MediaWiki  master
Sanitizer.php
Go to the documentation of this file.
1 <?php
31 class Sanitizer {
37  '/&([A-Za-z0-9\x80-\xff]+);
38  |&\#([0-9]+);
39  |&\#[xX]([0-9A-Fa-f]+);
40  |(&)/x';
41 
46  const ELEMENT_BITS_REGEX = '!^(/?)([A-Za-z][^\t\n\v />\0]*+)([^>]*?)(/?>)([^<]*)$!';
47 
56  const EVIL_URI_PATTERN = '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i';
57  const XMLNS_ATTRIBUTE_PATTERN = "/^xmlns:[:A-Z_a-z-.0-9]+$/";
58 
64  const ID_PRIMARY = 0;
65 
72  const ID_FALLBACK = 1;
73 
79  private static $htmlEntities = [
80  'Aacute' => 193,
81  'aacute' => 225,
82  'Acirc' => 194,
83  'acirc' => 226,
84  'acute' => 180,
85  'AElig' => 198,
86  'aelig' => 230,
87  'Agrave' => 192,
88  'agrave' => 224,
89  'alefsym' => 8501,
90  'Alpha' => 913,
91  'alpha' => 945,
92  'amp' => 38,
93  'and' => 8743,
94  'ang' => 8736,
95  'apos' => 39, // New in XHTML & HTML 5; avoid in output for compatibility with IE.
96  'Aring' => 197,
97  'aring' => 229,
98  'asymp' => 8776,
99  'Atilde' => 195,
100  'atilde' => 227,
101  'Auml' => 196,
102  'auml' => 228,
103  'bdquo' => 8222,
104  'Beta' => 914,
105  'beta' => 946,
106  'brvbar' => 166,
107  'bull' => 8226,
108  'cap' => 8745,
109  'Ccedil' => 199,
110  'ccedil' => 231,
111  'cedil' => 184,
112  'cent' => 162,
113  'Chi' => 935,
114  'chi' => 967,
115  'circ' => 710,
116  'clubs' => 9827,
117  'cong' => 8773,
118  'copy' => 169,
119  'crarr' => 8629,
120  'cup' => 8746,
121  'curren' => 164,
122  'dagger' => 8224,
123  'Dagger' => 8225,
124  'darr' => 8595,
125  'dArr' => 8659,
126  'deg' => 176,
127  'Delta' => 916,
128  'delta' => 948,
129  'diams' => 9830,
130  'divide' => 247,
131  'Eacute' => 201,
132  'eacute' => 233,
133  'Ecirc' => 202,
134  'ecirc' => 234,
135  'Egrave' => 200,
136  'egrave' => 232,
137  'empty' => 8709,
138  'emsp' => 8195,
139  'ensp' => 8194,
140  'Epsilon' => 917,
141  'epsilon' => 949,
142  'equiv' => 8801,
143  'Eta' => 919,
144  'eta' => 951,
145  'ETH' => 208,
146  'eth' => 240,
147  'Euml' => 203,
148  'euml' => 235,
149  'euro' => 8364,
150  'exist' => 8707,
151  'fnof' => 402,
152  'forall' => 8704,
153  'frac12' => 189,
154  'frac14' => 188,
155  'frac34' => 190,
156  'frasl' => 8260,
157  'Gamma' => 915,
158  'gamma' => 947,
159  'ge' => 8805,
160  'gt' => 62,
161  'harr' => 8596,
162  'hArr' => 8660,
163  'hearts' => 9829,
164  'hellip' => 8230,
165  'Iacute' => 205,
166  'iacute' => 237,
167  'Icirc' => 206,
168  'icirc' => 238,
169  'iexcl' => 161,
170  'Igrave' => 204,
171  'igrave' => 236,
172  'image' => 8465,
173  'infin' => 8734,
174  'int' => 8747,
175  'Iota' => 921,
176  'iota' => 953,
177  'iquest' => 191,
178  'isin' => 8712,
179  'Iuml' => 207,
180  'iuml' => 239,
181  'Kappa' => 922,
182  'kappa' => 954,
183  'Lambda' => 923,
184  'lambda' => 955,
185  'lang' => 9001,
186  'laquo' => 171,
187  'larr' => 8592,
188  'lArr' => 8656,
189  'lceil' => 8968,
190  'ldquo' => 8220,
191  'le' => 8804,
192  'lfloor' => 8970,
193  'lowast' => 8727,
194  'loz' => 9674,
195  'lrm' => 8206,
196  'lsaquo' => 8249,
197  'lsquo' => 8216,
198  'lt' => 60,
199  'macr' => 175,
200  'mdash' => 8212,
201  'micro' => 181,
202  'middot' => 183,
203  'minus' => 8722,
204  'Mu' => 924,
205  'mu' => 956,
206  'nabla' => 8711,
207  'nbsp' => 160,
208  'ndash' => 8211,
209  'ne' => 8800,
210  'ni' => 8715,
211  'not' => 172,
212  'notin' => 8713,
213  'nsub' => 8836,
214  'Ntilde' => 209,
215  'ntilde' => 241,
216  'Nu' => 925,
217  'nu' => 957,
218  'Oacute' => 211,
219  'oacute' => 243,
220  'Ocirc' => 212,
221  'ocirc' => 244,
222  'OElig' => 338,
223  'oelig' => 339,
224  'Ograve' => 210,
225  'ograve' => 242,
226  'oline' => 8254,
227  'Omega' => 937,
228  'omega' => 969,
229  'Omicron' => 927,
230  'omicron' => 959,
231  'oplus' => 8853,
232  'or' => 8744,
233  'ordf' => 170,
234  'ordm' => 186,
235  'Oslash' => 216,
236  'oslash' => 248,
237  'Otilde' => 213,
238  'otilde' => 245,
239  'otimes' => 8855,
240  'Ouml' => 214,
241  'ouml' => 246,
242  'para' => 182,
243  'part' => 8706,
244  'permil' => 8240,
245  'perp' => 8869,
246  'Phi' => 934,
247  'phi' => 966,
248  'Pi' => 928,
249  'pi' => 960,
250  'piv' => 982,
251  'plusmn' => 177,
252  'pound' => 163,
253  'prime' => 8242,
254  'Prime' => 8243,
255  'prod' => 8719,
256  'prop' => 8733,
257  'Psi' => 936,
258  'psi' => 968,
259  'quot' => 34,
260  'radic' => 8730,
261  'rang' => 9002,
262  'raquo' => 187,
263  'rarr' => 8594,
264  'rArr' => 8658,
265  'rceil' => 8969,
266  'rdquo' => 8221,
267  'real' => 8476,
268  'reg' => 174,
269  'rfloor' => 8971,
270  'Rho' => 929,
271  'rho' => 961,
272  'rlm' => 8207,
273  'rsaquo' => 8250,
274  'rsquo' => 8217,
275  'sbquo' => 8218,
276  'Scaron' => 352,
277  'scaron' => 353,
278  'sdot' => 8901,
279  'sect' => 167,
280  'shy' => 173,
281  'Sigma' => 931,
282  'sigma' => 963,
283  'sigmaf' => 962,
284  'sim' => 8764,
285  'spades' => 9824,
286  'sub' => 8834,
287  'sube' => 8838,
288  'sum' => 8721,
289  'sup' => 8835,
290  'sup1' => 185,
291  'sup2' => 178,
292  'sup3' => 179,
293  'supe' => 8839,
294  'szlig' => 223,
295  'Tau' => 932,
296  'tau' => 964,
297  'there4' => 8756,
298  'Theta' => 920,
299  'theta' => 952,
300  'thetasym' => 977,
301  'thinsp' => 8201,
302  'THORN' => 222,
303  'thorn' => 254,
304  'tilde' => 732,
305  'times' => 215,
306  'trade' => 8482,
307  'Uacute' => 218,
308  'uacute' => 250,
309  'uarr' => 8593,
310  'uArr' => 8657,
311  'Ucirc' => 219,
312  'ucirc' => 251,
313  'Ugrave' => 217,
314  'ugrave' => 249,
315  'uml' => 168,
316  'upsih' => 978,
317  'Upsilon' => 933,
318  'upsilon' => 965,
319  'Uuml' => 220,
320  'uuml' => 252,
321  'weierp' => 8472,
322  'Xi' => 926,
323  'xi' => 958,
324  'Yacute' => 221,
325  'yacute' => 253,
326  'yen' => 165,
327  'Yuml' => 376,
328  'yuml' => 255,
329  'Zeta' => 918,
330  'zeta' => 950,
331  'zwj' => 8205,
332  'zwnj' => 8204
333  ];
334 
338  private static $htmlEntityAliases = [
339  'רלמ' => 'rlm',
340  'رلم' => 'rlm',
341  ];
342 
346  private static $attribsRegex;
347 
355  static function getAttribsRegex() {
356  if ( self::$attribsRegex === null ) {
357  $attribFirst = "[:_\p{L}\p{N}]";
358  $attrib = "[:_\.\-\p{L}\p{N}]";
359  $space = '[\x09\x0a\x0c\x0d\x20]';
360  self::$attribsRegex =
361  "/(?:^|$space)({$attribFirst}{$attrib}*)
362  ($space*=$space*
363  (?:
364  # The attribute value: quoted or alone
365  \"([^\"]*)(?:\"|\$)
366  | '([^']*)(?:'|\$)
367  | (((?!$space|>).)*)
368  )
369  )?(?=$space|\$)/sxu";
370  }
371  return self::$attribsRegex;
372  }
373 
380  public static function getRecognizedTagData( $extratags = [], $removetags = [] ) {
381  global $wgAllowImageTag;
382 
383  static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
384  $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
385 
386  // Base our staticInitialised variable off of the global config state so that if the globals
387  // are changed (like in the screwed up test system) we will re-initialise the settings.
