  [ self::class, 'decodeCharReferencesCallback' ],
1666  $text );
1667  }
1668 
1679  public static function decodeCharReferencesAndNormalize( $text ) {
1680  $text = preg_replace_callback(
1681  self::CHAR_REFS_REGEX,
1682  [ self::class, 'decodeCharReferencesCallback' ],
1683  $text,
1684  -1, //limit
1685  $count
1686  );
1687 
1688  if ( $count ) {
1689  return MediaWikiServices::getInstance()->getContentLanguage()->normalize( $text );
1690  } else {
1691  return $text;
1692  }
1693  }
1694 
1700  if ( $matches[1] != '' ) {
1701  return self::decodeEntity( $matches[1] );
1702  } elseif ( $matches[2] != '' ) {
1703  return self::decodeChar( intval( $matches[2] ) );
1704  } elseif ( $matches[3] != '' ) {
1705  return self::decodeChar( hexdec( $matches[3] ) );
1706  }
1707  # Last case should be an ampersand by itself
1708  return $matches[0];
1709  }
1710 
1718  static function decodeChar( $codepoint ) {
1719  if ( self::validateCodepoint( $codepoint ) ) {
1720  return UtfNormal\Utils::codepointToUtf8( $codepoint );
1721  } else {
1722  return UtfNormal\Constants::UTF8_REPLACEMENT;
1723  }
1724  }
1725 
1734  static function decodeEntity( $name ) {
1735  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1736  $name = self::$htmlEntityAliases[$name];
1737  }
1738  if ( isset( self::$htmlEntities[$name] ) ) {
1739  return UtfNormal\Utils::codepointToUtf8( self::$htmlEntities[$name] );
1740  } else {
1741  return "&$name;";
1742  }
1743  }
1744 
1751  static function attributeWhitelist( $element ) {
1752  $list = self::setupAttributeWhitelist();
1753  return $list[$element] ?? [];
1754  }
1755 
1761  static function setupAttributeWhitelist() {
1762  static $whitelist;
1763 
1764  if ( $whitelist !== null ) {
1765  return $whitelist;
1766  }
1767 
1768  $common = [
1769  # HTML
1770  'id',
1771  'class',
1772  'style',
1773  'lang',
1774  'dir',
1775  'title',
1776 
1777  # WAI-ARIA
1778  'aria-describedby',
1779  'aria-flowto',
1780  'aria-label',
1781  'aria-labelledby',
1782  'aria-owns',
1783  'role',
1784 
1785  # RDFa
1786  # These attributes are specified in section 9 of
1787  # https://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1788  'about',
1789  'property',
1790  'resource',
1791  'datatype',
1792  'typeof',
1793 
1794  # Microdata. These are specified by
1795  # https://html.spec.whatwg.org/multipage/microdata.html#the-microdata-model
1796  'itemid',
1797  'itemprop',
1798  'itemref',
1799  'itemscope',
1800  'itemtype',
1801  ];
1802 
1803  $block = array_merge( $common, [ 'align' ] );
1804  $tablealign = [ 'align', 'valign' ];
1805  $tablecell = [
1806  'abbr',
1807  'axis',
1808  'headers',
1809  'scope',
1810  'rowspan',
1811  'colspan',
1812  'nowrap', # deprecated
1813  'width', # deprecated
1814  'height', # deprecated
1815  'bgcolor', # deprecated
1816  ];
1817 
1818  # Numbers refer to sections in HTML 4.01 standard describing the element.
