MediaWiki  master
Sanitizer.php
Go to the documentation of this file.
1 <?php
31 class Sanitizer {
37  '/&([A-Za-z0-9\x80-\xff]+);
38  |&\#([0-9]+);
39  |&\#[xX]([0-9A-Fa-f]+);
40  |(&)/x';
41 
46  const ELEMENT_BITS_REGEX = '!^(/?)([A-Za-z][^\t\n\v />\0]*+)([^>]*?)(/?>)([^<]*)$!';
47 
56  const EVIL_URI_PATTERN = '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i';
57  const XMLNS_ATTRIBUTE_PATTERN = "/^xmlns:[:A-Z_a-z-.0-9]+$/";
58 
64  const ID_PRIMARY = 0;
65 
72  const ID_FALLBACK = 1;
73 
79  private static $htmlEntities = [
80  'Aacute' => 193,
81  'aacute' => 225,
82  'Acirc' => 194,
83  'acirc' => 226,
84  'acute' => 180,
85  'AElig' => 198,
86  'aelig' => 230,
87  'Agrave' => 192,
88  'agrave' => 224,
89  'alefsym' => 8501,
90  'Alpha' => 913,
91  'alpha' => 945,
92  'amp' => 38,
93  'and' => 8743,
94  'ang' => 8736,
95  'apos' => 39, // New in XHTML & HTML 5; avoid in output for compatibility with IE.
96  'Aring' => 197,
97  'aring' => 229,
98  'asymp' => 8776,
99  'Atilde' => 195,
100  'atilde' => 227,
101  'Auml' => 196,
102  'auml' => 228,
103  'bdquo' => 8222,
104  'Beta' => 914,
105  'beta' => 946,
106  'brvbar' => 166,
107  'bull' => 8226,
108  'cap' => 8745,
109  'Ccedil' => 199,
110  'ccedil' => 231,
111  'cedil' => 184,
112  'cent' => 162,
113  'Chi' => 935,
114  'chi' => 967,
115  'circ' => 710,
116  'clubs' => 9827,
117  'cong' => 8773,
118  'copy' => 169,
119  'crarr' => 8629,
120  'cup' => 8746,
121  'curren' => 164,
122  'dagger' => 8224,
123  'Dagger' => 8225,
124  'darr' => 8595,
125  'dArr' => 8659,
126  'deg' => 176,
127  'Delta' => 916,
128  'delta' => 948,
129  'diams' => 9830,
130  'divide' => 247,
131  'Eacute' => 201,
132  'eacute' => 233,
133  'Ecirc' => 202,
134  'ecirc' => 234,
135  'Egrave' => 200,
136  'egrave' => 232,
137  'empty' => 8709,
138  'emsp' => 8195,
139  'ensp' => 8194,
140  'Epsilon' => 917,
141  'epsilon' => 949,
142  'equiv' => 8801,
143  'Eta' => 919,
144  'eta' => 951,
145  'ETH' => 208,
146  'eth' => 240,
147  'Euml' => 203,
148  'euml' => 235,
149  'euro' => 8364,
150  'exist' => 8707,
151  'fnof' => 402,
152  'forall' => 8704,
153  'frac12' => 189,
154  'frac14' => 188,
155  'frac34' => 190,
156  'frasl' => 8260,
157  'Gamma' => 915,
158  'gamma' => 947,
159  'ge' => 8805,
160  'gt' => 62,
161  'harr' => 8596,
162  'hArr' => 8660,
163  'hearts' => 9829,
164  'hellip' => 8230,
165  'Iacute' => 205,
166  'iacute' => 237,
167  'Icirc' => 206,
168  'icirc' => 238,
169  'iexcl' => 161,
170  'Igrave' => 204,
171  'igrave' => 236,
172  'image' => 8465,
173  'infin' => 8734,
174  'int' => 8747,
175  'Iota' => 921,
176  'iota' => 953,
177  'iquest' => 191,
178  'isin' => 8712,
179  'Iuml' => 207,
180  'iuml' => 239,
181  'Kappa' => 922,
182  'kappa' => 954,
183  'Lambda' => 923,
184  'lambda' => 955,
185  'lang' => 9001,
186  'laquo' => 171,
187  'larr' => 8592,
188  'lArr' => 8656,
189  'lceil' => 8968,
190  'ldquo' => 8220,
191  'le' => 8804,
192  'lfloor' => 8970,
193  'lowast' => 8727,
194  'loz' => 9674,
195  'lrm' => 8206,
196  'lsaquo' => 8249,
197  'lsquo' => 8216,
198  'lt' => 60,
199  'macr' => 175,
200  'mdash' => 8212,
201  'micro' => 181,
202  'middot' => 183,
203  'minus' => 8722,
204  'Mu' => 924,
205  'mu' => 956,
206  'nabla' => 8711,
207  'nbsp' => 160,
208  'ndash' => 8211,
209  'ne' => 8800,
210  'ni' => 8715,
211  'not' => 172,
212  'notin' => 8713,
213  'nsub' => 8836,
214  'Ntilde' => 209,
215  'ntilde' => 241,
216  'Nu' => 925,
217  'nu' => 957,
218  'Oacute' => 211,
219  'oacute' => 243,
220  'Ocirc' => 212,
221  'ocirc' => 244,
222  'OElig' => 338,
223  'oelig' => 339,
224  'Ograve' => 210,
225  'ograve' => 242,
226  'oline' => 8254,
227  'Omega' => 937,
228  'omega' => 969,
229  'Omicron' => 927,
230  'omicron' => 959,
231  'oplus' => 8853,
232  'or' => 8744,
233  'ordf' => 170,
234  'ordm' => 186,
235  'Oslash' => 216,
236  'oslash' => 248,
237  'Otilde' => 213,
238  'otilde' => 245,
239  'otimes' => 8855,
240  'Ouml' => 214,
241  'ouml' => 246,
242  'para' => 182,
243  'part' => 8706,
244  'permil' => 8240,
245  'perp' => 8869,
246  'Phi' => 934,
247  'phi' => 966,
248  'Pi' => 928,
249  'pi' => 960,
250  'piv' => 982,
251  'plusmn' => 177,
252  'pound' => 163,
253  'prime' => 8242,
254  'Prime' => 8243,
255  'prod' => 8719,
256  'prop' => 8733,
257  'Psi' => 936,
258  'psi' => 968,
259  'quot' => 34,
260  'radic' => 8730,
261  'rang' => 9002,
262  'raquo' => 187,
263  'rarr' => 8594,
264  'rArr' => 8658,
265  'rceil' => 8969,
266  'rdquo' => 8221,
267  'real' => 8476,
268  'reg' => 174,
269  'rfloor' => 8971,
270  'Rho' => 929,
271  'rho' => 961,
272  'rlm' => 8207,
273  'rsaquo' => 8250,
274  'rsquo' => 8217,
275  'sbquo' => 8218,
276  'Scaron' => 352,
277  'scaron' => 353,
278  'sdot' => 8901,
279  'sect' => 167,
280  'shy' => 173,
281  'Sigma' => 931,
282  'sigma' => 963,
283  'sigmaf' => 962,
284  'sim' => 8764,
285  'spades' => 9824,
286  'sub' => 8834,
287  'sube' => 8838,
288  'sum' => 8721,
289  'sup' => 8835,
290  'sup1' => 185,
291  'sup2' => 178,
292  'sup3' => 179,
293  'supe' => 8839,
294  'szlig' => 223,
295  'Tau' => 932,
296  'tau' => 964,
297  'there4' => 8756,
298  'Theta' => 920,
299  'theta' => 952,
300  'thetasym' => 977,
301  'thinsp' => 8201,
302  'THORN' => 222,
303  'thorn' => 254,
304  'tilde' => 732,
305  'times' => 215,
306  'trade' => 8482,
307  'Uacute' => 218,
308  'uacute' => 250,
309  'uarr' => 8593,
310  'uArr' => 8657,
311  'Ucirc' => 219,
312  'ucirc' => 251,
313  'Ugrave' => 217,
314  'ugrave' => 249,
315  'uml' => 168,
316  'upsih' => 978,
317  'Upsilon' => 933,
318  'upsilon' => 965,
319  'Uuml' => 220,
320  'uuml' => 252,
321  'weierp' => 8472,
322  'Xi' => 926,
323  'xi' => 958,
324  'Yacute' => 221,
325  'yacute' => 253,
326  'yen' => 165,
327  'Yuml' => 376,
328  'yuml' => 255,
329  'Zeta' => 918,
330  'zeta' => 950,
331  'zwj' => 8205,
332  'zwnj' => 8204
333  ];
334 
338  private static $htmlEntityAliases = [
339  'רלמ' => 'rlm',
340  'رلم' => 'rlm',
341  ];
342 
346  private static $attribsRegex;
347 
355  static function getAttribsRegex() {
356  if ( self::$attribsRegex === null ) {
357  $attribFirst = "[:_\p{L}\p{N}]";
358  $attrib = "[:_\.\-\p{L}\p{N}]";
359  $space = '[\x09\x0a\x0c\x0d\x20]';
360  self::$attribsRegex =
361  "/(?:^|$space)({$attribFirst}{$attrib}*)
362  ($space*=$space*
363  (?:
364  # The attribute value: quoted or alone
365  \"([^\"]*)(?:\"|\$)
366  | '([^']*)(?:'|\$)
367  | (((?!$space|>).)*)
368  )
369  )?(?=$space|\$)/sxu";
370  }
371  return self::$attribsRegex;
372  }
373 
380  public static function getRecognizedTagData( $extratags = [], $removetags = [] ) {
381  global $wgAllowImageTag;
382 
383  static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
384  $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
385 
386  // Base our staticInitialised variable off of the global config state so that if the globals
387  // are changed (like in the screwed up test system) we will re-initialise the settings.