388  $globalContext = $wgAllowImageTag;
389  if ( !$staticInitialised || $staticInitialised != $globalContext ) {
390  $htmlpairsStatic = [ # Tags that must be closed
391  'b', 'bdi', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
392  'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
393  'strike', 'strong', 'tt', 'var', 'div', 'center',
394  'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
395  'ruby', 'rb', 'rp', 'rt', 'rtc', 'p', 'span', 'abbr', 'dfn',
396  'kbd', 'samp', 'data', 'time', 'mark'
397  ];
398  $htmlsingle = [
399  'br', 'wbr', 'hr', 'li', 'dt', 'dd', 'meta', 'link'
400  ];
401 
402  # Elements that cannot have close tags. This is (not coincidentally)
403  # also the list of tags for which the HTML 5 parsing algorithm
404  # requires you to "acknowledge the token's self-closing flag", i.e.
405  # a self-closing tag like <br/> is not an HTML 5 parse error only
406  # for this list.
407  $htmlsingleonly = [
408  'br', 'wbr', 'hr', 'meta', 'link'
409  ];
410 
411  $htmlnest = [ # Tags that can be nested--??
412  'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
413  'li', 'dl', 'dt', 'dd', 'font', 'big', 'small', 'sub', 'sup', 'span',
414  'var', 'kbd', 'samp', 'em', 'strong', 'q', 'ruby', 'bdo'
415  ];
416  $tabletags = [ # Can only appear inside table, we will close them
417  'td', 'th', 'tr',
418  ];
419  $htmllist = [ # Tags used by list
420  'ul', 'ol',
421  ];
422  $listtags = [ # Tags that can appear in a list
423  'li',
424  ];
425 
426  if ( $wgAllowImageTag ) {
427  $htmlsingle[] = 'img';
428  $htmlsingleonly[] = 'img';
429  }
430 
431  $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
432  $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
433 
434  # Convert them all to hashtables for faster lookup
435  $vars = [ 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
436  'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' ];
437  foreach ( $vars as $var ) {
438  $$var = array_flip( $$var );
439  }
440  $staticInitialised = $globalContext;
441  }
442 
443  # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
444  $extratags = array_flip( $extratags );
445  $removetags = array_flip( $removetags );
446  $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
447  $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ), $removetags );
448 
449  return [
450  'htmlpairs' => $htmlpairs,
451  'htmlsingle' => $htmlsingle,
452  'htmlsingleonly' => $htmlsingleonly,
453  'htmlnest' => $htmlnest,
454  'tabletags' => $tabletags,
455  'htmllist' => $htmllist,
456  'listtags' => $listtags,
457  'htmlsingleallowed' => $htmlsingleallowed,
458  'htmlelements' => $htmlelements,
459  ];
460  }
461 
477  public static function removeHTMLtags( $text, $processCallback = null,
478  $args = [], $extratags = [], $removetags = [], $warnCallback = null
479  ) {
480  extract( self::getRecognizedTagData( $extratags, $removetags ) );
481 
482  # Remove HTML comments
483  $text = self::removeHTMLcomments( $text );
484  $bits = explode( '<', $text );
485  $text = str_replace( '>', '&gt;', array_shift( $bits ) );
486  if ( !MWTidy::isEnabled() ) {
487  $tagstack = $tablestack = [];
488  foreach ( $bits as $x ) {
489  $regs = [];
490  # $slash: Does the current element start with a '/'?
491  # $t: Current element name
492  # $params: String between element name and >
493  # $brace: Ending '>' or '/>'
494  # $rest: Everything until the next element of $bits
495  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
496  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
497  } else {
498  $slash = $t = $params = $brace = $rest = null;
499  }
500 
501  $badtag = false;
502  $t = strtolower( $t );
503  if ( isset( $htmlelements[$t] ) ) {
504  # Check our stack
505  if ( $slash && isset( $htmlsingleonly[$t] ) ) {
506  $badtag = true;
507  } elseif ( $slash ) {
508  # Closing a tag... is it the one we just opened?
509  MediaWiki\suppressWarnings();
510  $ot = array_pop( $tagstack );
511  MediaWiki\restoreWarnings();
512 
513  if ( $ot != $t ) {
514  if ( isset( $htmlsingleallowed[$ot] ) ) {
515  # Pop all elements with an optional close tag
516  # and see if we find a match below them
517  $optstack = [];
518  array_push( $optstack, $ot );
519  MediaWiki\suppressWarnings();
520  $ot = array_pop( $tagstack );
521  MediaWiki\restoreWarnings();
522  while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
523  array_push( $optstack, $ot );
524  MediaWiki\suppressWarnings();
525  $ot = array_pop( $tagstack );
526  MediaWiki\restoreWarnings();
527  }
528  if ( $t != $ot ) {
529  # No match. Push the optional elements back again
530  $badtag = true;
531  MediaWiki\suppressWarnings();
532  $ot = array_pop( $optstack );
533  MediaWiki\restoreWarnings();
534  while ( $ot ) {
535  array_push( $tagstack, $ot );
536  MediaWiki\suppressWarnings();
537  $ot = array_pop( $optstack );
538  MediaWiki\restoreWarnings();
539  }
540  }
541  } else {
542  MediaWiki\suppressWarnings();
543  array_push( $tagstack, $ot );
544  MediaWiki\restoreWarnings();
545 
546  # <li> can be nested in <ul> or <ol>, skip those cases:
547  if ( !isset( $htmllist[$ot] ) || !isset( $listtags[$t] ) ) {
548  $badtag = true;
549  }
550  }
551  } else {
552  if ( $t == 'table' ) {
553  $tagstack = array_pop( $tablestack );
554  }
555  }
556  $newparams = '';
557  } else {
558  # Keep track for later
559  if ( isset( $tabletags[$t] ) && !in_array( 'table', $tagstack ) ) {
560  $badtag = true;
561  } elseif ( in_array( $t, $tagstack ) && !isset( $htmlnest[$t] ) ) {
562  $badtag = true;
563  #  Is it a self closed htmlpair ? (T7487)
564  } elseif ( $brace == '/>' && isset( $htmlpairs[$t] ) ) {
565  // Eventually we'll just remove the self-closing
566  // slash, in order to be consistent with HTML5
567  // semantics.
568  // $brace = '>';
569  // For now, let's just warn authors to clean up.
570  if ( is_callable( $warnCallback ) ) {
571  call_user_func_array( $warnCallback, [ 'deprecated-self-close-category' ] );
572  }
573  $badtag = true;
574  } elseif ( isset( $htmlsingleonly[$t] ) ) {
575  # Hack to force empty tag for unclosable elements
576  $brace = '/>';
577  } elseif ( isset( $htmlsingle[$t] ) ) {
578  # Hack to not close $htmlsingle tags
579  $brace = null;
580  # Still need to push this optionally-closed tag to
581  # the tag stack so that we can match end tags
582  # instead of marking them as bad.
583  array_push( $tagstack, $t );
584  } elseif ( isset( $tabletags[$t] ) && in_array( $t, $tagstack ) ) {
585  // New table tag but forgot to close the previous one
586  $text .= "</$t>";
587  } else {
588  if ( $t == 'table' ) {
589  array_push( $tablestack, $tagstack );
590  $tagstack = [];
591  }
592  array_push( $tagstack, $t );
593  }
594 
595  # Replace any variables or template parameters with
596  # plaintext results.
597  if ( is_callable( $processCallback ) ) {
598  call_user_func_array( $processCallback, [ &$params, $args ] );
599  }
600 
601  if ( !self::validateTag( $params, $t ) ) {
602  $badtag = true;
603  }
604 
605  # Strip non-approved attributes from the tag
606  $newparams = self::fixTagAttributes( $params, $t );
607  }
608  if ( !$badtag ) {
609  $rest = str_replace( '>', '&gt;', $rest );
610  $close = ( $brace == '/>' && !$slash ) ? ' /' : '';
611  $text .= "<$slash$t$newparams$close>$rest";
612  continue;
613  }
614  }
615  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
616  }
617  # Close off any remaining tags
618  while ( is_array( $tagstack ) && ( $t = array_pop( $tagstack ) ) ) {
619  $text .= "</$t>\n";
620  if ( $t == 'table' ) {
621  $tagstack = array_pop( $tablestack );
622  }
623  }
624  } else {
625  # this might be possible using tidy itself
626  foreach ( $bits as $x ) {
627  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
628  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
629 
630  $badtag = false;
631  $t = strtolower( $t );
632  if ( isset( $htmlelements[$t] ) ) {
633  if ( is_callable( $processCallback ) ) {
634  call_user_func_array( $processCallback, [ &$params, $args ] );
635  }
636 
637  if ( $brace == '/>' && !( isset( $htmlsingle[$t] ) || isset( $htmlsingleonly[$t] ) ) ) {
638  // Eventually we'll just remove the self-closing
639  // slash, in order to be consistent with HTML5
640  // semantics.
641  // $brace = '>';
642  // For now, let's just warn authors to clean up.