1819  # See: https://www.w3.org/TR/html4/
1820  $whitelist = [
1821  # 7.5.4
1822  'div' => $block,
1823  'center' => $common, # deprecated
1824  'span' => $common,
1825 
1826  # 7.5.5
1827  'h1' => $block,
1828  'h2' => $block,
1829  'h3' => $block,
1830  'h4' => $block,
1831  'h5' => $block,
1832  'h6' => $block,
1833 
1834  # 7.5.6
1835  # address
1836 
1837  # 8.2.4
1838  'bdo' => $common,
1839 
1840  # 9.2.1
1841  'em' => $common,
1842  'strong' => $common,
1843  'cite' => $common,
1844  'dfn' => $common,
1845  'code' => $common,
1846  'samp' => $common,
1847  'kbd' => $common,
1848  'var' => $common,
1849  'abbr' => $common,
1850  # acronym
1851 
1852  # 9.2.2
1853  'blockquote' => array_merge( $common, [ 'cite' ] ),
1854  'q' => array_merge( $common, [ 'cite' ] ),
1855 
1856  # 9.2.3
1857  'sub' => $common,
1858  'sup' => $common,
1859 
1860  # 9.3.1
1861  'p' => $block,
1862 
1863  # 9.3.2
1864  'br' => array_merge( $common, [ 'clear' ] ),
1865 
1866  # https://www.w3.org/TR/html5/text-level-semantics.html#the-wbr-element
1867  'wbr' => $common,
1868 
1869  # 9.3.4
1870  'pre' => array_merge( $common, [ 'width' ] ),
1871 
1872  # 9.4
1873  'ins' => array_merge( $common, [ 'cite', 'datetime' ] ),
1874  'del' => array_merge( $common, [ 'cite', 'datetime' ] ),
1875 
1876  # 10.2
1877  'ul' => array_merge( $common, [ 'type' ] ),
1878  'ol' => array_merge( $common, [ 'type', 'start', 'reversed' ] ),
1879  'li' => array_merge( $common, [ 'type', 'value' ] ),
1880 
1881  # 10.3
1882  'dl' => $common,
1883  'dd' => $common,
1884  'dt' => $common,
1885 
1886  # 11.2.1
1887  'table' => array_merge( $common,
1888  [ 'summary', 'width', 'border', 'frame',
1889  'rules', 'cellspacing', 'cellpadding',
1890  'align', 'bgcolor',
1891  ] ),
1892 
1893  # 11.2.2
1894  'caption' => $block,
1895 
1896  # 11.2.3
1897  'thead' => $common,
1898  'tfoot' => $common,
1899  'tbody' => $common,
1900 
1901  # 11.2.4
1902  'colgroup' => array_merge( $common, [ 'span' ] ),
1903  'col' => array_merge( $common, [ 'span' ] ),
1904 
1905  # 11.2.5
1906  'tr' => array_merge( $common, [ 'bgcolor' ], $tablealign ),
1907 
1908  # 11.2.6
1909  'td' => array_merge( $common, $tablecell, $tablealign ),
1910  'th' => array_merge( $common, $tablecell, $tablealign ),
1911 
1912  # 12.2
1913  # NOTE: <a> is not allowed directly, but the attrib
1914  # whitelist is used from the Parser object
1915  'a' => array_merge( $common, [ 'href', 'rel', 'rev' ] ), # rel/rev esp. for RDFa
1916 
1917  # 13.2
1918  # Not usually allowed, but may be used for extension-style hooks
1919  # such as <math> when it is rasterized, or if $wgAllowImageTag is
1920  # true
1921  'img' => array_merge( $common, [ 'alt', 'src', 'width', 'height', 'srcset' ] ),
1922  # Attributes for A/V tags added in T163583 / T133673
1923  'audio' => array_merge( $common, [ 'controls', 'preload', 'width', 'height' ] ),
1924  'video' => array_merge( $common, [ 'poster', 'controls', 'preload', 'width', 'height' ] ),
1925  'source' => array_merge( $common, [ 'type', 'src' ] ),
1926  'track' => array_merge( $common, [ 'type', 'src', 'srclang', 'kind', 'label' ] ),
1927 
1928  # 15.2.1
1929  'tt' => $common,
1930  'b' => $common,
1931  'i' => $common,
1932  'big' => $common,
1933  'small' => $common,
1934  'strike' => $common,
1935  's' => $common,
1936  'u' => $common,
1937 
1938  # 15.2.2
1939  'font' => array_merge( $common, [ 'size', 'color', 'face' ] ),
1940  # basefont
1941 
1942  # 15.3
1943  'hr' => array_merge( $common, [ 'width' ] ),
1944 
1945  # HTML Ruby annotation text module, simple ruby only.