388  $globalContext = $wgAllowImageTag;
389  if ( !$staticInitialised || $staticInitialised != $globalContext ) {
390  $htmlpairsStatic = [ # Tags that must be closed
391  'b', 'bdi', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
392  'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
393  'strike', 'strong', 'tt', 'var', 'div', 'center',
394  'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
395  'ruby', 'rb', 'rp', 'rt', 'rtc', 'p', 'span', 'abbr', 'dfn',
396  'kbd', 'samp', 'data', 'time', 'mark'
397  ];
398  $htmlsingle = [
399  'br', 'wbr', 'hr', 'li', 'dt', 'dd', 'meta', 'link'
400  ];
401 
402  # Elements that cannot have close tags. This is (not coincidentally)
403  # also the list of tags for which the HTML 5 parsing algorithm
404  # requires you to "acknowledge the token's self-closing flag", i.e.
405  # a self-closing tag like <br/> is not an HTML 5 parse error only
406  # for this list.
407  $htmlsingleonly = [
408  'br', 'wbr', 'hr', 'meta', 'link'
409  ];
410 
411  $htmlnest = [ # Tags that can be nested--??
412  'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
413  'li', 'dl', 'dt', 'dd', 'font', 'big', 'small', 'sub', 'sup', 'span',
414  'var', 'kbd', 'samp', 'em', 'strong', 'q', 'ruby', 'bdo'
415  ];
416  $tabletags = [ # Can only appear inside table, we will close them
417  'td', 'th', 'tr',
418  ];
419  $htmllist = [ # Tags used by list
420  'ul', 'ol',
421  ];
422  $listtags = [ # Tags that can appear in a list
423  'li',
424  ];
425 
426  if ( $wgAllowImageTag ) {
427  $htmlsingle[] = 'img';
428  $htmlsingleonly[] = 'img';
429  }
430 
431  $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
432  $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
433 
434  # Convert them all to hashtables for faster lookup
435  $vars = [ 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
436  'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' ];
437  foreach ( $vars as $var ) {
438  $$var = array_flip( $$var );
439  }
440  $staticInitialised = $globalContext;
441  }
442 
443  # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
444  $extratags = array_flip( $extratags );
445  $removetags = array_flip( $removetags );
446  $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
447  $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ), $removetags );
448 
449  return [
450  'htmlpairs' => $htmlpairs,
451  'htmlsingle' => $htmlsingle,
452  'htmlsingleonly' => $htmlsingleonly,
453  'htmlnest' => $htmlnest,
454  'tabletags' => $tabletags,
455  'htmllist' => $htmllist,
456  'listtags' => $listtags,
457  'htmlsingleallowed' => $htmlsingleallowed,
458  'htmlelements' => $htmlelements,
459  ];
460  }
461 
477  public static function removeHTMLtags( $text, $processCallback = null,
478  $args = [], $extratags = [], $removetags = [], $warnCallback = null
479  ) {
480  $tagData = self::getRecognizedTagData( $extratags, $removetags );
481  $htmlpairs = $tagData['htmlpairs'];
482  $htmlsingle = $tagData['htmlsingle'];
483  $htmlsingleonly = $tagData['htmlsingleonly'];
484  $htmlnest = $tagData['htmlnest'];
485  $tabletags = $tagData['tabletags'];
486  $htmllist = $tagData['htmllist'];
487  $listtags = $tagData['listtags'];
488  $htmlsingleallowed = $tagData['htmlsingleallowed'];
489  $htmlelements = $tagData['htmlelements'];
490 
491  # Remove HTML comments
492  $text = self::removeHTMLcomments( $text );
493  $bits = explode( '<', $text );
494  $text = str_replace( '>', '&gt;', array_shift( $bits ) );
495  if ( !MWTidy::isEnabled() ) {
496  $tagstack = $tablestack = [];
497  foreach ( $bits as $x ) {
498  $regs = [];
499  # $slash: Does the current element start with a '/'?
500  # $t: Current element name
501  # $params: String between element name and >
502  # $brace: Ending '>' or '/>'
503  # $rest: Everything until the next element of $bits
504  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
505  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
506  } else {
507  $slash = $t = $params = $brace = $rest = null;
508  }
509 
510  $badtag = false;
511  $t = strtolower( $t );
512  if ( isset( $htmlelements[$t] ) ) {
513  # Check our stack
514  if ( $slash && isset( $htmlsingleonly[$t] ) ) {
515  $badtag = true;
516  } elseif ( $slash ) {
517  # Closing a tag... is it the one we just opened?
518  Wikimedia\suppressWarnings();
519  $ot = array_pop( $tagstack );
520  Wikimedia\restoreWarnings();
521 
522  if ( $ot != $t ) {
523  if ( isset( $htmlsingleallowed[$ot] ) ) {
524  # Pop all elements with an optional close tag
525  # and see if we find a match below them
526  $optstack = [];
527  array_push( $optstack, $ot );
528  Wikimedia\suppressWarnings();
529  $ot = array_pop( $tagstack );
530  Wikimedia\restoreWarnings();
531  while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
532  array_push( $optstack, $ot );
533  Wikimedia\suppressWarnings();
534  $ot = array_pop( $tagstack );
535  Wikimedia\restoreWarnings();
536  }
537  if ( $t != $ot ) {
538  # No match. Push the optional elements back again
539  $badtag = true;
540  Wikimedia\suppressWarnings();
541  $ot = array_pop( $optstack );
542  Wikimedia\restoreWarnings();
543  while ( $ot ) {
544  array_push( $tagstack, $ot );
545  Wikimedia\suppressWarnings();
546  $ot = array_pop( $optstack );
547  Wikimedia\restoreWarnings();
548  }
549  }
550  } else {
551  Wikimedia\suppressWarnings();
552  array_push( $tagstack, $ot );
553  Wikimedia\restoreWarnings();
554 
555  # <li> can be nested in <ul> or <ol>, skip those cases:
556  if ( !isset( $htmllist[$ot] ) || !isset( $listtags[$t] ) ) {
557  $badtag = true;
558  }
559  }
560  } else {
561  if ( $t == 'table' ) {
562  $tagstack = array_pop( $tablestack );
563  }
564  }
565  $newparams = '';
566  } else {
567  # Keep track for later
568  if ( isset( $tabletags[$t] ) && !in_array( 'table', $tagstack ) ) {
569  $badtag = true;
570  } elseif ( in_array( $t, $tagstack ) && !isset( $htmlnest[$t] ) ) {
571  $badtag = true;
572  #  Is it a self closed htmlpair ? (T7487)
573  } elseif ( $brace == '/>' && isset( $htmlpairs[$t] ) ) {
574  // Eventually we'll just remove the self-closing
575  // slash, in order to be consistent with HTML5
576  // semantics.
577  // $brace = '>';
578  // For now, let's just warn authors to clean up.
579  if ( is_callable( $warnCallback ) ) {
580  call_user_func_array( $warnCallback, [ 'deprecated-self-close-category' ] );
581  }
582  $badtag = true;
583  } elseif ( isset( $htmlsingleonly[$t] ) ) {
584  # Hack to force empty tag for unclosable elements
585  $brace = '/>';
586  } elseif ( isset( $htmlsingle[$t] ) ) {
587  # Hack to not close $htmlsingle tags
588  $brace = null;
589  # Still need to push this optionally-closed tag to
590  # the tag stack so that we can match end tags
591  # instead of marking them as bad.
592  array_push( $tagstack, $t );
593  } elseif ( isset( $tabletags[$t] ) && in_array( $t, $tagstack ) ) {
594  // New table tag but forgot to close the previous one
595  $text .= "</$t>";
596  } else {
597  if ( $t == 'table' ) {
598  array_push( $tablestack, $tagstack );
599  $tagstack = [];
600  }
601  array_push( $tagstack, $t );
602  }
603 
604  # Replace any variables or template parameters with
605  # plaintext results.
606  if ( is_callable( $processCallback ) ) {
607  call_user_func_array( $processCallback, [ &$params, $args ] );
608  }
609 
610  if ( !self::validateTag( $params, $t ) ) {
611  $badtag = true;
612  }
613 
614  # Strip non-approved attributes from the tag
615  $newparams = self::fixTagAttributes( $params, $t );
616  }
617  if ( !$badtag ) {
618  $rest = str_replace( '>', '&gt;', $rest );
619  $close = ( $brace == '/>' && !$slash ) ? ' /' : '';
620  $text .= "<$slash$t$newparams$close>$rest";
621  continue;
622  }
623  }
624  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
625  }
626  # Close off any remaining tags
627  while ( is_array( $tagstack ) && ( $t = array_pop( $tagstack ) ) ) {
628  $text .= "</$t>\n";
629  if ( $t == 'table' ) {
630  $tagstack = array_pop( $tablestack );
631  }
632  }
633  } else {
634  # this might be possible using tidy itself
635  foreach ( $bits as $x ) {
636  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
637  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
638 
639  $badtag = false;
640  $t = strtolower( $t );
641  if ( isset( $htmlelements[$t] ) ) {
642  if ( is_callable( $processCallback ) ) {
643  call_user_func_array( $processCallback, [ &$params, $args ] );
644  }
645 
646  if ( $brace == '/>' && !( isset( $htmlsingle[$t] ) || isset( $htmlsingleonly[$t] ) ) ) {
647  // Eventually we'll just remove the self-closing
648  // slash, in order to be consistent with HTML5
649  // semantics.