643  if ( is_callable( $warnCallback ) ) {
644  call_user_func_array( $warnCallback, [ 'deprecated-self-close-category' ] );
645  }
646  }
647  if ( !self::validateTag( $params, $t ) ) {
648  $badtag = true;
649  }
650 
651  $newparams = self::fixTagAttributes( $params, $t );
652  if ( !$badtag ) {
653  if ( $brace === '/>' && !isset( $htmlsingleonly[$t] ) ) {
654  # Interpret self-closing tags as empty tags even when
655  # HTML 5 would interpret them as start tags. Such input
656  # is commonly seen on Wikimedia wikis with this intention.
657  $brace = "></$t>";
658  }
659 
660  $rest = str_replace( '>', '&gt;', $rest );
661  $text .= "<$slash$t$newparams$brace$rest";
662  continue;
663  }
664  }
665  }
666  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
667  }
668  }
669  return $text;
670  }
671 
681  public static function removeHTMLcomments( $text ) {
682  while ( ( $start = strpos( $text, '<!--' ) ) !== false ) {
683  $end = strpos( $text, '-->', $start + 4 );
684  if ( $end === false ) {
685  # Unterminated comment; bail out
686  break;
687  }
688 
689  $end += 3;
690 
691  # Trim space and newline if the comment is both
692  # preceded and followed by a newline
693  $spaceStart = max( $start - 1, 0 );
694  $spaceLen = $end - $spaceStart;
695  while ( substr( $text, $spaceStart, 1 ) === ' ' && $spaceStart > 0 ) {
696  $spaceStart--;
697  $spaceLen++;
698  }
699  while ( substr( $text, $spaceStart + $spaceLen, 1 ) === ' ' ) {
700  $spaceLen++;
701  }
702  if ( substr( $text, $spaceStart, 1 ) === "\n"
703  && substr( $text, $spaceStart + $spaceLen, 1 ) === "\n" ) {
704  # Remove the comment, leading and trailing
705  # spaces, and leave only one newline.
706  $text = substr_replace( $text, "\n", $spaceStart, $spaceLen + 1 );
707  } else {
708  # Remove just the comment.
709  $text = substr_replace( $text, '', $start, $end - $start );
710  }
711  }
712  return $text;
713  }
714 
727  static function validateTag( $params, $element ) {
728  $params = self::decodeTagAttributes( $params );
729 
730  if ( $element == 'meta' || $element == 'link' ) {
731  if ( !isset( $params['itemprop'] ) ) {
732  // <meta> and <link> must have an itemprop="" otherwise they are not valid or safe in content
733  return false;
734  }
735  if ( $element == 'meta' && !isset( $params['content'] ) ) {
736  // <meta> must have a content="" for the itemprop
737  return false;
738  }
739  if ( $element == 'link' && !isset( $params['href'] ) ) {
740  // <link> must have an associated href=""
741  return false;
742  }
743  }
744 
745  return true;
746  }
747 
763  static function validateTagAttributes( $attribs, $element ) {
764  return self::validateAttributes( $attribs,
765  self::attributeWhitelist( $element ) );
766  }
767 
783  static function validateAttributes( $attribs, $whitelist ) {
784  $whitelist = array_flip( $whitelist );
785  $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
786 
787  $out = [];
788  foreach ( $attribs as $attribute => $value ) {
789  # Allow XML namespace declaration to allow RDFa
790  if ( preg_match( self::XMLNS_ATTRIBUTE_PATTERN, $attribute ) ) {
791  if ( !preg_match( self::EVIL_URI_PATTERN, $value ) ) {
792  $out[$attribute] = $value;
793  }
794 
795  continue;
796  }
797 
798  # Allow any attribute beginning with "data-"
799  # However:
800  # * Disallow data attributes used by MediaWiki code
801  # * Ensure that the attribute is not namespaced by banning
802  # colons.
803  if ( !preg_match( '/^data-[^:]*$/i', $attribute )
804  && !isset( $whitelist[$attribute] )
805  || self::isReservedDataAttribute( $attribute )
806  ) {
807  continue;
808  }
809 
810  # Strip javascript "expression" from stylesheets.
811  # https://msdn.microsoft.com/en-us/library/ms537634.aspx
812  if ( $attribute == 'style' ) {
813  $value = self::checkCss( $value );
814  }
815 
816  # Escape HTML id attributes
817  if ( $attribute === 'id' ) {
818  $value = self::escapeIdForAttribute( $value, self::ID_PRIMARY );
819  }
820 
821  # Escape HTML id reference lists
822  if ( $attribute === 'aria-describedby'
823  || $attribute === 'aria-flowto'
824  || $attribute === 'aria-labelledby'
825  || $attribute === 'aria-owns'
826  ) {
827  $value = self::escapeIdReferenceList( $value, 'noninitial' );
828  }
829 
830  // RDFa and microdata properties allow URLs, URIs and/or CURIs.
831  // Check them for sanity.
832  if ( $attribute === 'rel' || $attribute === 'rev'
833  # RDFa
834  || $attribute === 'about' || $attribute === 'property'
835  || $attribute === 'resource' || $attribute === 'datatype'
836  || $attribute === 'typeof'
837  # HTML5 microdata
838  || $attribute === 'itemid' || $attribute === 'itemprop'
839  || $attribute === 'itemref' || $attribute === 'itemscope'
840  || $attribute === 'itemtype'
841  ) {
842  // Paranoia. Allow "simple" values but suppress javascript
843  if ( preg_match( self::EVIL_URI_PATTERN, $value ) ) {
844  continue;
845  }
846  }
847 
848  # NOTE: even though elements using href/src are not allowed directly, supply
849  # validation code that can be used by tag hook handlers, etc
850  if ( $attribute === 'href' || $attribute === 'src' || $attribute === 'poster' ) {
851  if ( !preg_match( $hrefExp, $value ) ) {
852  continue; // drop any href or src attributes not using an allowed protocol.
853  // NOTE: this also drops all relative URLs
854  }
855  }
856 
857  // If this attribute was previously set, override it.
858  // Output should only have one attribute of each name.
859  $out[$attribute] = $value;
860  }
861 
862  # itemtype, itemid, itemref don't make sense without itemscope
863  if ( !array_key_exists( 'itemscope', $out ) ) {
864  unset( $out['itemtype'] );
865  unset( $out['itemid'] );
866  unset( $out['itemref'] );
867  }
868  # TODO: Strip itemprop if we aren't descendants of an itemscope or pointed to by an itemref.
869 
870  return $out;
871  }
872 
880  public static function isReservedDataAttribute( $attr ) {
881  // data-ooui is reserved for ooui.
882  // data-mw and data-parsoid are reserved for parsoid.
883  // data-mw-<name here> is reserved for extensions (or core) if
884  // they need to communicate some data to the client and want to be
885  // sure that it isn't coming from an untrusted user.
886  // We ignore the possibility of namespaces since user-generated HTML
887  // can't use them anymore.
888  return (bool)preg_match( '/^data-(ooui|mw|parsoid)/i', $attr );
889  }
890 
901  static function mergeAttributes( $a, $b ) {
902  $out = array_merge( $a, $b );
903  if ( isset( $a['class'] ) && isset( $b['class'] )
904  && is_string( $a['class'] ) && is_string( $b['class'] )
905  && $a['class'] !== $b['class']
906  ) {
907  $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
908  -1, PREG_SPLIT_NO_EMPTY );
909  $out['class'] = implode( ' ', array_unique( $classes ) );
910  }
911  return $out;
912  }
913 
923  public static function normalizeCss( $value ) {
924  // Decode character references like &#123;
925  $value = self::decodeCharReferences( $value );
926 
927  // Decode escape sequences and line continuation
928  // See the grammar in the CSS 2 spec, appendix D.
929  // This has to be done AFTER decoding character references.
930  // This means it isn't possible for this function to return
931  // unsanitized escape sequences. It is possible to manufacture
932  // input that contains character references that decode to
933  // escape sequences that decode to character references, but
934  // it's OK for the return value to contain character references
935  // because the caller is supposed to escape those anyway.
936  static $decodeRegex;
937  if ( !$decodeRegex ) {
938  $space = '[\\x20\\t\\r\\n\\f]';
939  $nl = '(?:\\n|\\r\\n|\\r|\\f)';
940  $backslash = '\\\\';
941  $decodeRegex = "/ $backslash
942  (?:
943  ($nl) | # 1. Line continuation
944  ([0-9A-Fa-f]{1,6})$space? | # 2. character number
945  (.) | # 3. backslash cancelling special meaning
946  () | # 4. backslash at end of string
947  )/xu";
948  }
949  $value = preg_replace_callback( $decodeRegex,
950  [ __CLASS__, 'cssDecodeCallback' ], $value );
951 
952  // Normalize Halfwidth and Fullwidth Unicode block that IE6 might treat as ascii
953  $value = preg_replace_callback(
954  '/[!-[]-z]/u', // U+FF01 to U+FF5A, excluding U+FF3C (T60088)
955  function ( $matches ) {
957  if ( $cp === false ) {
958  return '';
959  }
960  return chr( $cp - 65248 ); // ASCII range \x21-\x7A
961  },
962  $value
963  );
964 
965  // Convert more characters IE6 might treat as ascii
966  // U+0280, U+0274, U+207F, U+029F, U+026A, U+207D, U+208D
967  $value = str_replace(
968  [ 'ʀ', 'ɴ', 'ⁿ', 'ʟ', 'ɪ', '⁽', '₍' ],
969  [ 'r', 'n', 'n', 'l', 'i', '(', '(' ],
970  $value
971  );
972 
973  // Let the value through if it's nothing but a single comment, to
974  // allow other functions which may reject it to pass some error
975  // message through.
