MediaWiki  master
Sanitizer.php
Go to the documentation of this file.
1 <?php
31 class Sanitizer {
37  '/&([A-Za-z0-9\x80-\xff]+);
38  |&\#([0-9]+);
39  |&\#[xX]([0-9A-Fa-f]+);
40  |(&)/x';
41 
46  const ELEMENT_BITS_REGEX = '!^(/?)([A-Za-z][^\t\n\v />\0]*+)([^>]*?)(/?>)([^<]*)$!';
47 
56  const EVIL_URI_PATTERN = '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i';
57  const XMLNS_ATTRIBUTE_PATTERN = "/^xmlns:[:A-Z_a-z-.0-9]+$/";
58 
64  private static $htmlEntities = [
65  'Aacute' => 193,
66  'aacute' => 225,
67  'Acirc' => 194,
68  'acirc' => 226,
69  'acute' => 180,
70  'AElig' => 198,
71  'aelig' => 230,
72  'Agrave' => 192,
73  'agrave' => 224,
74  'alefsym' => 8501,
75  'Alpha' => 913,
76  'alpha' => 945,
77  'amp' => 38,
78  'and' => 8743,
79  'ang' => 8736,
80  'apos' => 39, // New in XHTML & HTML 5; avoid in output for compatibility with IE.
81  'Aring' => 197,
82  'aring' => 229,
83  'asymp' => 8776,
84  'Atilde' => 195,
85  'atilde' => 227,
86  'Auml' => 196,
87  'auml' => 228,
88  'bdquo' => 8222,
89  'Beta' => 914,
90  'beta' => 946,
91  'brvbar' => 166,
92  'bull' => 8226,
93  'cap' => 8745,
94  'Ccedil' => 199,
95  'ccedil' => 231,
96  'cedil' => 184,
97  'cent' => 162,
98  'Chi' => 935,
99  'chi' => 967,
100  'circ' => 710,
101  'clubs' => 9827,
102  'cong' => 8773,
103  'copy' => 169,
104  'crarr' => 8629,
105  'cup' => 8746,
106  'curren' => 164,
107  'dagger' => 8224,
108  'Dagger' => 8225,
109  'darr' => 8595,
110  'dArr' => 8659,
111  'deg' => 176,
112  'Delta' => 916,
113  'delta' => 948,
114  'diams' => 9830,
115  'divide' => 247,
116  'Eacute' => 201,
117  'eacute' => 233,
118  'Ecirc' => 202,
119  'ecirc' => 234,
120  'Egrave' => 200,
121  'egrave' => 232,
122  'empty' => 8709,
123  'emsp' => 8195,
124  'ensp' => 8194,
125  'Epsilon' => 917,
126  'epsilon' => 949,
127  'equiv' => 8801,
128  'Eta' => 919,
129  'eta' => 951,
130  'ETH' => 208,
131  'eth' => 240,
132  'Euml' => 203,
133  'euml' => 235,
134  'euro' => 8364,
135  'exist' => 8707,
136  'fnof' => 402,
137  'forall' => 8704,
138  'frac12' => 189,
139  'frac14' => 188,
140  'frac34' => 190,
141  'frasl' => 8260,
142  'Gamma' => 915,
143  'gamma' => 947,
144  'ge' => 8805,
145  'gt' => 62,
146  'harr' => 8596,
147  'hArr' => 8660,
148  'hearts' => 9829,
149  'hellip' => 8230,
150  'Iacute' => 205,
151  'iacute' => 237,
152  'Icirc' => 206,
153  'icirc' => 238,
154  'iexcl' => 161,
155  'Igrave' => 204,
156  'igrave' => 236,
157  'image' => 8465,
158  'infin' => 8734,
159  'int' => 8747,
160  'Iota' => 921,
161  'iota' => 953,
162  'iquest' => 191,
163  'isin' => 8712,
164  'Iuml' => 207,
165  'iuml' => 239,
166  'Kappa' => 922,
167  'kappa' => 954,
168  'Lambda' => 923,
169  'lambda' => 955,
170  'lang' => 9001,
171  'laquo' => 171,
172  'larr' => 8592,
173  'lArr' => 8656,
174  'lceil' => 8968,
175  'ldquo' => 8220,
176  'le' => 8804,
177  'lfloor' => 8970,
178  'lowast' => 8727,
179  'loz' => 9674,
180  'lrm' => 8206,
181  'lsaquo' => 8249,
182  'lsquo' => 8216,
183  'lt' => 60,
184  'macr' => 175,
185  'mdash' => 8212,
186  'micro' => 181,
187  'middot' => 183,
188  'minus' => 8722,
189  'Mu' => 924,
190  'mu' => 956,
191  'nabla' => 8711,
192  'nbsp' => 160,
193  'ndash' => 8211,
194  'ne' => 8800,
195  'ni' => 8715,
196  'not' => 172,
197  'notin' => 8713,
198  'nsub' => 8836,
199  'Ntilde' => 209,
200  'ntilde' => 241,
201  'Nu' => 925,
202  'nu' => 957,
203  'Oacute' => 211,
204  'oacute' => 243,
205  'Ocirc' => 212,
206  'ocirc' => 244,
207  'OElig' => 338,
208  'oelig' => 339,
209  'Ograve' => 210,
210  'ograve' => 242,
211  'oline' => 8254,
212  'Omega' => 937,
213  'omega' => 969,
214  'Omicron' => 927,