650  // $brace = '>';
651  // For now, let's just warn authors to clean up.
652  if ( is_callable( $warnCallback ) ) {
653  call_user_func_array( $warnCallback, [ 'deprecated-self-close-category' ] );
654  }
655  }
656  if ( !self::validateTag( $params, $t ) ) {
657  $badtag = true;
658  }
659 
660  $newparams = self::fixTagAttributes( $params, $t );
661  if ( !$badtag ) {
662  if ( $brace === '/>' && !isset( $htmlsingleonly[$t] ) ) {
663  # Interpret self-closing tags as empty tags even when
664  # HTML 5 would interpret them as start tags. Such input
665  # is commonly seen on Wikimedia wikis with this intention.
666  $brace = "></$t>";
667  }
668 
669  $rest = str_replace( '>', '&gt;', $rest );
670  $text .= "<$slash$t$newparams$brace$rest";
671  continue;
672  }
673  }
674  }
675  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
676  }
677  }
678  return $text;
679  }
680 
690  public static function removeHTMLcomments( $text ) {
691  while ( ( $start = strpos( $text, '<!--' ) ) !== false ) {
692  $end = strpos( $text, '-->', $start + 4 );
693  if ( $end === false ) {
694  # Unterminated comment; bail out
695  break;
696  }
697 
698  $end += 3;
699 
700  # Trim space and newline if the comment is both
701  # preceded and followed by a newline
702  $spaceStart = max( $start - 1, 0 );
703  $spaceLen = $end - $spaceStart;
704  while ( substr( $text, $spaceStart, 1 ) === ' ' && $spaceStart > 0 ) {
705  $spaceStart--;
706  $spaceLen++;
707  }
708  while ( substr( $text, $spaceStart + $spaceLen, 1 ) === ' ' ) {
709  $spaceLen++;
710  }
711  if ( substr( $text, $spaceStart, 1 ) === "\n"
712  && substr( $text, $spaceStart + $spaceLen, 1 ) === "\n" ) {
713  # Remove the comment, leading and trailing
714  # spaces, and leave only one newline.
715  $text = substr_replace( $text, "\n", $spaceStart, $spaceLen + 1 );
716  } else {
717  # Remove just the comment.
718  $text = substr_replace( $text, '', $start, $end - $start );
719  }
720  }
721  return $text;
722  }
723 
736  static function validateTag( $params, $element ) {
737  $params = self::decodeTagAttributes( $params );
738 
739  if ( $element == 'meta' || $element == 'link' ) {
740  if ( !isset( $params['itemprop'] ) ) {
741  // <meta> and <link> must have an itemprop="" otherwise they are not valid or safe in content
742  return false;
743  }
744  if ( $element == 'meta' && !isset( $params['content'] ) ) {
745  // <meta> must have a content="" for the itemprop
746  return false;
747  }
748  if ( $element == 'link' && !isset( $params['href'] ) ) {
749  // <link> must have an associated href=""
750  return false;
751  }
752  }
753 
754  return true;
755  }
756 
772  static function validateTagAttributes( $attribs, $element ) {
773  return self::validateAttributes( $attribs,
774  self::attributeWhitelist( $element ) );
775  }
776 
792  static function validateAttributes( $attribs, $whitelist ) {
793  $whitelist = array_flip( $whitelist );
794  $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
795 
796  $out = [];
797  foreach ( $attribs as $attribute => $value ) {
798  # Allow XML namespace declaration to allow RDFa
799  if ( preg_match( self::XMLNS_ATTRIBUTE_PATTERN, $attribute ) ) {
800  if ( !preg_match( self::EVIL_URI_PATTERN, $value ) ) {
801  $out[$attribute] = $value;
802  }
803 
804  continue;
805  }
806 
807  # Allow any attribute beginning with "data-"
808  # However:
809  # * Disallow data attributes used by MediaWiki code
810  # * Ensure that the attribute is not namespaced by banning
811  # colons.
812  if ( !preg_match( '/^data-[^:]*$/i', $attribute )
813  && !isset( $whitelist[$attribute] )
814  || self::isReservedDataAttribute( $attribute )
815  ) {
816  continue;
817  }
818 
819  # Strip javascript "expression" from stylesheets.
820  # https://msdn.microsoft.com/en-us/library/ms537634.aspx
821  if ( $attribute == 'style' ) {
822  $value = self::checkCss( $value );
823  }
824 
825  # Escape HTML id attributes
826  if ( $attribute === 'id' ) {
827  $value = self::escapeIdForAttribute( $value, self::ID_PRIMARY );
828  }
829 
830  # Escape HTML id reference lists
831  if ( $attribute === 'aria-describedby'
832  || $attribute === 'aria-flowto'
833  || $attribute === 'aria-labelledby'
834  || $attribute === 'aria-owns'
835  ) {
836  $value = self::escapeIdReferenceList( $value );
837  }
838 
839  // RDFa and microdata properties allow URLs, URIs and/or CURIs.
840  // Check them for sanity.
841  if ( $attribute === 'rel' || $attribute === 'rev'
842  # RDFa
843  || $attribute === 'about' || $attribute === 'property'
844  || $attribute === 'resource' || $attribute === 'datatype'
845  || $attribute === 'typeof'
846  # HTML5 microdata
847  || $attribute === 'itemid' || $attribute === 'itemprop'
848  || $attribute === 'itemref' || $attribute === 'itemscope'
849  || $attribute === 'itemtype'
850  ) {
851  // Paranoia. Allow "simple" values but suppress javascript
852  if ( preg_match( self::EVIL_URI_PATTERN, $value ) ) {
853  continue;
854  }
855  }
856 
857  # NOTE: even though elements using href/src are not allowed directly, supply
858  # validation code that can be used by tag hook handlers, etc
859  if ( $attribute === 'href' || $attribute === 'src' || $attribute === 'poster' ) {
860  if ( !preg_match( $hrefExp, $value ) ) {
861  continue; // drop any href or src attributes not using an allowed protocol.
862  // NOTE: this also drops all relative URLs
863  }
864  }
865 
866  // If this attribute was previously set, override it.
867  // Output should only have one attribute of each name.
868  $out[$attribute] = $value;
869  }
870 
871  # itemtype, itemid, itemref don't make sense without itemscope
872  if ( !array_key_exists( 'itemscope', $out ) ) {
873  unset( $out['itemtype'] );
874  unset( $out['itemid'] );
875  unset( $out['itemref'] );
876  }
877  # TODO: Strip itemprop if we aren't descendants of an itemscope or pointed to by an itemref.
878 
879  return $out;
880  }
881 
889  public static function isReservedDataAttribute( $attr ) {
890  // data-ooui is reserved for ooui.
891  // data-mw and data-parsoid are reserved for parsoid.
892  // data-mw-<name here> is reserved for extensions (or core) if
893  // they need to communicate some data to the client and want to be
894  // sure that it isn't coming from an untrusted user.
895  // We ignore the possibility of namespaces since user-generated HTML
896  // can't use them anymore.
897  return (bool)preg_match( '/^data-(ooui|mw|parsoid)/i', $attr );
898  }
899 
910  static function mergeAttributes( $a, $b ) {
911  $out = array_merge( $a, $b );
912  if ( isset( $a['class'] ) && isset( $b['class'] )
913  && is_string( $a['class'] ) && is_string( $b['class'] )
914  && $a['class'] !== $b['class']
915  ) {
916  $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
917  -1, PREG_SPLIT_NO_EMPTY );
918  $out['class'] = implode( ' ', array_unique( $classes ) );
919  }
920  return $out;
921  }
922 
932  public static function normalizeCss( $value ) {
933  // Decode character references like &#123;
934  $value = self::decodeCharReferences( $value );
935 
936  // Decode escape sequences and line continuation
937  // See the grammar in the CSS 2 spec, appendix D.
938  // This has to be done AFTER decoding character references.
939  // This means it isn't possible for this function to return
940  // unsanitized escape sequences. It is possible to manufacture
941  // input that contains character references that decode to
942  // escape sequences that decode to character references, but
943  // it's OK for the return value to contain character references
944  // because the caller is supposed to escape those anyway.