976  if ( !preg_match( '! ^ \s* /\* [^*\\/]* \*/ \s* $ !x', $value ) ) {
977  // Remove any comments; IE gets token splitting wrong
978  // This must be done AFTER decoding character references and
979  // escape sequences, because those steps can introduce comments
980  // This step cannot introduce character references or escape
981  // sequences, because it replaces comments with spaces rather
982  // than removing them completely.
983  $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value );
984 
985  // Remove anything after a comment-start token, to guard against
986  // incorrect client implementations.
987  $commentPos = strpos( $value, '/*' );
988  if ( $commentPos !== false ) {
989  $value = substr( $value, 0, $commentPos );
990  }
991  }
992 
993  // S followed by repeat, iteration, or prolonged sound marks,
994  // which IE will treat as "ss"
995  $value = preg_replace(
996  '/s(?:
997  \xE3\x80\xB1 | # U+3031
998  \xE3\x82\x9D | # U+309D
999  \xE3\x83\xBC | # U+30FC
1000  \xE3\x83\xBD | # U+30FD
1001  \xEF\xB9\xBC | # U+FE7C
1002  \xEF\xB9\xBD | # U+FE7D
1003  \xEF\xBD\xB0 # U+FF70
1004  )/ix',
1005  'ss',
1006  $value
1007  );
1008 
1009  return $value;
1010  }
1011 
1030  static function checkCss( $value ) {
1031  $value = self::normalizeCss( $value );
1032 
1033  // Reject problematic keywords and control characters
1034  if ( preg_match( '/[\000-\010\013\016-\037\177]/', $value ) ||
1035  strpos( $value, UtfNormal\Constants::UTF8_REPLACEMENT ) !== false ) {
1036  return '/* invalid control char */';
1037  } elseif ( preg_match(
1038  '! expression
1039  | filter\s*:
1040  | accelerator\s*:
1041  | -o-link\s*:
1042  | -o-link-source\s*:
1043  | -o-replace\s*:
1044  | url\s*\(
1045  | image\s*\(
1046  | image-set\s*\(
1047  | attr\s*\([^)]+[\s,]+url
1048  !ix', $value ) ) {
1049  return '/* insecure input */';
1050  }
1051  return $value;
1052  }
1053 
1058  static function cssDecodeCallback( $matches ) {
1059  if ( $matches[1] !== '' ) {
1060  // Line continuation
1061  return '';
1062  } elseif ( $matches[2] !== '' ) {
1063  $char = UtfNormal\Utils::codepointToUtf8( hexdec( $matches[2] ) );
1064  } elseif ( $matches[3] !== '' ) {
1065  $char = $matches[3];
1066  } else {
1067  $char = '\\';
1068  }
1069  if ( $char == "\n" || $char == '"' || $char == "'" || $char == '\\' ) {
1070  // These characters need to be escaped in strings
1071  // Clean up the escape sequence to avoid parsing errors by clients
1072  return '\\' . dechex( ord( $char ) ) . ' ';
1073  } else {
1074  // Decode unnecessary escape
1075  return $char;
1076  }
1077  }
1078 
1100  static function fixTagAttributes( $text, $element, $sorted = false ) {
1101  if ( trim( $text ) == '' ) {
1102  return '';
1103  }
1104 
1105  $decoded = self::decodeTagAttributes( $text );
1106  $stripped = self::validateTagAttributes( $decoded, $element );
1107 
1108  if ( $sorted ) {
1109  ksort( $stripped );
1110  }
1111 
1112  return self::safeEncodeTagAttributes( $stripped );
1113  }
1114 
1120  static function encodeAttribute( $text ) {
1121  $encValue = htmlspecialchars( $text, ENT_QUOTES );
1122 
1123  // Whitespace is normalized during attribute decoding,
1124  // so if we've been passed non-spaces we must encode them
1125  // ahead of time or they won't be preserved.
1126  $encValue = strtr( $encValue, [
1127  "\n" => '&#10;',
1128  "\r" => '&#13;',
1129  "\t" => '&#9;',
1130  ] );
1131 
1132  return $encValue;
1133  }
1134 
1141  static function safeEncodeAttribute( $text ) {
1142  $encValue = self::encodeAttribute( $text );
1143 
1144  # Templates and links may be expanded in later parsing,
1145  # creating invalid or dangerous output. Suppress this.
1146  $encValue = strtr( $encValue, [
1147  '<' => '&lt;', // This should never happen,
1148  '>' => '&gt;', // we've received invalid input
1149  '"' => '&quot;', // which should have been escaped.
1150  '{' => '&#123;',
1151  '}' => '&#125;', // prevent unpaired language conversion syntax
1152  '[' => '&#91;',
1153  "''" => '&#39;&#39;',
1154  'ISBN' => '&#73;SBN',
1155  'RFC' => '&#82;FC',
1156  'PMID' => '&#80;MID',
1157  '|' => '&#124;',
1158  '__' => '&#95;_',
1159  ] );
1160 
1161  # Stupid hack
1162  $encValue = preg_replace_callback(
1163  '/((?i)' . wfUrlProtocols() . ')/',
1164  [ 'Sanitizer', 'armorLinksCallback' ],
1165  $encValue );
1166  return $encValue;
1167  }
1168 
1202  static function escapeId( $id, $options = [] ) {
1204  $options = (array)$options;
1205 
1206  $id = self::decodeCharReferences( $id );
1207 
1208  if ( $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) {
1209  $id = preg_replace( '/[ \t\n\r\f_\'"&#%]+/', '_', $id );
1210  $id = trim( $id, '_' );
1211  if ( $id === '' ) {
1212  // Must have been all whitespace to start with.
1213  return '_';
1214  } else {
1215  return $id;
1216  }
1217  }
1218 
1219  // HTML4-style escaping
1220  static $replace = [
1221  '%3A' => ':',
1222  '%' => '.'
1223  ];
1224 
1225  $id = urlencode( strtr( $id, ' ', '_' ) );
1226  $id = strtr( $id, $replace );
1227 
1228  if ( !preg_match( '/^[a-zA-Z]/', $id ) && !in_array( 'noninitial', $options ) ) {
1229  // Initial character must be a letter!
1230  $id = "x$id";
1231  }
1232  return $id;
1233  }
1234 
1250  public static function escapeIdForAttribute( $id, $mode = self::ID_PRIMARY ) {
1252 
1253  if ( !isset( $wgFragmentMode[$mode] ) ) {
1254  if ( $mode === self::ID_PRIMARY ) {
1255  throw new UnexpectedValueException( '$wgFragmentMode is configured with no primary mode' );
1256  }
1257  return false;
1258  }
1259 
1260  $internalMode = $wgFragmentMode[$mode];
1261 
1262  return self::escapeIdInternal( $id, $internalMode );
1263  }
1264 
1277  public static function escapeIdForLink( $id ) {
1279 
1280  if ( !isset( $wgFragmentMode[self::ID_PRIMARY] ) ) {
1281  throw new UnexpectedValueException( '$wgFragmentMode is configured with no primary mode' );
1282  }
1283 
1284  $mode = $wgFragmentMode[self::ID_PRIMARY];
1285 
1286  $id = self::escapeIdInternal( $id, $mode );
1287  $id = self::urlEscapeId( $id, $mode );
1288 
1289  return $id;
1290  }
1291 
1301  public static function escapeIdForExternalInterwiki( $id ) {
1303 
1304  $id = self::escapeIdInternal( $id, $wgExternalInterwikiFragmentMode );
1305  $id = self::urlEscapeId( $id, $wgExternalInterwikiFragmentMode );
1306 
1307  return $id;
1308  }
1309 
1317  private static function urlEscapeId( $id, $mode ) {
1318  if ( $mode === 'html5' ) {
1319  $id = urlencode( $id );
1320  $id = str_replace( '%3A', ':', $id );
1321  }
1322 
1323  return $id;
1324  }
1325 
1333  private static function escapeIdInternal( $id, $mode ) {
1334  $id = self::decodeCharReferences( $id );
1335 
1336  switch ( $mode ) {
1337  case 'html5':
1338  $id = str_replace( ' ', '_', $id );
1339  break;
1340  case 'legacy':
1341  // This corresponds to 'noninitial' mode of the old escapeId()
1342  static $replace = [
1343  '%3A' => ':',
1344  '%' => '.'
1345  ];
1346 
1347  $id = urlencode( str_replace( ' ', '_', $id ) );
1348  $id = strtr( $id, $replace );
1349  break;
1350  case 'html5-legacy':
1351  $id = preg_replace( '/[ \t\n\r\f_\'"&#%]+/', '_', $id );
1352  $id = trim( $id, '_' );
1353  if ( $id === '' ) {
1354  // Must have been all whitespace to start with.
1355  $id = '_';
1356  }
1357  break;
1358  default:
1359  throw new InvalidArgumentException( "Invalid mode '$mode' passed to '" . __METHOD__ );
1360  }
1361 
1362  return $id;
1363  }
1364 
1377  static function escapeIdReferenceList( $referenceString, $options = [] ) {
1378  # Explode the space delimited list string into an array of tokens
1379  $references = preg_split( '/\s+/', "{$referenceString}", -1, PREG_SPLIT_NO_EMPTY );
1380 
1381  # Escape each token as an id
1382  foreach ( $references as &$ref ) {
1383  $ref = self::escapeIdForAttribute( $ref );
1384  }
1385 
1386  # Merge the array back to a space delimited list string
1387  # If the array is empty, the result will be an empty string ('')
1388  $referenceString = implode( ' ', $references );
1389 
1390  return $referenceString;
1391  }
1392 
1404  static function escapeClass( $class ) {
1405  // Convert ugly stuff to underscores and kill underscores in ugly places
1406  return rtrim( preg_replace(
1407  [ '/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/', '/_+/' ],
1408  '_',
1409  $class ), '_' );
1410  }
1411 
1419  static function escapeHtmlAllowEntities( $html ) {
1420  $html = self::decodeCharReferences( $html );
1421  # It seems wise to escape ' as well as ", as a matter of course. Can't
1422  # hurt. Use ENT_SUBSTITUTE so that incorrectly truncated multibyte characters
1423  # don't cause the entire string to disappear.