1946  # https://www.w3.org/TR/html5/text-level-semantics.html#the-ruby-element
1947  'ruby' => $common,
1948  # rbc
1949  'rb' => $common,
1950  'rp' => $common,
1951  'rt' => $common, # array_merge( $common, [ 'rbspan' ] ),
1952  'rtc' => $common,
1953 
1954  # MathML root element, where used for extensions
1955  # 'title' may not be 100% valid here; it's XHTML
1956  # https://www.w3.org/TR/REC-MathML/
1957  'math' => [ 'class', 'style', 'id', 'title' ],
1958 
1959  // HTML 5 section 4.5
1960  'figure' => $common,
1961  'figure-inline' => $common, # T118520
1962  'figcaption' => $common,
1963 
1964  # HTML 5 section 4.6
1965  'bdi' => $common,
1966 
1967  # HTML5 elements, defined by:
1968  # https://html.spec.whatwg.org/multipage/semantics.html#the-data-element
1969  'data' => array_merge( $common, [ 'value' ] ),
1970  'time' => array_merge( $common, [ 'datetime' ] ),
1971  'mark' => $common,
1972 
1973  // meta and link are only permitted by removeHTMLtags when Microdata
1974  // is enabled so we don't bother adding a conditional to hide these
1975  // Also meta and link are only valid in WikiText as Microdata elements
1976  // (ie: validateTag rejects tags missing the attributes needed for Microdata)
1977  // So we don't bother including $common attributes that have no purpose.
1978  'meta' => [ 'itemprop', 'content' ],
1979  'link' => [ 'itemprop', 'href', 'title' ],
1980  ];
1981 
1982  return $whitelist;
1983  }
1984 
1995  static function stripAllTags( $html ) {
1996  // Use RemexHtml to tokenize $html and extract the text
1998  $tokenizer = new RemexHtml\Tokenizer\Tokenizer( $handler, $html, [
1999  'ignoreErrors' => true,
2000  // don't ignore char refs, we want them to be decoded
2001  'ignoreNulls' => true,
2002  'skipPreprocess' => true,
2003  ] );
2004  $tokenizer->execute();
2005  $text = $handler->getResult();
2006 
2007  $text = self::normalizeWhitespace( $text );
2008  return $text;
2009  }
2010 
2020  static function hackDocType() {
2021  $out = "<!DOCTYPE html [\n";
2022  foreach ( self::$htmlEntities as $entity => $codepoint ) {
2023  $out .= "<!ENTITY $entity \"&#$codepoint;\">";
2024  }
2025  $out .= "]>\n";
2026  return $out;
2027  }
2028 
2033  static function cleanUrl( $url ) {
2034  # Normalize any HTML entities in input. They will be
2035  # re-escaped by makeExternalLink().
2036  $url = self::decodeCharReferences( $url );
2037 
2038  # Escape any control characters introduced by the above step
2039  $url = preg_replace_callback( '/[\][<>"\\x00-\\x20\\x7F\|]/',
2040  [ __CLASS__, 'cleanUrlCallback' ], $url );
2041 
2042  # Validate hostname portion
2043  $matches = [];
2044  if ( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
2045  list( /* $whole */, $protocol, $host, $rest ) = $matches;
2046 
2047  // Characters that will be ignored in IDNs.
2048  // https://tools.ietf.org/html/rfc3454#section-3.1
2049  // Strip them before further processing so blacklists and such work.
2050  $strip = "/
2051  \\s| # general whitespace
2052  \xc2\xad| # 00ad SOFT HYPHEN
2053  \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
2054  \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
2055  \xe2\x81\xa0| # 2060 WORD JOINER
2056  \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
2057  \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
2058  \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
2059  \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
2060  \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
2061  \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
2062  \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
2063  [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe0f VARIATION SELECTOR-1-16
2064  /xuD";
2065 
2066  $host = preg_replace( $strip, '', $host );
2067 
2068  // IPv6 host names are bracketed with []. Url-decode these.