945  static $decodeRegex;
946  if ( !$decodeRegex ) {
947  $space = '[\\x20\\t\\r\\n\\f]';
948  $nl = '(?:\\n|\\r\\n|\\r|\\f)';
949  $backslash = '\\\\';
950  $decodeRegex = "/ $backslash
951  (?:
952  ($nl) | # 1. Line continuation
953  ([0-9A-Fa-f]{1,6})$space? | # 2. character number
954  (.) | # 3. backslash cancelling special meaning
955  () | # 4. backslash at end of string
956  )/xu";
957  }
958  $value = preg_replace_callback( $decodeRegex,
959  [ __CLASS__, 'cssDecodeCallback' ], $value );
960 
961  // Normalize Halfwidth and Fullwidth Unicode block that IE6 might treat as ascii
962  $value = preg_replace_callback(
963  '/[!-[]-z]/u', // U+FF01 to U+FF5A, excluding U+FF3C (T60088)
964  function ( $matches ) {
966  if ( $cp === false ) {
967  return '';
968  }
969  return chr( $cp - 65248 ); // ASCII range \x21-\x7A
970  },
971  $value
972  );
973 
974  // Convert more characters IE6 might treat as ascii
975  // U+0280, U+0274, U+207F, U+029F, U+026A, U+207D, U+208D
976  $value = str_replace(
977  [ 'ʀ', 'ɴ', 'ⁿ', 'ʟ', 'ɪ', '⁽', '₍' ],
978  [ 'r', 'n', 'n', 'l', 'i', '(', '(' ],
979  $value
980  );
981 
982  // Let the value through if it's nothing but a single comment, to
983  // allow other functions which may reject it to pass some error
984  // message through.
985  if ( !preg_match( '! ^ \s* /\* [^*\\/]* \*/ \s* $ !x', $value ) ) {
986  // Remove any comments; IE gets token splitting wrong
987  // This must be done AFTER decoding character references and
988  // escape sequences, because those steps can introduce comments
989  // This step cannot introduce character references or escape
990  // sequences, because it replaces comments with spaces rather
991  // than removing them completely.
992  $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value );
993 
994  // Remove anything after a comment-start token, to guard against
995  // incorrect client implementations.
996  $commentPos = strpos( $value, '/*' );
997  if ( $commentPos !== false ) {
998  $value = substr( $value, 0, $commentPos );
999  }
1000  }
1001 
1002  // S followed by repeat, iteration, or prolonged sound marks,
1003  // which IE will treat as "ss"
1004  $value = preg_replace(
1005  '/s(?:
1006  \xE3\x80\xB1 | # U+3031
1007  \xE3\x82\x9D | # U+309D
1008  \xE3\x83\xBC | # U+30FC
1009  \xE3\x83\xBD | # U+30FD
1010  \xEF\xB9\xBC | # U+FE7C
1011  \xEF\xB9\xBD | # U+FE7D
1012  \xEF\xBD\xB0 # U+FF70
1013  )/ix',
1014  'ss',
1015  $value
1016  );
1017 
1018  return $value;
1019  }
1020 
1039  static function checkCss( $value ) {
1040  $value = self::normalizeCss( $value );
1041 
1042  // Reject problematic keywords and control characters
1043  if ( preg_match( '/[\000-\010\013\016-\037\177]/', $value ) ||
1044  strpos( $value, UtfNormal\Constants::UTF8_REPLACEMENT ) !== false ) {
1045  return '/* invalid control char */';
1046  } elseif ( preg_match(
1047  '! expression
1048  | filter\s*:
1049  | accelerator\s*:
1050  | -o-link\s*:
1051  | -o-link-source\s*:
1052  | -o-replace\s*:
1053  | url\s*\(
1054  | image\s*\(
1055  | image-set\s*\(
1056  | attr\s*\([^)]+[\s,]+url
1057  !ix', $value ) ) {
1058  return '/* insecure input */';
1059  }
1060  return $value;
1061  }
1062 
1067  static function cssDecodeCallback( $matches ) {
1068  if ( $matches[1] !== '' ) {
1069  // Line continuation
1070  return '';
1071  } elseif ( $matches[2] !== '' ) {
1072  $char = UtfNormal\Utils::codepointToUtf8( hexdec( $matches[2] ) );
1073  } elseif ( $matches[3] !== '' ) {
1074  $char = $matches[3];
1075  } else {
1076  $char = '\\';
1077  }
1078  if ( $char == "\n" || $char == '"' || $char == "'" || $char == '\\' ) {
1079  // These characters need to be escaped in strings
1080  // Clean up the escape sequence to avoid parsing errors by clients
1081  return '\\' . dechex( ord( $char ) ) . ' ';
1082  } else {
1083  // Decode unnecessary escape
1084  return $char;
1085  }
1086  }
1087 
1109  static function fixTagAttributes( $text, $element, $sorted = false ) {
1110  if ( trim( $text ) == '' ) {
1111  return '';
1112  }
1113 
1114  $decoded = self::decodeTagAttributes( $text );
1115  $stripped = self::validateTagAttributes( $decoded, $element );
1116 
1117  if ( $sorted ) {
1118  ksort( $stripped );
1119  }
1120 
1121  return self::safeEncodeTagAttributes( $stripped );
1122  }
1123 
1129  static function encodeAttribute( $text ) {
1130  $encValue = htmlspecialchars( $text, ENT_QUOTES );
1131 
1132  // Whitespace is normalized during attribute decoding,
1133  // so if we've been passed non-spaces we must encode them
1134  // ahead of time or they won't be preserved.
1135  $encValue = strtr( $encValue, [
1136  "\n" => '&#10;',
1137  "\r" => '&#13;',
1138  "\t" => '&#9;',
1139  ] );
1140 
1141  return $encValue;
1142  }
1143 
1150  static function safeEncodeAttribute( $text ) {
1151  $encValue = self::encodeAttribute( $text );
1152 
1153  # Templates and links may be expanded in later parsing,
1154  # creating invalid or dangerous output. Suppress this.
1155  $encValue = strtr( $encValue, [
1156  '<' => '&lt;', // This should never happen,
1157  '>' => '&gt;', // we've received invalid input
1158  '"' => '&quot;', // which should have been escaped.
1159  '{' => '&#123;',
1160  '}' => '&#125;', // prevent unpaired language conversion syntax
1161  '[' => '&#91;',
1162  ']' => '&#93;',
1163  "''" => '&#39;&#39;',
1164  'ISBN' => '&#73;SBN',
1165  'RFC' => '&#82;FC',
1166  'PMID' => '&#80;MID',
1167  '|' => '&#124;',
1168  '__' => '&#95;_',
1169  ] );
1170 
1171  # Stupid hack
1172  $encValue = preg_replace_callback(
1173  '/((?i)' . wfUrlProtocols() . ')/',
1174  function ( $matches ) {
1175  return str_replace( ':', '&#58;', $matches[1] );
1176  },
1177  $encValue );
1178  return $encValue;
1179  }
1180 
1209  static function escapeId( $id, $options = [] ) {
1210  $options = (array)$options;
1211 
1212  // HTML4-style escaping
1213  static $replace = [
1214  '%3A' => ':',
1215  '%' => '.'
1216  ];
1217 
1218  $id = urlencode( strtr( $id, ' ', '_' ) );
1219  $id = strtr( $id, $replace );
1220 
1221  if ( !preg_match( '/^[a-zA-Z]/', $id ) && !in_array( 'noninitial', $options ) ) {
1222  // Initial character must be a letter!
1223  $id = "x$id";
1224  }
1225  return $id;
1226  }
1227 
1243  public static function escapeIdForAttribute( $id, $mode = self::ID_PRIMARY ) {
1245 
1246  if ( !isset( $wgFragmentMode[$mode] ) ) {
1247  if ( $mode === self::ID_PRIMARY ) {
1248  throw new UnexpectedValueException( '$wgFragmentMode is configured with no primary mode' );
1249  }
1250  return false;
1251  }
1252 
1253  $internalMode = $wgFragmentMode[$mode];
1254 
1255  return self::escapeIdInternal( $id, $internalMode );
1256  }
1257 
1270  public static function escapeIdForLink( $id ) {
1272 
1273  if ( !isset( $wgFragmentMode[self::ID_PRIMARY] ) ) {
1274  throw new UnexpectedValueException( '$wgFragmentMode is configured with no primary mode' );
1275  }
1276 
1277  $mode = $wgFragmentMode[self::ID_PRIMARY];
1278 
1279  $id = self::escapeIdInternal( $id, $mode );
1280 
1281  return $id;
1282  }
1283 
1293  public static function escapeIdForExternalInterwiki( $id ) {
1295 
1296  $id = self::escapeIdInternal( $id, $wgExternalInterwikiFragmentMode );
1297 
1298  return $id;
1299  }
1300 
1308  private static function escapeIdInternal( $id, $mode ) {
1309  switch ( $mode ) {
1310  case 'html5':
1311  $id = str_replace( ' ', '_', $id );
1312  break;
1313  case 'legacy':
1314  // This corresponds to 'noninitial' mode of the old escapeId()
1315  static $replace = [
1316  '%3A' => ':',
1317  '%' => '.'
1318  ];
1319 
1320  $id = urlencode( str_replace( ' ', '_', $id ) );
1321  $id = strtr( $id, $replace );
1322  break;
1323  default:
1324  throw new InvalidArgumentException( "Invalid mode '$mode' passed to '" . __METHOD__ );
1325  }
1326 
1327  return $id;
1328  }
1329 
1342  static function escapeIdReferenceList( $referenceString, $options = [] ) {
1343  if ( $options ) {
1344  wfDeprecated( __METHOD__ . ' with $options', '1.31' );
1345  }
1346  # Explode the space delimited list string into an array of tokens
1347  $references = preg_split( '/\s+/', "{$referenceString}", -1, PREG_SPLIT_NO_EMPTY );
1348 
1349  # Escape each token as an id
1350  foreach ( $references as &$ref ) {
1351  $ref = self::escapeIdForAttribute( $ref );
1352  }
1353 
1354  # Merge the array back to a space delimited list string
1355  # If the array is empty, the result will be an empty string ('')
1356  $referenceString = implode( ' ', $references );
1357 
1358  return $referenceString;
1359  }
1360 
1372  static function escapeClass( $class ) {
1373  // Convert ugly stuff to underscores and kill underscores in ugly places
1374  return rtrim( preg_replace(
1375  [ '/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/', '/_+/' ],
1376  '_',
1377  $class ), '_' );
1378  }
1379 
1387  static function escapeHtmlAllowEntities( $html ) {
1388  $html = self::decodeCharReferences( $html );
1389  # It seems wise to escape ' as well as ", as a matter of course. Can't
1390  # hurt. Use ENT_SUBSTITUTE so that incorrectly truncated multibyte characters
1391  # don't cause the entire string to disappear.