1424  $html = htmlspecialchars( $html, ENT_QUOTES | ENT_SUBSTITUTE );
1425  return $html;
1426  }
1427 
1433  private static function armorLinksCallback( $matches ) {
1434  return str_replace( ':', '&#58;', $matches[1] );
1435  }
1436 
1445  public static function decodeTagAttributes( $text ) {
1446  if ( trim( $text ) == '' ) {
1447  return [];
1448  }
1449 
1450  $attribs = [];
1451  $pairs = [];
1452  if ( !preg_match_all(
1453  self::getAttribsRegex(),
1454  $text,
1455  $pairs,
1456  PREG_SET_ORDER ) ) {
1457  return $attribs;
1458  }
1459 
1460  foreach ( $pairs as $set ) {
1461  $attribute = strtolower( $set[1] );
1462  $value = self::getTagAttributeCallback( $set );
1463 
1464  // Normalize whitespace
1465  $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1466  $value = trim( $value );
1467 
1468  // Decode character references
1469  $attribs[$attribute] = self::decodeCharReferences( $value );
1470  }
1471  return $attribs;
1472  }
1473 
1481  public static function safeEncodeTagAttributes( $assoc_array ) {
1482  $attribs = [];
1483  foreach ( $assoc_array as $attribute => $value ) {
1484  $encAttribute = htmlspecialchars( $attribute );
1485  $encValue = self::safeEncodeAttribute( $value );
1486 
1487  $attribs[] = "$encAttribute=\"$encValue\"";
1488  }
1489  return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : '';
1490  }
1491 
1500  private static function getTagAttributeCallback( $set ) {
1501  if ( isset( $set[5] ) ) {
1502  # No quotes.
1503  return $set[5];
1504  } elseif ( isset( $set[4] ) ) {
1505  # Single-quoted
1506  return $set[4];
1507  } elseif ( isset( $set[3] ) ) {
1508  # Double-quoted
1509  return $set[3];
1510  } elseif ( !isset( $set[2] ) ) {
1511  # In XHTML, attributes must have a value so return an empty string.
1512  # See "Empty attribute syntax",
1513  # https://www.w3.org/TR/html5/syntax.html#syntax-attribute-name
1514  return "";
1515  } else {
1516  throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1517  }
1518  }
1519 
1524  private static function normalizeWhitespace( $text ) {
1525  return preg_replace(
1526  '/\r\n|[\x20\x0d\x0a\x09]/',
1527  ' ',
1528  $text );
1529  }
1530 
1540  return trim( preg_replace( '/[ _]+/', ' ', $section ) );
1541  }
1542 
1558  static function normalizeCharReferences( $text ) {
1559  return preg_replace_callback(
1560  self::CHAR_REFS_REGEX,
1561  [ 'Sanitizer', 'normalizeCharReferencesCallback' ],
1562  $text );
1563  }
1564 
1570  $ret = null;
1571  if ( $matches[1] != '' ) {
1572  $ret = self::normalizeEntity( $matches[1] );
1573  } elseif ( $matches[2] != '' ) {
1574  $ret = self::decCharReference( $matches[2] );
1575  } elseif ( $matches[3] != '' ) {
1576  $ret = self::hexCharReference( $matches[3] );
1577  }
1578  if ( is_null( $ret ) ) {
1579  return htmlspecialchars( $matches[0] );
1580  } else {
1581  return $ret;
1582  }
1583  }
1584 
1595  static function normalizeEntity( $name ) {
1596  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1597  return '&' . self::$htmlEntityAliases[$name] . ';';
1598  } elseif ( in_array( $name, [ 'lt', 'gt', 'amp', 'quot' ] ) ) {
1599  return "&$name;";
1600  } elseif ( isset( self::$htmlEntities[$name] ) ) {
1601  return '&#' . self::$htmlEntities[$name] . ';';
1602  } else {
1603  return "&amp;$name;";
1604  }
1605  }
1606 
1611  static function decCharReference( $codepoint ) {
1612  $point = intval( $codepoint );
1613  if ( self::validateCodepoint( $point ) ) {
1614  return sprintf( '&#%d;', $point );
1615  } else {
1616  return null;
1617  }
1618  }
1619 
1624  static function hexCharReference( $codepoint ) {
1625  $point = hexdec( $codepoint );
1626  if ( self::validateCodepoint( $point ) ) {
1627  return sprintf( '&#x%x;', $point );
1628  } else {
1629  return null;
1630  }
1631  }
1632 
1639  private static function validateCodepoint( $codepoint ) {
1640  # U+000C is valid in HTML5 but not allowed in XML.
1641  # U+000D is valid in XML but not allowed in HTML5.
1642  # U+007F - U+009F are disallowed in HTML5 (control characters).
1643  return $codepoint == 0x09
1644  || $codepoint == 0x0a
1645  || ( $codepoint >= 0x20 && $codepoint <= 0x7e )
1646  || ( $codepoint >= 0xa0 && $codepoint <= 0xd7ff )
1647  || ( $codepoint >= 0xe000 && $codepoint <= 0xfffd )
1648  || ( $codepoint >= 0x10000 && $codepoint <= 0x10ffff );
1649  }
1650 
1658  public static function decodeCharReferences( $text ) {
1659  return preg_replace_callback(
1660  self::CHAR_REFS_REGEX,
1661  [ 'Sanitizer', 'decodeCharReferencesCallback' ],
1662  $text );
1663  }
1664 
1675  public static function decodeCharReferencesAndNormalize( $text ) {
1677  $text = preg_replace_callback(
1678  self::CHAR_REFS_REGEX,
1679  [ 'Sanitizer', 'decodeCharReferencesCallback' ],
1680  $text,
1681  -1, //limit
1682  $count
1683  );
1684 
1685  if ( $count ) {
1686  return $wgContLang->normalize( $text );
1687  } else {
1688  return $text;
1689  }
1690  }
1691 
1697  if ( $matches[1] != '' ) {
1698  return self::decodeEntity( $matches[1] );
1699  } elseif ( $matches[2] != '' ) {
1700  return self::decodeChar( intval( $matches[2] ) );
1701  } elseif ( $matches[3] != '' ) {
1702  return self::decodeChar( hexdec( $matches[3] ) );
1703  }
1704  # Last case should be an ampersand by itself
1705  return $matches[0];
1706  }
1707 
1715  static function decodeChar( $codepoint ) {
1716  if ( self::validateCodepoint( $codepoint ) ) {
1717  return UtfNormal\Utils::codepointToUtf8( $codepoint );
1718  } else {
1720  }
1721  }
1722 
1731  static function decodeEntity( $name ) {
1732  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1733  $name = self::$htmlEntityAliases[$name];
1734  }
1735  if ( isset( self::$htmlEntities[$name] ) ) {
1736  return UtfNormal\Utils::codepointToUtf8( self::$htmlEntities[$name] );
1737  } else {
1738  return "&$name;";
1739  }
1740  }
1741 
1748  static function attributeWhitelist( $element ) {
1749  $list = self::setupAttributeWhitelist();
1750  return isset( $list[$element] )
1751  ? $list[$element]
1752  : [];
1753  }
1754 
1760  static function setupAttributeWhitelist() {
1761  static $whitelist;
1762 
1763  if ( $whitelist !== null ) {
1764  return $whitelist;
1765  }
1766 
1767  $common = [
1768  # HTML
1769  'id',
1770  'class',
1771  'style',
1772  'lang',
1773  'dir',
1774  'title',
1775 
1776  # WAI-ARIA
1777  'aria-describedby',
1778  'aria-flowto',
1779  'aria-label',
1780  'aria-labelledby',
1781  'aria-owns',
1782  'role',
1783 
1784  # RDFa
1785  # These attributes are specified in section 9 of
1786  # https://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1787  'about',
1788  'property',
1789  'resource',
1790  'datatype',
1791  'typeof',
1792 
1793  # Microdata. These are specified by
1794  # https://html.spec.whatwg.org/multipage/microdata.html#the-microdata-model
1795  'itemid',
1796  'itemprop',
1797  'itemref',
1798  'itemscope',
1799  'itemtype',
1800  ];
1801 
1802  $block = array_merge( $common, [ 'align' ] );
1803  $tablealign = [ 'align', 'valign' ];
1804  $tablecell = [
1805  'abbr',
1806  'axis',
1807  'headers',
1808  'scope',
1809  'rowspan',
1810  'colspan',
1811  'nowrap', # deprecated
1812  'width', # deprecated
1813  'height', # deprecated
1814  'bgcolor', # deprecated
1815  ];
1816 
1817  # Numbers refer to sections in HTML 4.01 standard describing the element.