2069  if ( substr_compare( "//%5B", $host, 0, 5 ) === 0 &&
2070  preg_match( '!^//%5B([0-9A-Fa-f:.]+)%5D((:\d+)?)$!', $host, $matches )
2071  ) {
2072  $host = '//[' . $matches[1] . ']' . $matches[2];
2073  }
2074 
2075  // @todo FIXME: Validate hostnames here
2076 
2077  return $protocol . $host . $rest;
2078  } else {
2079  return $url;
2080  }
2081  }
2082 
2087  static function cleanUrlCallback( $matches ) {
2088  return urlencode( $matches[0] );
2089  }
2090 
2119  public static function validateEmail( $addr ) {
2120  $result = null;
2121  if ( !Hooks::run( 'isValidEmailAddr', [ $addr, &$result ] ) ) {
2122  return $result;
2123  }
2124 
2125  // Please note strings below are enclosed in brackets [], this make the
2126  // hyphen "-" a range indicator. Hence it is double backslashed below.
2127  // See T28948
2128  $rfc5322_atext = "a-z0-9!#$%&'*+\\-\/=?^_`{|}~";
2129  $rfc1034_ldh_str = "a-z0-9\\-";
2130 
2131  $html5_email_regexp = "/
2132  ^ # start of string
2133  [$rfc5322_atext\\.]+ # user part which is liberal :p
2134  @ # 'apostrophe'
2135  [$rfc1034_ldh_str]+ # First domain part
2136  (\\.[$rfc1034_ldh_str]+)* # Following part prefixed with a dot
2137  $ # End of string
2138  /ix"; // case Insensitive, eXtended
2139 
2140  return (bool)preg_match( $html5_email_regexp, $addr );
2141  }
2142 }
$wgExternalInterwikiFragmentMode
Which ID escaping mode should be used for external interwiki links? See documentation for $wgFragment...
static armorFrenchSpaces( $text, $space='&#160;')
Armor French spaces with a replacement character.
Definition: Sanitizer.php:1172
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if that
Definition: deferred.txt:11
wfUrlProtocols( $includeProtocolRelative=true)
Returns a regular expression of url protocols.
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses & $html
Definition: hooks.txt:1982
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global list
Definition: deferred.txt:11
static escapeId( $id, $options=[])
Given a value, escape it so that it can be used in an id attribute and return it. ...
Definition: Sanitizer.php:1254
static normalizeWhitespace( $text)
Definition: Sanitizer.php:1528
const ID_PRIMARY
Tells escapeUrlForHtml() to encode the ID using the wiki&#39;s primary encoding.
Definition: Sanitizer.php:66
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses & $ret
Definition: hooks.txt:1982
Apache License January AND DISTRIBUTION Definitions License shall mean the terms and conditions for use
static setupAttributeWhitelist()
Foreach array key (an allowed HTML element), return an array of allowed attributes.
Definition: Sanitizer.php:1761
static cleanUrl( $url)
Definition: Sanitizer.php:2033
static isEnabled()
Definition: MWTidy.php:54
you don t have to do a grep find to see where the $wgReverseTitle variable is used
Definition: hooks.txt:115
null for the local wiki Added in
Definition: hooks.txt:1585
$value
static escapeIdReferenceList( $referenceString)
Given a string containing a space delimited list of ids, escape each id to match ids escaped by the e...
Definition: Sanitizer.php:1384
static isReservedDataAttribute( $attr)
Given an attribute name, checks whether it is a reserved data attribute (such as data-mw-foo) which i...
Definition: Sanitizer.php:908
static normalizeCss( $value)
Normalize CSS into a format we can easily search for hostile input.
Definition: Sanitizer.php:951
static $attribNameRegex
Lazy-initialised attribute name regex, see getAttribNameRegex()
Definition: Sanitizer.php:379
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency MediaWikiServices
Definition: injection.txt:23
static hackDocType()
Hack up a private DOCTYPE with HTML&#39;s standard entity declarations.
Definition: Sanitizer.php:2020
static hexCharReference( $codepoint)
Definition: Sanitizer.php:1628
static attributeWhitelist( $element)
Fetch the whitelist of acceptable attributes for a given element name.