1392  $html = htmlspecialchars( $html, ENT_QUOTES | ENT_SUBSTITUTE );
1393  return $html;
1394  }
1395 
1404  public static function decodeTagAttributes( $text ) {
1405  if ( trim( $text ) == '' ) {
1406  return [];
1407  }
1408 
1409  $attribs = [];
1410  $pairs = [];
1411  if ( !preg_match_all(
1412  self::getAttribsRegex(),
1413  $text,
1414  $pairs,
1415  PREG_SET_ORDER ) ) {
1416  return $attribs;
1417  }
1418 
1419  foreach ( $pairs as $set ) {
1420  $attribute = strtolower( $set[1] );
1421  $value = self::getTagAttributeCallback( $set );
1422 
1423  // Normalize whitespace
1424  $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1425  $value = trim( $value );
1426 
1427  // Decode character references
1428  $attribs[$attribute] = self::decodeCharReferences( $value );
1429  }
1430  return $attribs;
1431  }
1432 
1440  public static function safeEncodeTagAttributes( $assoc_array ) {
1441  $attribs = [];
1442  foreach ( $assoc_array as $attribute => $value ) {
1443  $encAttribute = htmlspecialchars( $attribute );
1444  $encValue = self::safeEncodeAttribute( $value );
1445 
1446  $attribs[] = "$encAttribute=\"$encValue\"";
1447  }
1448  return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : '';
1449  }
1450 
1459  private static function getTagAttributeCallback( $set ) {
1460  if ( isset( $set[5] ) ) {
1461  # No quotes.
1462  return $set[5];
1463  } elseif ( isset( $set[4] ) ) {
1464  # Single-quoted
1465  return $set[4];
1466  } elseif ( isset( $set[3] ) ) {
1467  # Double-quoted
1468  return $set[3];
1469  } elseif ( !isset( $set[2] ) ) {
1470  # In XHTML, attributes must have a value so return an empty string.
1471  # See "Empty attribute syntax",
1472  # https://www.w3.org/TR/html5/syntax.html#syntax-attribute-name
1473  return "";
1474  } else {
1475  throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1476  }
1477  }
1478 
1483  private static function normalizeWhitespace( $text ) {
1484  return preg_replace(
1485  '/\r\n|[\x20\x0d\x0a\x09]/',
1486  ' ',
1487  $text );
1488  }
1489 
1499  return trim( preg_replace( '/[ _]+/', ' ', $section ) );
1500  }
1501 
1517  static function normalizeCharReferences( $text ) {
1518  return preg_replace_callback(
1519  self::CHAR_REFS_REGEX,
1520  [ self::class, 'normalizeCharReferencesCallback' ],
1521  $text );
1522  }
1523 
1529  $ret = null;
1530  if ( $matches[1] != '' ) {
1531  $ret = self::normalizeEntity( $matches[1] );
1532  } elseif ( $matches[2] != '' ) {
1533  $ret = self::decCharReference( $matches[2] );
1534  } elseif ( $matches[3] != '' ) {
1535  $ret = self::hexCharReference( $matches[3] );
1536  }
1537  if ( is_null( $ret ) ) {
1538  return htmlspecialchars( $matches[0] );
1539  } else {
1540  return $ret;
1541  }
1542  }
1543 
1554  static function normalizeEntity( $name ) {
1555  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1556  return '&' . self::$htmlEntityAliases[$name] . ';';
1557  } elseif ( in_array( $name, [ 'lt', 'gt', 'amp', 'quot' ] ) ) {
1558  return "&$name;";
1559  } elseif ( isset( self::$htmlEntities[$name] ) ) {
1560  return '&#' . self::$htmlEntities[$name] . ';';
1561  } else {
1562  return "&amp;$name;";
1563  }
1564  }
1565 
1570  static function decCharReference( $codepoint ) {
1571  $point = intval( $codepoint );
1572  if ( self::validateCodepoint( $point ) ) {
1573  return sprintf( '&#%d;', $point );
1574  } else {
1575  return null;
1576  }
1577  }
1578 
1583  static function hexCharReference( $codepoint ) {
1584  $point = hexdec( $codepoint );
1585  if ( self::validateCodepoint( $point ) ) {
1586  return sprintf( '&#x%x;', $point );
1587  } else {
1588  return null;
1589  }
1590  }
1591 
1598  private static function validateCodepoint( $codepoint ) {
1599  # U+000C is valid in HTML5 but not allowed in XML.
1600  # U+000D is valid in XML but not allowed in HTML5.
1601  # U+007F - U+009F are disallowed in HTML5 (control characters).
1602  return $codepoint == 0x09
1603  || $codepoint == 0x0a
1604  || ( $codepoint >= 0x20 && $codepoint <= 0x7e )
1605  || ( $codepoint >= 0xa0 && $codepoint <= 0xd7ff )
1606  || ( $codepoint >= 0xe000 && $codepoint <= 0xfffd )
1607  || ( $codepoint >= 0x10000 && $codepoint <= 0x10ffff );
1608  }
1609 
1617  public static function decodeCharReferences( $text ) {
1618  return preg_replace_callback(
1619  self::CHAR_REFS_REGEX,
1620  [ self::class, 'decodeCharReferencesCallback' ],
1621  $text );
1622  }
1623 
1634  public static function decodeCharReferencesAndNormalize( $text ) {
1636  $text = preg_replace_callback(
1637  self::CHAR_REFS_REGEX,
1638  [ self::class, 'decodeCharReferencesCallback' ],
1639  $text,
1640  -1, //limit
1641  $count
1642  );
1643 
1644  if ( $count ) {
1645  return $wgContLang->normalize( $text );
1646  } else {
1647  return $text;
1648  }
1649  }
1650 
1656  if ( $matches[1] != '' ) {
1657  return self::decodeEntity( $matches[1] );
1658  } elseif ( $matches[2] != '' ) {
1659  return self::decodeChar( intval( $matches[2] ) );
1660  } elseif ( $matches[3] != '' ) {
1661  return self::decodeChar( hexdec( $matches[3] ) );
1662  }
1663  # Last case should be an ampersand by itself
1664  return $matches[0];
1665  }
1666 
1674  static function decodeChar( $codepoint ) {
1675  if ( self::validateCodepoint( $codepoint ) ) {
1676  return UtfNormal\Utils::codepointToUtf8( $codepoint );
1677  } else {
1679  }
1680  }
1681 
1690  static function decodeEntity( $name ) {
1691  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1692  $name = self::$htmlEntityAliases[$name];
1693  }
1694  if ( isset( self::$htmlEntities[$name] ) ) {
1695  return UtfNormal\Utils::codepointToUtf8( self::$htmlEntities[$name] );
1696  } else {
1697  return "&$name;";
1698  }
1699  }
1700 
1707  static function attributeWhitelist( $element ) {
1708  $list = self::setupAttributeWhitelist();
1709  return isset( $list[$element] )
1710  ? $list[$element]
1711  : [];
1712  }
1713 
1719  static function setupAttributeWhitelist() {
1720  static $whitelist;
1721 
1722  if ( $whitelist !== null ) {
1723  return $whitelist;
1724  }
1725 
1726  $common = [
1727  # HTML
1728  'id',
1729  'class',
1730  'style',
1731  'lang',
1732  'dir',
1733  'title',
1734 
1735  # WAI-ARIA
1736  'aria-describedby',
1737  'aria-flowto',
1738  'aria-label',
1739  'aria-labelledby',
1740  'aria-owns',
1741  'role',
1742 
1743  # RDFa
1744  # These attributes are specified in section 9 of
1745  # https://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1746  'about',
1747  'property',
1748  'resource',
1749  'datatype',
1750  'typeof',
1751 
1752  # Microdata. These are specified by
1753  # https://html.spec.whatwg.org/multipage/microdata.html#the-microdata-model
1754  'itemid',
1755  'itemprop',
1756  'itemref',
1757  'itemscope',
1758  'itemtype',
1759  ];
1760 
1761  $block = array_merge( $common, [ 'align' ] );
1762  $tablealign = [ 'align', 'valign' ];
1763  $tablecell = [
1764  'abbr',
1765  'axis',
1766  'headers',
1767  'scope',
1768  'rowspan',
1769  'colspan',
1770  'nowrap', # deprecated
1771  'width', # deprecated
1772  'height', # deprecated
1773  'bgcolor', # deprecated
1774  ];
1775 
1776  # Numbers refer to sections in HTML 4.01 standard describing the element.