1818  # See: https://www.w3.org/TR/html4/
1819  $whitelist = [
1820  # 7.5.4
1821  'div' => $block,
1822  'center' => $common, # deprecated
1823  'span' => $common,
1824 
1825  # 7.5.5
1826  'h1' => $block,
1827  'h2' => $block,
1828  'h3' => $block,
1829  'h4' => $block,
1830  'h5' => $block,
1831  'h6' => $block,
1832 
1833  # 7.5.6
1834  # address
1835 
1836  # 8.2.4
1837  'bdo' => $common,
1838 
1839  # 9.2.1
1840  'em' => $common,
1841  'strong' => $common,
1842  'cite' => $common,
1843  'dfn' => $common,
1844  'code' => $common,
1845  'samp' => $common,
1846  'kbd' => $common,
1847  'var' => $common,
1848  'abbr' => $common,
1849  # acronym
1850 
1851  # 9.2.2
1852  'blockquote' => array_merge( $common, [ 'cite' ] ),
1853  'q' => array_merge( $common, [ 'cite' ] ),
1854 
1855  # 9.2.3
1856  'sub' => $common,
1857  'sup' => $common,
1858 
1859  # 9.3.1
1860  'p' => $block,
1861 
1862  # 9.3.2
1863  'br' => array_merge( $common, [ 'clear' ] ),
1864 
1865  # https://www.w3.org/TR/html5/text-level-semantics.html#the-wbr-element
1866  'wbr' => $common,
1867 
1868  # 9.3.4
1869  'pre' => array_merge( $common, [ 'width' ] ),
1870 
1871  # 9.4
1872  'ins' => array_merge( $common, [ 'cite', 'datetime' ] ),
1873  'del' => array_merge( $common, [ 'cite', 'datetime' ] ),
1874 
1875  # 10.2
1876  'ul' => array_merge( $common, [ 'type' ] ),
1877  'ol' => array_merge( $common, [ 'type', 'start', 'reversed' ] ),
1878  'li' => array_merge( $common, [ 'type', 'value' ] ),
1879 
1880  # 10.3
1881  'dl' => $common,
1882  'dd' => $common,
1883  'dt' => $common,
1884 
1885  # 11.2.1
1886  'table' => array_merge( $common,
1887  [ 'summary', 'width', 'border', 'frame',
1888  'rules', 'cellspacing', 'cellpadding',
1889  'align', 'bgcolor',
1890  ] ),
1891 
1892  # 11.2.2
1893  'caption' => $block,
1894 
1895  # 11.2.3
1896  'thead' => $common,
1897  'tfoot' => $common,
1898  'tbody' => $common,
1899 
1900  # 11.2.4
1901  'colgroup' => array_merge( $common, [ 'span' ] ),
1902  'col' => array_merge( $common, [ 'span' ] ),
1903 
1904  # 11.2.5
1905  'tr' => array_merge( $common, [ 'bgcolor' ], $tablealign ),
1906 
1907  # 11.2.6
1908  'td' => array_merge( $common, $tablecell, $tablealign ),
1909  'th' => array_merge( $common, $tablecell, $tablealign ),
1910 
1911  # 12.2
1912  # NOTE: <a> is not allowed directly, but the attrib
1913  # whitelist is used from the Parser object
1914  'a' => array_merge( $common, [ 'href', 'rel', 'rev' ] ), # rel/rev esp. for RDFa
1915 
1916  # 13.2
1917  # Not usually allowed, but may be used for extension-style hooks
1918  # such as <math> when it is rasterized, or if $wgAllowImageTag is
1919  # true
1920  'img' => array_merge( $common, [ 'alt', 'src', 'width', 'height', 'srcset' ] ),
1921 
1922  'video' => array_merge( $common, [ 'poster', 'controls', 'preload', 'width', 'height' ] ),
1923  'source' => array_merge( $common, [ 'type', 'src' ] ),
1924  'track' => array_merge( $common, [ 'type', 'src', 'srclang', 'kind', 'label' ] ),
1925 
1926  # 15.2.1
1927  'tt' => $common,
1928  'b' => $common,
1929  'i' => $common,
1930  'big' => $common,
1931  'small' => $common,
1932  'strike' => $common,
1933  's' => $common,
1934  'u' => $common,
1935 
1936  # 15.2.2
1937  'font' => array_merge( $common, [ 'size', 'color', 'face' ] ),
1938  # basefont
1939 
1940  # 15.3
1941  'hr' => array_merge( $common, [ 'width' ] ),
1942 
1943  # HTML Ruby annotation text module, simple ruby only.
1944  # https://www.w3.org/TR/html5/text-level-semantics.html#the-ruby-element
1945  'ruby' => $common,
1946  # rbc
1947  'rb' => $common,
1948  'rp' => $common,
1949  'rt' => $common, # array_merge( $common, array( 'rbspan' ) ),
1950  'rtc' => $common,
1951 
1952  # MathML root element, where used for extensions
1953  # 'title' may not be 100% valid here; it's XHTML
1954  # https://www.w3.org/TR/REC-MathML/
1955  'math' => [ 'class', 'style', 'id', 'title' ],
1956 
1957  // HTML 5 section 4.5
1958  'figure' => $common,
1959  'figcaption' => $common,
1960 
1961  # HTML 5 section 4.6
1962  'bdi' => $common,
1963 
1964  # HTML5 elements, defined by:
1965  # https://html.spec.whatwg.org/multipage/semantics.html#the-data-element
1966  'data' => array_merge( $common, [ 'value' ] ),
1967  'time' => array_merge( $common, [ 'datetime' ] ),
1968  'mark' => $common,
1969 
1970  // meta and link are only permitted by removeHTMLtags when Microdata
1971  // is enabled so we don't bother adding a conditional to hide these
1972  // Also meta and link are only valid in WikiText as Microdata elements
1973  // (ie: validateTag rejects tags missing the attributes needed for Microdata)
1974  // So we don't bother including $common attributes that have no purpose.
1975  'meta' => [ 'itemprop', 'content' ],
1976  'link' => [ 'itemprop', 'href', 'title' ],
1977  ];
1978 
1979  return $whitelist;
1980  }
1981 
1992  static function stripAllTags( $text ) {
1993  # Actual <tags>
1994  $text = StringUtils::delimiterReplace( '<', '>', '', $text );
1995 
1996  # Normalize &entities and whitespace
1997  $text = self::decodeCharReferences( $text );
1998  $text = self::normalizeWhitespace( $text );
1999 
2000  return $text;
2001  }
2002 
2012  static function hackDocType() {
2013  $out = "<!DOCTYPE html [\n";
2014  foreach ( self::$htmlEntities as $entity => $codepoint ) {
2015  $out .= "<!ENTITY $entity \"&#$codepoint;\">";
2016  }
2017  $out .= "]>\n";
2018  return $out;
2019  }
2020 
2025  static function cleanUrl( $url ) {
2026  # Normalize any HTML entities in input. They will be
2027  # re-escaped by makeExternalLink().
2028  $url = self::decodeCharReferences( $url );
2029 
2030  # Escape any control characters introduced by the above step
2031  $url = preg_replace_callback( '/[\][<>"\\x00-\\x20\\x7F\|]/',
2032  [ __CLASS__, 'cleanUrlCallback' ], $url );
2033 
2034  # Validate hostname portion
2035  $matches = [];
2036  if ( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
2037  list( /* $whole */, $protocol, $host, $rest ) = $matches;
2038 
2039  // Characters that will be ignored in IDNs.
2040  // https://tools.ietf.org/html/rfc3454#section-3.1
2041  // Strip them before further processing so blacklists and such work.
2042  $strip = "/
2043  \\s| # general whitespace
2044  \xc2\xad| # 00ad SOFT HYPHEN
2045  \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
2046  \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
2047  \xe2\x81\xa0| # 2060 WORD JOINER
2048  \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
2049  \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
2050  \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
2051  \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
2052  \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
2053  \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
2054  \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
2055  [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe0f VARIATION SELECTOR-1-16
2056  /xuD";
2057 
2058  $host = preg_replace( $strip, '', $host );
2059 
2060  // IPv6 host names are bracketed with []. Url-decode these.
2061  if ( substr_compare( "//%5B", $host, 0, 5 ) === 0 &&
2062  preg_match( '!^//%5B([0-9A-Fa-f:.]+)%5D((:\d+)?)$!', $host, $matches )
2063  ) {
2064  $host = '//[' . $matches[1] . ']' . $matches[2];
2065  }
2066 
2067  // @todo FIXME: Validate hostnames here
2068 
2069  return $protocol . $host . $rest;
2070  } else {
2071  return $url;
2072  }
2073  }
2074 
2079  static function cleanUrlCallback( $matches ) {
2080  return urlencode( $matches[0] );
2081  }
2082 
2111  public static function validateEmail( $addr ) {
2112  $result = null;
2113  if ( !Hooks::run( 'isValidEmailAddr', [ $addr, &$result ] ) ) {
2114  return $result;
2115  }
2116 
2117  // Please note strings below are enclosed in brackets [], this make the
2118  // hyphen "-" a range indicator. Hence it is double backslashed below.
2119  // See T28948
2120  $rfc5322_atext = "a-z0-9!#$%&'*+\\-\/=?^_`{|}~";
2121  $rfc1034_ldh_str = "a-z0-9\\-";
2122 
2123  $html5_email_regexp = "/
2124  ^ # start of string
2125  [$rfc5322_atext\\.]+ # user part which is liberal :p
2126  @ # 'apostrophe'
2127  [$rfc1034_ldh_str]+ # First domain part
2128  (\\.[$rfc1034_ldh_str]+)* # Following part prefixed with a dot
2129  $ # End of string
2130  /ix"; // case Insensitive, eXtended
2131 
2132  return (bool)preg_match( $html5_email_regexp, $addr );
2133  }
2134 }
utf8ToCodepoint($char)
Determine the Unicode codepoint of a single-character UTF-8 sequence.