Definition: Sanitizer.php:1751
static static static $attribsRegex
Lazy-initialised attributes regex, see getAttribsRegex()
Definition: Sanitizer.php:342
The index of the header message $result[1]=The index of the body text message $result[2 through n]=Parameters passed to body text message. Please note the header message cannot receive/use parameters. 'ImportHandleLogItemXMLTag':When parsing a XML tag in a log item. Return false to stop further processing of the tag $reader:XMLReader object $logInfo:Array of information 'ImportHandlePageXMLTag':When parsing a XML tag in a page. Return false to stop further processing of the tag $reader:XMLReader object & $pageInfo:Array of information 'ImportHandleRevisionXMLTag':When parsing a XML tag in a page revision. Return false to stop further processing of the tag $reader:XMLReader object $pageInfo:Array of page information $revisionInfo:Array of revision information 'ImportHandleToplevelXMLTag':When parsing a top level XML tag. Return false to stop further processing of the tag $reader:XMLReader object 'ImportHandleUnknownUser':When a user doesn 't exist locally, this hook is called to give extensions an opportunity to auto-create it. If the auto-creation is successful, return false. $name:User name 'ImportHandleUploadXMLTag':When parsing a XML tag in a file upload. Return false to stop further processing of the tag $reader:XMLReader object $revisionInfo:Array of information 'ImportLogInterwikiLink':Hook to change the interwiki link used in log entries and edit summaries for transwiki imports. & $fullInterwikiPrefix:Interwiki prefix, may contain colons. & $pageTitle:String that contains page title. 'ImportSources':Called when reading from the $wgImportSources configuration variable. Can be used to lazy-load the import sources list. & $importSources:The value of $wgImportSources. Modify as necessary. See the comment in DefaultSettings.php for the detail of how to structure this array. 'InfoAction':When building information to display on the action=info page. $context:IContextSource object & $pageInfo:Array of information 'InitializeArticleMaybeRedirect':MediaWiki check to see if title is a redirect. & $title:Title object for the current page & $request:WebRequest & $ignoreRedirect:boolean to skip redirect check & $target:Title/string of redirect target & $article:Article object 'InternalParseBeforeLinks':during Parser 's internalParse method before links but after nowiki/noinclude/includeonly/onlyinclude and other processings. & $parser:Parser object & $text:string containing partially parsed text & $stripState:Parser 's internal StripState object 'InternalParseBeforeSanitize':during Parser 's internalParse method just before the parser removes unwanted/dangerous HTML tags and after nowiki/noinclude/includeonly/onlyinclude and other processings. Ideal for syntax-extensions after template/parser function execution which respect nowiki and HTML-comments. & $parser:Parser object & $text:string containing partially parsed text & $stripState:Parser 's internal StripState object 'InterwikiLoadPrefix':When resolving if a given prefix is an interwiki or not. Return true without providing an interwiki to continue interwiki search. $prefix:interwiki prefix we are looking for. & $iwData:output array describing the interwiki with keys iw_url, iw_local, iw_trans and optionally iw_api and iw_wikiid. 'InvalidateEmailComplete':Called after a user 's email has been invalidated successfully. $user:user(object) whose email is being invalidated 'IRCLineURL':When constructing the URL to use in an IRC notification. Callee may modify $url and $query, URL will be constructed as $url . $query & $url:URL to index.php & $query:Query string $rc:RecentChange object that triggered url generation 'IsFileCacheable':Override the result of Article::isFileCacheable()(if true) & $article:article(object) being checked 'IsTrustedProxy':Override the result of IP::isTrustedProxy() & $ip:IP being check & $result:Change this value to override the result of IP::isTrustedProxy() 'IsUploadAllowedFromUrl':Override the result of UploadFromUrl::isAllowedUrl() $url:URL used to upload from & $allowed:Boolean indicating if uploading is allowed for given URL 'isValidEmailAddr':Override the result of Sanitizer::validateEmail(), for instance to return false if the domain name doesn 't match your organization. $addr:The e-mail address entered by the user & $result:Set this and return false to override the internal checks 'isValidPassword':Override the result of User::isValidPassword() $password:The password entered by the user & $result:Set this and return false to override the internal checks $user:User the password is being validated for 'Language::getMessagesFileName':$code:The language code or the language we 're looking for a messages file for & $file:The messages file path, you can override this to change the location. 