1777  # See: https://www.w3.org/TR/html4/
1778  $whitelist = [
1779  # 7.5.4
1780  'div' => $block,
1781  'center' => $common, # deprecated
1782  'span' => $common,
1783 
1784  # 7.5.5
1785  'h1' => $block,
1786  'h2' => $block,
1787  'h3' => $block,
1788  'h4' => $block,
1789  'h5' => $block,
1790  'h6' => $block,
1791 
1792  # 7.5.6
1793  # address
1794 
1795  # 8.2.4
1796  'bdo' => $common,
1797 
1798  # 9.2.1
1799  'em' => $common,
1800  'strong' => $common,
1801  'cite' => $common,
1802  'dfn' => $common,
1803  'code' => $common,
1804  'samp' => $common,
1805  'kbd' => $common,
1806  'var' => $common,
1807  'abbr' => $common,
1808  # acronym
1809 
1810  # 9.2.2
1811  'blockquote' => array_merge( $common, [ 'cite' ] ),
1812  'q' => array_merge( $common, [ 'cite' ] ),
1813 
1814  # 9.2.3
1815  'sub' => $common,
1816  'sup' => $common,
1817 
1818  # 9.3.1
1819  'p' => $block,
1820 
1821  # 9.3.2
1822  'br' => array_merge( $common, [ 'clear' ] ),
1823 
1824  # https://www.w3.org/TR/html5/text-level-semantics.html#the-wbr-element
1825  'wbr' => $common,
1826 
1827  # 9.3.4
1828  'pre' => array_merge( $common, [ 'width' ] ),
1829 
1830  # 9.4
1831  'ins' => array_merge( $common, [ 'cite', 'datetime' ] ),
1832  'del' => array_merge( $common, [ 'cite', 'datetime' ] ),
1833 
1834  # 10.2
1835  'ul' => array_merge( $common, [ 'type' ] ),
1836  'ol' => array_merge( $common, [ 'type', 'start', 'reversed' ] ),
1837  'li' => array_merge( $common, [ 'type', 'value' ] ),
1838 
1839  # 10.3
1840  'dl' => $common,
1841  'dd' => $common,
1842  'dt' => $common,
1843 
1844  # 11.2.1
1845  'table' => array_merge( $common,
1846  [ 'summary', 'width', 'border', 'frame',
1847  'rules', 'cellspacing', 'cellpadding',
1848  'align', 'bgcolor',
1849  ] ),
1850 
1851  # 11.2.2
1852  'caption' => $block,
1853 
1854  # 11.2.3
1855  'thead' => $common,
1856  'tfoot' => $common,
1857  'tbody' => $common,
1858 
1859  # 11.2.4
1860  'colgroup' => array_merge( $common, [ 'span' ] ),
1861  'col' => array_merge( $common, [ 'span' ] ),
1862 
1863  # 11.2.5
1864  'tr' => array_merge( $common, [ 'bgcolor' ], $tablealign ),
1865 
1866  # 11.2.6
1867  'td' => array_merge( $common, $tablecell, $tablealign ),
1868  'th' => array_merge( $common, $tablecell, $tablealign ),
1869 
1870  # 12.2
1871  # NOTE: <a> is not allowed directly, but the attrib
1872  # whitelist is used from the Parser object
1873  'a' => array_merge( $common, [ 'href', 'rel', 'rev' ] ), # rel/rev esp. for RDFa
1874 
1875  # 13.2
1876  # Not usually allowed, but may be used for extension-style hooks
1877  # such as <math> when it is rasterized, or if $wgAllowImageTag is
1878  # true
1879  'img' => array_merge( $common, [ 'alt', 'src', 'width', 'height', 'srcset' ] ),
1880 
1881  'video' => array_merge( $common, [ 'poster', 'controls', 'preload', 'width', 'height' ] ),
1882  'source' => array_merge( $common, [ 'type', 'src' ] ),
1883  'track' => array_merge( $common, [ 'type', 'src', 'srclang', 'kind', 'label' ] ),
1884 
1885  # 15.2.1
1886  'tt' => $common,
1887  'b' => $common,
1888  'i' => $common,
1889  'big' => $common,
1890  'small' => $common,
1891  'strike' => $common,
1892  's' => $common,
1893  'u' => $common,
1894 
1895  # 15.2.2
1896  'font' => array_merge( $common, [ 'size', 'color', 'face' ] ),
1897  # basefont
1898 
1899  # 15.3
1900  'hr' => array_merge( $common, [ 'width' ] ),
1901 
1902  # HTML Ruby annotation text module, simple ruby only.
1903  # https://www.w3.org/TR/html5/text-level-semantics.html#the-ruby-element
1904  'ruby' => $common,
1905  # rbc
1906  'rb' => $common,
1907  'rp' => $common,
1908  'rt' => $common, # array_merge( $common, array( 'rbspan' ) ),
1909  'rtc' => $common,
1910 
1911  # MathML root element, where used for extensions
1912  # 'title' may not be 100% valid here; it's XHTML
1913  # https://www.w3.org/TR/REC-MathML/
1914  'math' => [ 'class', 'style', 'id', 'title' ],
1915 
1916  // HTML 5 section 4.5
1917  'figure' => $common,
1918  'figcaption' => $common,
1919 
1920  # HTML 5 section 4.6
1921  'bdi' => $common,
1922 
1923  # HTML5 elements, defined by:
1924  # https://html.spec.whatwg.org/multipage/semantics.html#the-data-element
1925  'data' => array_merge( $common, [ 'value' ] ),
1926  'time' => array_merge( $common, [ 'datetime' ] ),
1927  'mark' => $common,
1928 
1929  // meta and link are only permitted by removeHTMLtags when Microdata
1930  // is enabled so we don't bother adding a conditional to hide these
1931  // Also meta and link are only valid in WikiText as Microdata elements
1932  // (ie: validateTag rejects tags missing the attributes needed for Microdata)
1933  // So we don't bother including $common attributes that have no purpose.
1934  'meta' => [ 'itemprop', 'content' ],
1935  'link' => [ 'itemprop', 'href', 'title' ],
1936  ];
1937 
1938  return $whitelist;
1939  }
1940 
1951  static function stripAllTags( $html ) {
1952  // Use RemexHtml to tokenize $html and extract the text
1954  $tokenizer = new RemexHtml\Tokenizer\Tokenizer( $handler, $html, [
1955  'ignoreErrors' => true,
1956  // don't ignore char refs, we want them to be decoded
1957  'ignoreNulls' => true,
1958  'skipPreprocess' => true,
1959  ] );
1960  $tokenizer->execute();
1961  $text = $handler->getResult();
1962 
1963  $text = self::normalizeWhitespace( $text );
1964  return $text;
1965  }
1966 
1976  static function hackDocType() {
1977  $out = "<!DOCTYPE html [\n";
1978  foreach ( self::$htmlEntities as $entity => $codepoint ) {
1979  $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1980  }
1981  $out .= "]>\n";
1982  return $out;
1983  }
1984 
1989  static function cleanUrl( $url ) {
1990  # Normalize any HTML entities in input. They will be
1991  # re-escaped by makeExternalLink().
1992  $url = self::decodeCharReferences( $url );
1993 
1994  # Escape any control characters introduced by the above step
1995  $url = preg_replace_callback( '/[\][<>"\\x00-\\x20\\x7F\|]/',
1996  [ __CLASS__, 'cleanUrlCallback' ], $url );
1997 
1998  # Validate hostname portion
1999  $matches = [];
2000  if ( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
2001  list( /* $whole */, $protocol, $host, $rest ) = $matches;
2002 
2003  // Characters that will be ignored in IDNs.
2004  // https://tools.ietf.org/html/rfc3454#section-3.1
2005  // Strip them before further processing so blacklists and such work.
2006  $strip = "/
2007  \\s| # general whitespace
2008  \xc2\xad| # 00ad SOFT HYPHEN
2009  \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
2010  \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
2011  \xe2\x81\xa0| # 2060 WORD JOINER
2012  \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
2013  \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
2014  \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
2015  \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
2016  \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
2017  \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
2018  \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
2019  [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe0f VARIATION SELECTOR-1-16
2020  /xuD";
2021 
2022  $host = preg_replace( $strip, '', $host );
2023 
2024  // IPv6 host names are bracketed with []. Url-decode these.
2025  if ( substr_compare( "//%5B", $host, 0, 5 ) === 0 &&
2026  preg_match( '!^//%5B([0-9A-Fa-f:.]+)%5D((:\d+)?)$!', $host, $matches )
2027  ) {
2028  $host = '//[' . $matches[1] . ']' . $matches[2];
2029  }
2030 
2031  // @todo FIXME: Validate hostnames here
2032 
2033  return $protocol . $host . $rest;
2034  } else {
2035  return $url;
2036  }
2037  }
2038 
2043  static function cleanUrlCallback( $matches ) {
2044  return urlencode( $matches[0] );
2045  }
2046 
2075  public static function validateEmail( $addr ) {
2076  $result = null;
2077  if ( !Hooks::run( 'isValidEmailAddr', [ $addr, &$result ] ) ) {
2078  return $result;
2079  }
2080 
2081  // Please note strings below are enclosed in brackets [], this make the
2082  // hyphen "-" a range indicator. Hence it is double backslashed below.