$wgExternalInterwikiFragmentMode
Which ID escaping mode should be used for external interwiki links? See documentation for $wgFragment...
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if that
Definition: deferred.txt:11
static decCharReference($codepoint)
Definition: Sanitizer.php:1611
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses & $html
Definition: hooks.txt:1964
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global list
Definition: deferred.txt:11
static decodeTagAttributes($text)
Return an associative array of attribute names and values from a partial tag string.
Definition: Sanitizer.php:1445
this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that probably a stub it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output $out
Definition: hooks.txt:782
static normalizeEntity($name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the equivalent numeric entity re...
Definition: Sanitizer.php:1595
the array() calling protocol came about after MediaWiki 1.4rc1.
static safeEncodeTagAttributes($assoc_array)
Build a partial tag string from an associative array of attribute names and values as returned by dec...
Definition: Sanitizer.php:1481
static normalizeCharReferencesCallback($matches)
Definition: Sanitizer.php:1569
const ID_PRIMARY
Tells escapeUrlForHtml() to encode the ID using the wiki's primary encoding.
Definition: Sanitizer.php:64
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses & $ret
Definition: hooks.txt:1964
static setupAttributeWhitelist()
Foreach array key (an allowed HTML element), return an array of allowed attributes.
Definition: Sanitizer.php:1760
static isEnabled()
Definition: MWTidy.php:79
static fixTagAttributes($text, $element, $sorted=false)
Take a tag soup fragment listing an HTML element's attributes and normalize it to well-formed XML...
Definition: Sanitizer.php:1100
static decodeCharReferencesCallback($matches)
Definition: Sanitizer.php:1696
static cssDecodeCallback($matches)
Definition: Sanitizer.php:1058
you don t have to do a grep find to see where the $wgReverseTitle variable is used
Definition: hooks.txt:115
null for the local wiki Added in
Definition: hooks.txt:1580
$value
static escapeClass($class)
Given a value, escape it so that it can be used as a CSS class and return it.
Definition: Sanitizer.php:1404
static hackDocType()
Hack up a private DOCTYPE with HTML's standard entity declarations.
Definition: Sanitizer.php:2012
static cleanUrl($url)
Definition: Sanitizer.php:2025
static stripAllTags($text)
Take a fragment of (potentially invalid) HTML and return a version with any tags removed, encoded as plain text.
Definition: Sanitizer.php:1992
when a variable name is used in a it is silently declared as a new local masking the global
Definition: design.txt:93
const UTF8_REPLACEMENT
static hexCharReference($codepoint)
Definition: Sanitizer.php:1624
static validateTagAttributes($attribs, $element)
Take an array of attribute names and values and normalize or discard illegal values for the given ele...
Definition: Sanitizer.php:763
static normalizeWhitespace($text)
Definition: Sanitizer.php:1524
static isReservedDataAttribute($attr)
Given an attribute name, checks whether it is a reserved data attribute (such as data-mw-foo) which i...
Definition: Sanitizer.php:880
static static static $attribsRegex
Lazy-initialised attributes regex, see getAttribsRegex()
Definition: Sanitizer.php:340
The index of the header message $result[1]=The index of the body text message $result[2 through n]=Parameters passed to body text message.Please note the header message cannot receive/use parameters. 'ImportHandleLogItemXMLTag':When parsing a XML tag in a log item.Return false to stop further processing of the tag $reader:XMLReader object $logInfo:Array of information 'ImportHandlePageXMLTag':When parsing a XML tag in a page.Return false to stop further processing of the tag $reader:XMLReader object &$pageInfo:Array of information 'ImportHandleRevisionXMLTag':When parsing a XML tag in a page revision.Return false to stop further processing of the tag $reader:XMLReader object $pageInfo:Array of page information $revisionInfo:Array of revision information 'ImportHandleToplevelXMLTag':When parsing a top level XML tag.Return false to stop further processing of the tag $reader:XMLReader object 'ImportHandleUploadXMLTag':When parsing a XML tag in a file upload.Return false to stop further processing of the tag $reader:XMLReader object $revisionInfo:Array of information 'ImportLogInterwikiLink':Hook to change the interwiki link used in log entries and edit summaries for transwiki imports.&$fullInterwikiPrefix:Interwiki prefix, may contain colons.&$pageTitle:String that contains page title. 'ImportSources':Called when reading from the $wgImportSources configuration variable.Can be used to lazy-load the import sources list.&$importSources:The value of $wgImportSources.Modify as necessary.See the comment in DefaultSettings.php for the detail of how to structure this array. 'InfoAction':When building information to display on the action=info page.$context:IContextSource object &$pageInfo:Array of information 'InitializeArticleMaybeRedirect':MediaWiki check to see if title is a redirect.&$title:Title object for the current page &$request:WebRequest &$ignoreRedirect:boolean to skip redirect check &$target:Title/string of redirect target &$article:Article object 'InternalParseBeforeLinks':during Parser's internalParse method before links but after nowiki/noinclude/includeonly/onlyinclude and other processings.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InternalParseBeforeSanitize':during Parser's internalParse method just before the parser removes unwanted/dangerous HTML tags and after nowiki/noinclude/includeonly/onlyinclude and other processings.Ideal for syntax-extensions after template/parser function execution which respect nowiki and HTML-comments.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InterwikiLoadPrefix':When resolving if a given prefix is an interwiki or not.Return true without providing an interwiki to continue interwiki search.$prefix:interwiki prefix we are looking for.&$iwData:output array describing the interwiki with keys iw_url, iw_local, iw_trans and optionally iw_api and iw_wikiid. 'InvalidateEmailComplete':Called after a user's email has been invalidated successfully.$user:user(object) whose email is being invalidated 'IRCLineURL':When constructing the URL to use in an IRC notification.Callee may modify $url and $query, URL will be constructed as $url.$query &$url:URL to index.php &$query:Query string $rc:RecentChange object that triggered url generation 'IsFileCacheable':Override the result of Article::isFileCacheable()(if true) &$article:article(object) being checked 'IsTrustedProxy':Override the result of IP::isTrustedProxy() &$ip:IP being check &$result:Change this value to override the result of IP::isTrustedProxy() 'IsUploadAllowedFromUrl':Override the result of UploadFromUrl::isAllowedUrl() $url:URL used to upload from &$allowed:Boolean indicating if uploading is allowed for given URL 'isValidEmailAddr':Override the result of Sanitizer::validateEmail(), for instance to return false if the domain name doesn't match your organization.$addr:The e-mail address entered by the user &$result:Set this and return false to override the internal checks 'isValidPassword':Override the result of User::isValidPassword() $password:The password entered by the user &$result:Set this and return false to override the internal checks $user:User the password is being validated for 'Language::getMessagesFileName':$code:The language code or the language we're looking for a messages file for &$file:The messages file path, you can override this to change the location. 'LanguageGetMagic':DEPRECATED!Use $magicWords in a file listed in $wgExtensionMessagesFiles instead.Use this to define synonyms of magic words depending of the language &$magicExtensions:associative array of magic words synonyms $lang:language code(string) 'LanguageGetNamespaces':Provide custom ordering for namespaces or remove namespaces.Do not use this hook to add namespaces.Use CanonicalNamespaces for that.&$namespaces:Array of namespaces indexed by their numbers 'LanguageGetSpecialPageAliases':DEPRECATED!Use $specialPageAliases in a file listed in $wgExtensionMessagesFiles instead.Use to define aliases of special pages names depending of the language &$specialPageAliases:associative array of magic words synonyms $lang:language code(string) 'LanguageGetTranslatedLanguageNames':Provide translated language names.&$names:array of language code=> language name $code:language of the preferred translations 'LanguageLinks':Manipulate a page's language links.This is called in various places to allow extensions to define the effective language links for a page.$title:The page's Title.&$links:Array with elements of the form"language:title"in the order that they will be output.&$linkFlags:Associative array mapping prefixed links to arrays of flags.Currently unused, but planned to provide support for marking individual language links in the UI, e.g.for featured articles. 'LanguageSelector':Hook to change the language selector available on a page.$out:The output page.$cssClassName:CSS class name of the language selector. 'LinkBegin':DEPRECATED!Use HtmlPageLinkRendererBegin instead.Used when generating internal and interwiki links in Linker::link(), before processing starts.Return false to skip default processing and return $ret.See documentation for Linker::link() for details on the expected meanings of parameters.$skin:the Skin object $target:the Title that the link is pointing to &$html:the contents that the< a > tag should have(raw HTML) $result
Definition: hooks.txt:1962
if($line===false) $args
Definition: cdb.php:63
const ID_FALLBACK
Tells escapeUrlForHtml() to encode the ID using the fallback encoding, or return false if no fallback...
Definition: Sanitizer.php:72
static decodeCharReferences($text)
Decode any character references, numeric or named entities, in the text and return a UTF-8 string...
Definition: Sanitizer.php:1658
static validateCodepoint($codepoint)
Returns true if a given Unicode codepoint is a valid character in both HTML5 and XML.
Definition: Sanitizer.php:1639
const EVIL_URI_PATTERN
Blacklist for evil uris like javascript: WARNING: DO NOT use this in any place that actually requires...
Definition: Sanitizer.php:56
static escapeIdForExternalInterwiki($id)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid URL...