'LanguageGetNamespaces':Provide custom ordering for namespaces or remove namespaces. Do not use this hook to add namespaces. Use CanonicalNamespaces for that. & $namespaces:Array of namespaces indexed by their numbers 'LanguageGetTranslatedLanguageNames':Provide translated language names. & $names:array of language code=> language name $code:language of the preferred translations 'LanguageLinks':Manipulate a page 's language links. This is called in various places to allow extensions to define the effective language links for a page. $title:The page 's Title. & $links:Array with elements of the form "language:title" in the order that they will be output. & $linkFlags:Associative array mapping prefixed links to arrays of flags. Currently unused, but planned to provide support for marking individual language links in the UI, e.g. for featured articles. 'LanguageSelector':Hook to change the language selector available on a page. $out:The output page. $cssClassName:CSS class name of the language selector. 'LinkBegin':DEPRECATED since 1.28! Use HtmlPageLinkRendererBegin instead. Used when generating internal and interwiki links in Linker::link(), before processing starts. Return false to skip default processing and return $ret. See documentation for Linker::link() for details on the expected meanings of parameters. $skin:the Skin object $target:the Title that the link is pointing to & $html:the contents that the< a > tag should have(raw HTML) $result
Definition: hooks.txt:1980
this hook is for auditing only RecentChangesLinked and Watchlist Do not use this to implement individual filters if they are compatible with the ChangesListFilter and ChangesListFilterGroup structure use sub classes of those in conjunction with the ChangesListSpecialPageStructuredFilters hook This hook can be used to implement filters that do not implement that or custom behavior that is not an individual filter e g Watchlist and Watchlist you will want to construct new ChangesListBooleanFilter or ChangesListStringOptionsFilter objects When constructing them
Definition: hooks.txt:979
if( $line===false) $args
Definition: cdb.php:64
static escapeIdInternal( $id, $mode)
Helper for escapeIdFor*() functions.
Definition: Sanitizer.php:1353
const ID_FALLBACK
Tells escapeUrlForHtml() to encode the ID using the fallback encoding, or return false if no fallback...
Definition: Sanitizer.php:74
static validateEmail( $addr)
Does a string look like an e-mail address?
Definition: Sanitizer.php:2119
static decCharReference( $codepoint)
Definition: Sanitizer.php:1615
this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that When $user is not it can be in the form of< username >< more info > e g for bot passwords intended to be added to log contexts Fields it might only if the login was with a bot password it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output modifiable modifiable after all normalizations have been except for the $wgMaxImageArea check set to true or false to override the $wgMaxImageArea check result gives extension the possibility to transform it themselves $handler
Definition: hooks.txt:780
this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that When $user is not it can be in the form of< username >< more info > e g for bot passwords intended to be added to log contexts Fields it might only if the login was with a bot password it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output $out
Definition: hooks.txt:780
const EVIL_URI_PATTERN
Blacklist for evil uris like javascript: WARNING: DO NOT use this in any place that actually requires...
Definition: Sanitizer.php:58
static validateTagAttributes( $attribs, $element)
Take an array of attribute names and values and normalize or discard illegal values for the given ele...
Definition: Sanitizer.php:791
const ELEMENT_BITS_REGEX
Acceptable tag name charset from HTML5 parsing spec https://www.w3.org/TR/html5/syntax.html#tag-open-state.
Definition: Sanitizer.php:48
static stripAllTags( $html)
Take a fragment of (potentially invalid) HTML and return a version with any tags removed, encoded as plain text.
Definition: Sanitizer.php:1995
static cssDecodeCallback( $matches)
Definition: Sanitizer.php:1087
static $htmlEntities
List of all named character entities defined in HTML 4.01 https://www.w3.org/TR/html4/sgml/entities.html As well as ' which is only defined starting in XHTML1.