2083  // See T28948
2084  $rfc5322_atext = "a-z0-9!#$%&'*+\\-\/=?^_`{|}~";
2085  $rfc1034_ldh_str = "a-z0-9\\-";
2086 
2087  $html5_email_regexp = "/
2088  ^ # start of string
2089  [$rfc5322_atext\\.]+ # user part which is liberal :p
2090  @ # 'apostrophe'
2091  [$rfc1034_ldh_str]+ # First domain part
2092  (\\.[$rfc1034_ldh_str]+)* # Following part prefixed with a dot
2093  $ # End of string
2094  /ix"; // case Insensitive, eXtended
2095 
2096  return (bool)preg_match( $html5_email_regexp, $addr );
2097  }
2098 }
utf8ToCodepoint($char)
Determine the Unicode codepoint of a single-character UTF-8 sequence.
$wgExternalInterwikiFragmentMode
Which ID escaping mode should be used for external interwiki links? See documentation for $wgFragment...
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if that
Definition: deferred.txt:11
static decCharReference($codepoint)
Definition: Sanitizer.php:1570
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses & $html
Definition: hooks.txt:2019
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global list
Definition: deferred.txt:11
static decodeTagAttributes($text)
Return an associative array of attribute names and values from a partial tag string.
Definition: Sanitizer.php:1404
this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that probably a stub it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output $out
Definition: hooks.txt:790
static normalizeEntity($name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the equivalent numeric entity re...
Definition: Sanitizer.php:1554
the array() calling protocol came about after MediaWiki 1.4rc1.
static safeEncodeTagAttributes($assoc_array)
Build a partial tag string from an associative array of attribute names and values as returned by dec...
Definition: Sanitizer.php:1440
static normalizeCharReferencesCallback($matches)
Definition: Sanitizer.php:1528
const ID_PRIMARY
Tells escapeUrlForHtml() to encode the ID using the wiki's primary encoding.
Definition: Sanitizer.php:64
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses & $ret
Definition: hooks.txt:2019
static setupAttributeWhitelist()
Foreach array key (an allowed HTML element), return an array of allowed attributes.
Definition: Sanitizer.php:1719
static isEnabled()
Definition: MWTidy.php:58
static fixTagAttributes($text, $element, $sorted=false)
Take a tag soup fragment listing an HTML element's attributes and normalize it to well-formed XML...
Definition: Sanitizer.php:1109
static decodeCharReferencesCallback($matches)
Definition: Sanitizer.php:1655
static cssDecodeCallback($matches)
Definition: Sanitizer.php:1067
you don t have to do a grep find to see where the $wgReverseTitle variable is used
Definition: hooks.txt:115
null for the local wiki Added in
Definition: hooks.txt:1623
$value
static escapeClass($class)
Given a value, escape it so that it can be used as a CSS class and return it.
Definition: Sanitizer.php:1372
static hackDocType()
Hack up a private DOCTYPE with HTML's standard entity declarations.
Definition: Sanitizer.php:1976
static cleanUrl($url)
Definition: Sanitizer.php:1989
when a variable name is used in a it is silently declared as a new local masking the global
Definition: design.txt:93
const UTF8_REPLACEMENT
static hexCharReference($codepoint)
Definition: Sanitizer.php:1583
static validateTagAttributes($attribs, $element)
Take an array of attribute names and values and normalize or discard illegal values for the given ele...
Definition: Sanitizer.php:772
static normalizeWhitespace($text)
Definition: Sanitizer.php:1483
static isReservedDataAttribute($attr)
Given an attribute name, checks whether it is a reserved data attribute (such as data-mw-foo) which i...
Definition: Sanitizer.php:889
static static static $attribsRegex
Lazy-initialised attributes regex, see getAttribsRegex()
Definition: Sanitizer.php:340
The index of the header message $result[1]=The index of the body text message $result[2 through n]=Parameters passed to body text message.Please note the header message cannot receive/use parameters. 'ImportHandleLogItemXMLTag':When parsing a XML tag in a log item.Return false to stop further processing of the tag $reader:XMLReader object $logInfo:Array of information 'ImportHandlePageXMLTag':When parsing a XML tag in a page.Return false to stop further processing of the tag $reader:XMLReader object &$pageInfo:Array of information 'ImportHandleRevisionXMLTag':When parsing a XML tag in a page revision.Return false to stop further processing of the tag $reader:XMLReader object $pageInfo:Array of page information $revisionInfo:Array of revision information 'ImportHandleToplevelXMLTag':When parsing a top level XML tag.Return false to stop further processing of the tag $reader:XMLReader object 'ImportHandleUnknownUser':When a user doesn't exist locally, this hook is called to give extensions an opportunity to auto-create it.If the auto-creation is successful, return false.$name:User name 'ImportHandleUploadXMLTag':When parsing a XML tag in a file upload.Return false to stop further processing of the tag $reader:XMLReader object $revisionInfo:Array of information 'ImportLogInterwikiLink':Hook to change the interwiki link used in log entries and edit summaries for transwiki imports.&$fullInterwikiPrefix:Interwiki prefix, may contain colons.&$pageTitle:String that contains page title. 'ImportSources':Called when reading from the $wgImportSources configuration variable.Can be used to lazy-load the import sources list.&$importSources:The value of $wgImportSources.Modify as necessary.See the comment in DefaultSettings.php for the detail of how to structure this array. 'InfoAction':When building information to display on the action=info page.$context:IContextSource object &$pageInfo:Array of information 'InitializeArticleMaybeRedirect':MediaWiki check to see if title is a redirect.&$title:Title object for the current page &$request:WebRequest &$ignoreRedirect:boolean to skip redirect check &$target:Title/string of redirect target &$article:Article object 'InternalParseBeforeLinks':during Parser's internalParse method before links but after nowiki/noinclude/includeonly/onlyinclude and other processings.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InternalParseBeforeSanitize':during Parser's internalParse method just before the parser removes unwanted/dangerous HTML tags and after nowiki/noinclude/includeonly/onlyinclude and other processings.Ideal for syntax-extensions after template/parser function execution which respect nowiki and HTML-comments.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InterwikiLoadPrefix':When resolving if a given prefix is an interwiki or not.Return true without providing an interwiki to continue interwiki search.$prefix:interwiki prefix we are looking for.&$iwData:output array describing the interwiki with keys iw_url, iw_local, iw_trans and optionally iw_api and iw_wikiid. 'InvalidateEmailComplete':Called after a user's email has been invalidated successfully.$user:user(object) whose email is being invalidated 'IRCLineURL':When constructing the URL to use in an IRC notification.Callee may modify $url and $query, URL will be constructed as $url.$query &$url:URL to index.php &$query:Query string $rc:RecentChange object that triggered url generation 'IsFileCacheable':Override the result of Article::isFileCacheable()(if true) &$article:article(object) being checked 'IsTrustedProxy':Override the result of IP::isTrustedProxy() &$ip:IP being check &$result:Change this value to override the result of IP::isTrustedProxy() 'IsUploadAllowedFromUrl':Override the result of UploadFromUrl::isAllowedUrl() $url:URL used to upload from &$allowed:Boolean indicating if uploading is allowed for given URL 'isValidEmailAddr':Override the result of Sanitizer::validateEmail(), for instance to return false if the domain name doesn't match your organization.$addr:The e-mail address entered by the user &$result:Set this and return false to override the internal checks 'isValidPassword':Override the result of User::isValidPassword() $password:The password entered by the user &$result:Set this and return false to override the internal checks $user:User the password is being validated for 'Language::getMessagesFileName':$code:The language code or the language we're looking for a messages file for &$file:The messages file path, you can override this to change the location. 'LanguageGetMagic':DEPRECATED!Use $magicWords in a file listed in $wgExtensionMessagesFiles instead.Use this to define synonyms of magic words depending of the language &$magicExtensions:associative array of magic words synonyms $lang:language code(string) 'LanguageGetNamespaces':Provide custom ordering for namespaces or remove namespaces.Do not use this hook to add namespaces.Use CanonicalNamespaces for that.&$namespaces:Array of namespaces indexed by their numbers 'LanguageGetSpecialPageAliases':DEPRECATED!Use $specialPageAliases in a file listed in $wgExtensionMessagesFiles instead.Use to define aliases of special pages names depending of the language &$specialPageAliases:associative array of magic words synonyms $lang:language code(string) 'LanguageGetTranslatedLanguageNames':Provide translated language names.&$names:array of language code=> language name $code:language of the preferred translations 'LanguageLinks':Manipulate a page's language links.This is called in various places to allow extensions to define the effective language links for a page.$title:The page's Title.&$links:Array with elements of the form"language:title"in the order that they will be output.&$linkFlags:Associative array mapping prefixed links to arrays of flags.Currently unused, but planned to provide support for marking individual language links in the UI, e.g.for featured articles. 'LanguageSelector':Hook to change the language selector available on a page.$out:The output page.$cssClassName:CSS class name of the language selector. 'LinkBegin':DEPRECATED!Use HtmlPageLinkRendererBegin instead.Used when generating internal and interwiki links in Linker::link(), before processing starts.Return false to skip default processing and return $ret.See documentation for Linker::link() for details on the expected meanings of parameters.$skin:the Skin object $target:the Title that the link is pointing to &$html:the contents that the< a > tag should have(raw HTML) $result
Definition: hooks.txt:2017
if($line===false) $args
Definition: cdb.php:64
const ID_FALLBACK
Tells escapeUrlForHtml() to encode the ID using the fallback encoding, or return false if no fallback...
Definition: Sanitizer.php:72
static decodeCharReferences($text)
Decode any character references, numeric or named entities, in the text and return a UTF-8 string...
Definition: Sanitizer.php:1617
static validateCodepoint($codepoint)
Returns true if a given Unicode codepoint is a valid character in both HTML5 and XML.