Definition: Sanitizer.php:1301
const ELEMENT_BITS_REGEX
Acceptable tag name charset from HTML5 parsing spec https://www.w3.org/TR/html5/syntax.html#tag-open-state.
Definition: Sanitizer.php:46
Unicode normalization routines for working with UTF-8 strings.
Definition: UtfNormal.php:48
static decodeChar($codepoint)
Return UTF-8 string for a codepoint if that is a valid character reference, otherwise U+FFFD REPLACEM...
Definition: Sanitizer.php:1715
static normalizeSectionNameWhitespace($section)
Normalizes whitespace in a section name, such as might be returned by Parser::stripSectionName(), for use in the id's that are used for section links.
Definition: Sanitizer.php:1539
static delimiterReplace($startDelim, $endDelim, $replace, $subject, $flags= '')
Perform an operation equivalent to preg_replace() with flags.
static urlEscapeId($id, $mode)
Helper for escapeIdFor*() functions.
Definition: Sanitizer.php:1317
static $htmlEntities
List of all named character entities defined in HTML 4.01 https://www.w3.org/TR/html4/sgml/entities.html As well as ' which is only defined starting in XHTML1.
Definition: Sanitizer.php:79
static attributeWhitelist($element)
Fetch the whitelist of acceptable attributes for a given element name.
Definition: Sanitizer.php:1748
this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist Do not use this to implement individual filters if they are compatible with the ChangesListFilter and ChangesListFilterGroup structure use sub classes of those in conjunction with the ChangesListSpecialPageStructuredFilters hook This hook can be used to implement filters that do not implement that or custom behavior that is not an individual filter e g Watchlist and Watchlist you will want to construct new ChangesListBooleanFilter or ChangesListStringOptionsFilter objects When constructing you specify which group they belong to You can reuse existing or create your you must register them with $special registerFilterGroup removed from all revisions and log entries to which it was applied This gives extensions a chance to take it off their books as the deletion has already been partly carried out by this point or something similar the user will be unable to create the tag set and then return false from the hook function Ensure you consume the ChangeTagAfterDelete hook to carry out custom deletion actions as context called by AbstractContent::getParserOutput May be used to override the normal model specific rendering of page content as context as context $options
Definition: hooks.txt:1048
static escapeHtmlAllowEntities($html)
Given HTML input, escape with htmlspecialchars but un-escape entities.
Definition: Sanitizer.php:1419
static validateTag($params, $element)
Takes attribute names and values for a tag and the tag name and validates that the tag is allowed to ...
Definition: Sanitizer.php:727
static mergeAttributes($a, $b)
Merge two sets of HTML attributes.
Definition: Sanitizer.php:901
const CHAR_REFS_REGEX
Regular expression to match various types of character references in Sanitizer::normalizeCharReferenc...
Definition: Sanitizer.php:36
static getRecognizedTagData($extratags=[], $removetags=[])
Return the various lists of recognized tags.
Definition: Sanitizer.php:380
$params
$wgFragmentMode
How should section IDs be encoded? This array can contain 1 or 2 elements, each of them can be one of...
static validateAttributes($attribs, $whitelist)
Take an array of attribute names and values and normalize or discard illegal values for the given whi...
Definition: Sanitizer.php:783
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses after processing & $attribs
Definition: hooks.txt:1964
static decodeCharReferencesAndNormalize($text)
Decode any character references, numeric or named entities, in the next and normalize the resulting s...
Definition: Sanitizer.php:1675
static run($event, array $args=[], $deprecatedVersion=null)
Call hook functions defined in Hooks::register and $wgHooks.
Definition: Hooks.php:131
static static $htmlEntityAliases
Character entity aliases accepted by MediaWiki.
Definition: Sanitizer.php:338
static escapeIdReferenceList($referenceString, $options=[])
Given a string containing a space delimited list of ids, escape each id to match ids escaped by the e...
Definition: Sanitizer.php:1377
Apache License January AND DISTRIBUTION Definitions License shall mean the terms and conditions for and distribution as defined by Sections through of this document Licensor shall mean the copyright owner or entity authorized by the copyright owner that is granting the License Legal Entity shall mean the union of the acting entity and all other entities that control are controlled by or are under common control with that entity For the purposes of this definition control direct or to cause the direction or management of such whether by contract or including but not limited to software source documentation and configuration files Object form shall mean any form resulting from mechanical transformation or translation of a Source including but not limited to compiled object generated and conversions to other media types Work shall mean the work of whether in Source or Object made available under the as indicated by a copyright notice that is included in or attached to the whether in Source or Object that is based or other modifications as a an original work of authorship For the purposes of this Derivative Works shall not include works that remain separable or merely the Work and Derivative Works thereof Contribution shall mean any work of including the original version of the Work and any modifications or additions to that Work or Derivative Works that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner For the purposes of this submitted means any form of or written communication sent to the Licensor or its including but not limited to communication on electronic mailing source code control and issue tracking systems that are managed by
static cleanUrlCallback($matches)
Definition: Sanitizer.php:2079
This document is intended to provide useful advice for parties seeking to redistribute MediaWiki to end users It s targeted particularly at maintainers for Linux since it s been observed that distribution packages of MediaWiki often break We ve consistently had to recommend that users seeking support use official tarballs instead of their distribution s and this often solves whatever problem the user is having It would be nice if this could such as
Definition: distributors.txt:9
this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist Do not use this to implement individual filters if they are compatible with the ChangesListFilter and ChangesListFilterGroup structure use sub classes of those in conjunction with the ChangesListSpecialPageStructuredFilters hook This hook can be used to implement filters that do not implement that or custom behavior that is not an individual filter e g Watchlist and Watchlist you will want to construct new ChangesListBooleanFilter or ChangesListStringOptionsFilter objects When constructing them
Definition: hooks.txt:989
usually copyright or history_copyright This message must be in HTML not wikitext if the section is included from a template $section
Definition: hooks.txt:2981
static armorLinksCallback($matches)
Regex replace callback for armoring links against further processing.
Definition: Sanitizer.php:1433
static escapeId($id, $options=[])
Given a value, escape it so that it can be used in an id attribute and return it. ...
Definition: Sanitizer.php:1202
wfUrlProtocols($includeProtocolRelative=true)
Returns a regular expression of url protocols.
static normalizeCss($value)
Normalize CSS into a format we can easily search for hostile input.
Definition: Sanitizer.php:923
const XMLNS_ATTRIBUTE_PATTERN
Definition: Sanitizer.php:57
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency which acts as the top level factory for services in MediaWiki which can be used to gain access to default instances of various services MediaWikiServices however also allows new services to be defined and default services to be redefined Services are defined or redefined by providing a callback the instantiator that will return a new instance of the service When it will create an instance of MediaWikiServices and populate it with the services defined in the files listed by thereby bootstrapping the DI framework Per $wgServiceWiringFiles lists includes ServiceWiring php
Definition: injection.txt:35
static escapeIdForAttribute($id, $mode=self::ID_PRIMARY)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid HTM...
Definition: Sanitizer.php:1250
static removeHTMLtags($text, $processCallback=null, $args=[], $extratags=[], $removetags=[], $warnCallback=null)
Cleans up HTML, removes dangerous tags and attributes, and removes HTML comments. ...
Definition: Sanitizer.php:477
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if so it s not worth the trouble Since there is a job queue in the jobs table
Definition: deferred.txt:11
static normalizeCharReferences($text)
Ensure that any entities and character references are legal for XML and XHTML specifically.
Definition: Sanitizer.php:1558
static escapeIdForLink($id)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid URL...
Definition: Sanitizer.php:1277
this class mediates it Skin Encapsulates a look and feel for the wiki All of the functions that render HTML and make choices about how to render it are here and are called from various other places when and is meant to be subclassed with other skins that may override some of its functions The User object contains a reference to a and so rather than having a global skin object we just rely on the global User and get the skin with $wgUser and also has some character encoding functions and other locale stuff The current user interface language is instantiated as and the local content language as $wgContLang
Definition: design.txt:56
$wgExperimentalHtmlIds
Abandoned experiment with HTML5-style ID escaping.
Allows to change the fields on the form that will be generated $name
Definition: hooks.txt:302
static removeHTMLcomments($text)
Remove '', and everything between.
Definition: Sanitizer.php:681
static getAttribsRegex()
Regular expression to match HTML/XML attribute pairs within a tag.
Definition: Sanitizer.php:355
codepointToUtf8($codepoint)
Return UTF-8 sequence for a given Unicode code point.
static validateEmail($addr)
Does a string look like an e-mail address?
Definition: Sanitizer.php:2111
static checkCss($value)
Pick apart some CSS and check it for forbidden or unsafe structures.
Definition: Sanitizer.php:1030
static getTagAttributeCallback($set)
Pick the appropriate attribute value from a match set from the attribs regex matches.
Definition: Sanitizer.php:1500
</td >< td > &</td >< td > t want your writing to be edited mercilessly and redistributed at will
static escapeIdInternal($id, $mode)
Helper for escapeIdFor*() functions.
Definition: Sanitizer.php:1333
static decodeEntity($name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the UTF-8 encoding of that chara...
Definition: Sanitizer.php:1731
static safeEncodeAttribute($text)
Encode an attribute value for HTML tags, with extra armoring against further wiki processing...
Definition: Sanitizer.php:1141
static configuration should be added through ResourceLoaderGetConfigVars instead & $vars
Definition: hooks.txt:2197
static encodeAttribute($text)
Encode an attribute value for HTML output.
Definition: Sanitizer.php:1120
$matches