Definition: Sanitizer.php:81
static getRecognizedTagData( $extratags=[], $removetags=[])
Return the various lists of recognized tags.
Definition: Sanitizer.php:400
static escapeIdForAttribute( $id, $mode=self::ID_PRIMARY)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid HTM...
Definition: Sanitizer.php:1288
static mergeAttributes( $a, $b)
Merge two sets of HTML attributes.
Definition: Sanitizer.php:929
const CHAR_REFS_REGEX
Regular expression to match various types of character references in Sanitizer::normalizeCharReferenc...
Definition: Sanitizer.php:38
static getTagAttributeCallback( $set)
Pick the appropriate attribute value from a match set from the attribs regex matches.
Definition: Sanitizer.php:1504
static decodeChar( $codepoint)
Return UTF-8 string for a codepoint if that is a valid character reference, otherwise U+FFFD REPLACEM...
Definition: Sanitizer.php:1718
$params
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped & $options
Definition: hooks.txt:1982
$wgFragmentMode
How should section IDs be encoded? This array can contain 1 or 2 elements, each of them can be one of...
static cleanUrlCallback( $matches)
Definition: Sanitizer.php:2087
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses after processing & $attribs
Definition: hooks.txt:1982
this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that When $user is not null
Definition: hooks.txt:780
static decodeTagAttributes( $text)
Return an associative array of attribute names and values from a partial tag string.
Definition: Sanitizer.php:1443
static escapeClass( $class)
Given a value, escape it so that it can be used as a CSS class and return it.
Definition: Sanitizer.php:1411
static static $htmlEntityAliases
Character entity aliases accepted by MediaWiki.
Definition: Sanitizer.php:340
static normalizeCharReferences( $text)
Ensure that any entities and character references are legal for XML and XHTML specifically.
Definition: Sanitizer.php:1562
Apache License January AND DISTRIBUTION Definitions License shall mean the terms and conditions for and distribution as defined by Sections through of this document Licensor shall mean the copyright owner or entity authorized by the copyright owner that is granting the License Legal Entity shall mean the union of the acting entity and all other entities that control are controlled by or are under common control with that entity For the purposes of this definition control direct or to cause the direction or management of such whether by contract or including but not limited to software source documentation and configuration files Object form shall mean any form resulting from mechanical transformation or translation of a Source including but not limited to compiled object generated and conversions to other media types Work shall mean the work of whether in Source or Object made available under the as indicated by a copyright notice that is included in or attached to the whether in Source or Object that is based or other modifications as a an original work of authorship For the purposes of this Derivative Works shall not include works that remain separable or merely the Work and Derivative Works thereof Contribution shall mean any work of including the original version of the Work and any modifications or additions to that Work or Derivative Works that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner For the purposes of this submitted means any form of or written communication sent to the Licensor or its including but not limited to communication on electronic mailing source code control and issue tracking systems that are managed by
static validateTag( $params, $element)
Takes attribute names and values for a tag and the tag name and validates that the tag is allowed to ...
Definition: Sanitizer.php:755
This document is intended to provide useful advice for parties seeking to redistribute MediaWiki to end users It s targeted particularly at maintainers for Linux since it s been observed that distribution packages of MediaWiki often break We ve consistently had to recommend that users seeking support use official tarballs instead of their distribution s and this often solves whatever problem the user is having It would be nice if this could such as
Definition: distributors.txt:9
usually copyright or history_copyright This message must be in HTML not wikitext if the section is included from a template $section
Definition: hooks.txt:3051
const XMLNS_ATTRIBUTE_PATTERN
Definition: Sanitizer.php:59
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency which acts as the top level factory for services in MediaWiki which can be used to gain access to default instances of various services MediaWikiServices however also allows new services to be defined and default services to be redefined Services are defined or redefined by providing a callback the instantiator that will return a new instance of the service When it will create an instance of MediaWikiServices and populate it with the services defined in the files listed by thereby bootstrapping the DI framework Per $wgServiceWiringFiles lists includes ServiceWiring php
Definition: injection.txt:35
static safeEncodeTagAttributes( $assoc_array)
Build a partial tag string from an associative array of attribute names and values as returned by dec...