Definition: Sanitizer.php:1598
const EVIL_URI_PATTERN
Blacklist for evil uris like javascript: WARNING: DO NOT use this in any place that actually requires...
Definition: Sanitizer.php:56
static escapeIdForExternalInterwiki($id)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid URL...
Definition: Sanitizer.php:1293
const ELEMENT_BITS_REGEX
Acceptable tag name charset from HTML5 parsing spec https://www.w3.org/TR/html5/syntax.html#tag-open-state.
Definition: Sanitizer.php:46
Unicode normalization routines for working with UTF-8 strings.
Definition: UtfNormal.php:48
static decodeChar($codepoint)
Return UTF-8 string for a codepoint if that is a valid character reference, otherwise U+FFFD REPLACEM...
Definition: Sanitizer.php:1674
static normalizeSectionNameWhitespace($section)
Normalizes whitespace in a section name, such as might be returned by Parser::stripSectionName(), for use in the id's that are used for section links.
Definition: Sanitizer.php:1498
static delimiterReplace($startDelim, $endDelim, $replace, $subject, $flags= '')
Perform an operation equivalent to preg_replace() with flags.
static $htmlEntities
List of all named character entities defined in HTML 4.01 https://www.w3.org/TR/html4/sgml/entities.html As well as ' which is only defined starting in XHTML1.
Definition: Sanitizer.php:79
static attributeWhitelist($element)
Fetch the whitelist of acceptable attributes for a given element name.
Definition: Sanitizer.php:1707
static escapeHtmlAllowEntities($html)
Given HTML input, escape with htmlspecialchars but un-escape entities.
Definition: Sanitizer.php:1387
static validateTag($params, $element)
Takes attribute names and values for a tag and the tag name and validates that the tag is allowed to ...
Definition: Sanitizer.php:736
static mergeAttributes($a, $b)
Merge two sets of HTML attributes.
Definition: Sanitizer.php:910
const CHAR_REFS_REGEX
Regular expression to match various types of character references in Sanitizer::normalizeCharReferenc...
Definition: Sanitizer.php:36
static getRecognizedTagData($extratags=[], $removetags=[])
Return the various lists of recognized tags.
Definition: Sanitizer.php:380
$params
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped & $options
Definition: hooks.txt:2019
$wgFragmentMode
How should section IDs be encoded? This array can contain 1 or 2 elements, each of them can be one of...
static validateAttributes($attribs, $whitelist)
Take an array of attribute names and values and normalize or discard illegal values for the given whi...
Definition: Sanitizer.php:792
wfDeprecated($function, $version=false, $component=false, $callerOffset=2)
Throws a warning that $function is deprecated.
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses after processing & $attribs
Definition: hooks.txt:2019
static decodeCharReferencesAndNormalize($text)
Decode any character references, numeric or named entities, in the next and normalize the resulting s...
Definition: Sanitizer.php:1634
static run($event, array $args=[], $deprecatedVersion=null)
Call hook functions defined in Hooks::register and $wgHooks.
Definition: Hooks.php:203
static static $htmlEntityAliases
Character entity aliases accepted by MediaWiki.
Definition: Sanitizer.php:338
static escapeIdReferenceList($referenceString, $options=[])
Given a string containing a space delimited list of ids, escape each id to match ids escaped by the e...
Definition: Sanitizer.php:1342
Apache License January AND DISTRIBUTION Definitions License shall mean the terms and conditions for and distribution as defined by Sections through of this document Licensor shall mean the copyright owner or entity authorized by the copyright owner that is granting the License Legal Entity shall mean the union of the acting entity and all other entities that control are controlled by or are under common control with that entity For the purposes of this definition control direct or to cause the direction or management of such whether by contract or including but not limited to software source documentation and configuration files Object form shall mean any form resulting from mechanical transformation or translation of a Source including but not limited to compiled object generated and conversions to other media types Work shall mean the work of whether in Source or Object made available under the as indicated by a copyright notice that is included in or attached to the whether in Source or Object that is based or other modifications as a an original work of authorship For the purposes of this Derivative Works shall not include works that remain separable or merely the Work and Derivative Works thereof Contribution shall mean any work of including the original version of the Work and any modifications or additions to that Work or Derivative Works that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner For the purposes of this submitted means any form of or written communication sent to the Licensor or its including but not limited to communication on electronic mailing source code control and issue tracking systems that are managed by
static cleanUrlCallback($matches)
Definition: Sanitizer.php:2043
This document is intended to provide useful advice for parties seeking to redistribute MediaWiki to end users It s targeted particularly at maintainers for Linux since it s been observed that distribution packages of MediaWiki often break We ve consistently had to recommend that users seeking support use official tarballs instead of their distribution s and this often solves whatever problem the user is having It would be nice if this could such as
Definition: distributors.txt:9
this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist Do not use this to implement individual filters if they are compatible with the ChangesListFilter and ChangesListFilterGroup structure use sub classes of those in conjunction with the ChangesListSpecialPageStructuredFilters hook This hook can be used to implement filters that do not implement that or custom behavior that is not an individual filter e g Watchlist and Watchlist you will want to construct new ChangesListBooleanFilter or ChangesListStringOptionsFilter objects When constructing them
Definition: hooks.txt:997
usually copyright or history_copyright This message must be in HTML not wikitext if the section is included from a template $section
Definition: hooks.txt:3038
static escapeId($id, $options=[])
Given a value, escape it so that it can be used in an id attribute and return it. ...
Definition: Sanitizer.php:1209
wfUrlProtocols($includeProtocolRelative=true)
Returns a regular expression of url protocols.
static normalizeCss($value)
Normalize CSS into a format we can easily search for hostile input.
Definition: Sanitizer.php:932
const XMLNS_ATTRIBUTE_PATTERN
Definition: Sanitizer.php:57
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency which acts as the top level factory for services in MediaWiki which can be used to gain access to default instances of various services MediaWikiServices however also allows new services to be defined and default services to be redefined Services are defined or redefined by providing a callback the instantiator that will return a new instance of the service When it will create an instance of MediaWikiServices and populate it with the services defined in the files listed by thereby bootstrapping the DI framework Per $wgServiceWiringFiles lists includes ServiceWiring php
Definition: injection.txt:35
static escapeIdForAttribute($id, $mode=self::ID_PRIMARY)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid HTM...
Definition: Sanitizer.php:1243
static removeHTMLtags($text, $processCallback=null, $args=[], $extratags=[], $removetags=[], $warnCallback=null)
Cleans up HTML, removes dangerous tags and attributes, and removes HTML comments. ...
Definition: Sanitizer.php:477
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if so it s not worth the trouble Since there is a job queue in the jobs table
Definition: deferred.txt:11
static normalizeCharReferences($text)
Ensure that any entities and character references are legal for XML and XHTML specifically.
Definition: Sanitizer.php:1517
you have access to all of the normal MediaWiki so you can get a DB use the etc For full docs on the Maintenance class
Definition: maintenance.txt:52
static escapeIdForLink($id)
Given a section name or other user-generated or otherwise unsafe string, escapes it to be a valid URL...
Definition: Sanitizer.php:1270
this class mediates it Skin Encapsulates a look and feel for the wiki All of the functions that render HTML and make choices about how to render it are here and are called from various other places when and is meant to be subclassed with other skins that may override some of its functions The User object contains a reference to a and so rather than having a global skin object we just rely on the global User and get the skin with $wgUser and also has some character encoding functions and other locale stuff The current user interface language is instantiated as and the local content language as $wgContLang
Definition: design.txt:56
Allows to change the fields on the form that will be generated $name
Definition: hooks.txt:302
static removeHTMLcomments($text)
Remove '', and everything between.
Definition: Sanitizer.php:690
static getAttribsRegex()
Regular expression to match HTML/XML attribute pairs within a tag.
Definition: Sanitizer.php:355
codepointToUtf8($codepoint)
Return UTF-8 sequence for a given Unicode code point.
static validateEmail($addr)
Does a string look like an e-mail address?
Definition: Sanitizer.php:2075
static checkCss($value)
Pick apart some CSS and check it for forbidden or unsafe structures.
Definition: Sanitizer.php:1039
static stripAllTags($html)
Take a fragment of (potentially invalid) HTML and return a version with any tags removed, encoded as plain text.
Definition: Sanitizer.php:1951
static getTagAttributeCallback($set)
Pick the appropriate attribute value from a match set from the attribs regex matches.
Definition: Sanitizer.php:1459
</td >< td > &</td >< td > t want your writing to be edited mercilessly and redistributed at will
static escapeIdInternal($id, $mode)
Helper for escapeIdFor*() functions.
Definition: Sanitizer.php:1308
this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that probably a stub it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output modifiable modifiable after all normalizations have been except for the $wgMaxImageArea check set to true or false to override the $wgMaxImageArea check result gives extension the possibility to transform it themselves $handler
Definition: hooks.txt:790
static decodeEntity($name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the UTF-8 encoding of that chara...
Definition: Sanitizer.php:1690
static safeEncodeAttribute($text)
Encode an attribute value for HTML tags, with extra armoring against further wiki processing...
Definition: Sanitizer.php:1150
static configuration should be added through ResourceLoaderGetConfigVars instead & $vars
Definition: hooks.txt:2252
static encodeAttribute($text)
Encode an attribute value for HTML output.
Definition: Sanitizer.php:1129
$matches