Definition: Sanitizer.php:1485
static validateCodepoint( $codepoint)
Returns true if a given Unicode codepoint is a valid character in both HTML5 and XML.
Definition: Sanitizer.php:1643
static normalizeCharReferencesCallback( $matches)
Definition: Sanitizer.php:1573
static decodeCharReferencesCallback( $matches)
Definition: Sanitizer.php:1699
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if so it s not worth the trouble Since there is a job queue in the jobs table
Definition: deferred.txt:11
$wgAllowImageTag
A different approach to the above: simply allow the "<img>" tag to be used.
static encodeAttribute( $text)
Encode an attribute value for HTML output.
Definition: Sanitizer.php:1149
you have access to all of the normal MediaWiki so you can get a DB use the etc For full docs on the Maintenance class
Definition: maintenance.txt:52
static escapeIdForLink( $id)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid URL...
Definition: Sanitizer.php:1315
static removeHTMLcomments( $text)
Remove &#39;&#39;, and everything between.
Definition: Sanitizer.php:709
wfDeprecated( $function, $version=false, $component=false, $callerOffset=2)
Throws a warning that $function is deprecated.
static decodeCharReferences( $text)
Decode any character references, numeric or named entities, in the text and return a UTF-8 string...
Definition: Sanitizer.php:1662
static escapeIdForExternalInterwiki( $id)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid URL...
Definition: Sanitizer.php:1338
static normalizeEntity( $name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the equivalent numeric entity re...
Definition: Sanitizer.php:1599
static checkCss( $value)
Pick apart some CSS and check it for forbidden or unsafe structures.
Definition: Sanitizer.php:1058
static fixTagAttributes( $text, $element, $sorted=false)
Take a tag soup fragment listing an HTML element&#39;s attributes and normalize it to well-formed XML...
Definition: Sanitizer.php:1129
static decodeEntity( $name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the UTF-8 encoding of that chara...
Definition: Sanitizer.php:1734
Allows to change the fields on the form that will be generated $name
Definition: hooks.txt:271
static getAttribsRegex()
Regular expression to match HTML/XML attribute pairs within a tag.
Definition: Sanitizer.php:356
static escapeHtmlAllowEntities( $html)
Given HTML input, escape with htmlspecialchars but un-escape entities.
Definition: Sanitizer.php:1426
static removeHTMLtags( $text, $processCallback=null, $args=[], $extratags=[], $removetags=[], $warnCallback=null)
Cleans up HTML, removes dangerous tags and attributes, and removes HTML comments. ...
Definition: Sanitizer.php:497
</td >< td > &</td >< td > t want your writing to be edited mercilessly and redistributed at will
static validateAttributes( $attribs, $whitelist)
Take an array of attribute names and values and normalize or discard illegal values for the given whi...
Definition: Sanitizer.php:811
static configuration should be added through ResourceLoaderGetConfigVars instead & $vars
Definition: hooks.txt:2217
static getAttribNameRegex()
Used in Sanitizer::decodeTagAttributes to filter attributes.
Definition: Sanitizer.php:385
static normalizeSectionNameWhitespace( $section)
Normalizes whitespace in a section name, such as might be returned by Parser::stripSectionName(), for use in the id&#39;s that are used for section links.
Definition: Sanitizer.php:1543
static run( $event, array $args=[], $deprecatedVersion=null)
Call hook functions defined in Hooks::register and $wgHooks.
Definition: Hooks.php:200
static decodeCharReferencesAndNormalize( $text)
Decode any character references, numeric or named entities, in the next and normalize the resulting s...
Definition: Sanitizer.php:1679
static delimiterReplace( $startDelim, $endDelim, $replace, $subject, $flags='')
Perform an operation equivalent to preg_replace() with flags.
static safeEncodeAttribute( $text)
Encode an attribute value for HTML tags, with extra armoring against further wiki processing...
Definition: Sanitizer.php:1192
$matches