215  'omicron' => 959,
216  'oplus' => 8853,
217  'or' => 8744,
218  'ordf' => 170,
219  'ordm' => 186,
220  'Oslash' => 216,
221  'oslash' => 248,
222  'Otilde' => 213,
223  'otilde' => 245,
224  'otimes' => 8855,
225  'Ouml' => 214,
226  'ouml' => 246,
227  'para' => 182,
228  'part' => 8706,
229  'permil' => 8240,
230  'perp' => 8869,
231  'Phi' => 934,
232  'phi' => 966,
233  'Pi' => 928,
234  'pi' => 960,
235  'piv' => 982,
236  'plusmn' => 177,
237  'pound' => 163,
238  'prime' => 8242,
239  'Prime' => 8243,
240  'prod' => 8719,
241  'prop' => 8733,
242  'Psi' => 936,
243  'psi' => 968,
244  'quot' => 34,
245  'radic' => 8730,
246  'rang' => 9002,
247  'raquo' => 187,
248  'rarr' => 8594,
249  'rArr' => 8658,
250  'rceil' => 8969,
251  'rdquo' => 8221,
252  'real' => 8476,
253  'reg' => 174,
254  'rfloor' => 8971,
255  'Rho' => 929,
256  'rho' => 961,
257  'rlm' => 8207,
258  'rsaquo' => 8250,
259  'rsquo' => 8217,
260  'sbquo' => 8218,
261  'Scaron' => 352,
262  'scaron' => 353,
263  'sdot' => 8901,
264  'sect' => 167,
265  'shy' => 173,
266  'Sigma' => 931,
267  'sigma' => 963,
268  'sigmaf' => 962,
269  'sim' => 8764,
270  'spades' => 9824,
271  'sub' => 8834,
272  'sube' => 8838,
273  'sum' => 8721,
274  'sup' => 8835,
275  'sup1' => 185,
276  'sup2' => 178,
277  'sup3' => 179,
278  'supe' => 8839,
279  'szlig' => 223,
280  'Tau' => 932,
281  'tau' => 964,
282  'there4' => 8756,
283  'Theta' => 920,
284  'theta' => 952,
285  'thetasym' => 977,
286  'thinsp' => 8201,
287  'THORN' => 222,
288  'thorn' => 254,
289  'tilde' => 732,
290  'times' => 215,
291  'trade' => 8482,
292  'Uacute' => 218,
293  'uacute' => 250,
294  'uarr' => 8593,
295  'uArr' => 8657,
296  'Ucirc' => 219,
297  'ucirc' => 251,
298  'Ugrave' => 217,
299  'ugrave' => 249,
300  'uml' => 168,
301  'upsih' => 978,
302  'Upsilon' => 933,
303  'upsilon' => 965,
304  'Uuml' => 220,
305  'uuml' => 252,
306  'weierp' => 8472,
307  'Xi' => 926,
308  'xi' => 958,
309  'Yacute' => 221,
310  'yacute' => 253,
311  'yen' => 165,
312  'Yuml' => 376,
313  'yuml' => 255,
314  'Zeta' => 918,
315  'zeta' => 950,
316  'zwj' => 8205,
317  'zwnj' => 8204
318  ];
319 
323  private static $htmlEntityAliases = [
324  'רלמ' => 'rlm',
325  'رلم' => 'rlm',
326  ];
327 
331  private static $attribsRegex;
332 
340  static function getAttribsRegex() {
341  if ( self::$attribsRegex === null ) {
342  $attribFirst = '[:A-Z_a-z0-9]';
343  $attrib = '[:A-Z_a-z-.0-9]';
344  $space = '[\x09\x0a\x0c\x0d\x20]';
345  self::$attribsRegex =
346  "/(?:^|$space)({$attribFirst}{$attrib}*)
347  ($space*=$space*
348  (?:
349  # The attribute value: quoted or alone
350  \"([^\"]*)(?:\"|\$)
351  | '([^']*)(?:'|\$)
352  | (((?!$space|>).)*)
353  )
354  )?(?=$space|\$)/sx";
355  }
356  return self::$attribsRegex;
357  }
358 
365  public static function getRecognizedTagData( $extratags = [], $removetags = [] ) {
366  global $wgAllowImageTag;
367 
368  static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
369  $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
370 
371  // Base our staticInitialised variable off of the global config state so that if the globals
372  // are changed (like in the screwed up test system) we will re-initialise the settings.
373  $globalContext = $wgAllowImageTag;
374  if ( !$staticInitialised || $staticInitialised != $globalContext ) {
375  $htmlpairsStatic = [ # Tags that must be closed
376  'b', 'bdi', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
377  'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
378  'strike', 'strong', 'tt', 'var', 'div', 'center',
379  'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
380  'ruby', 'rb', 'rp', 'rt', 'rtc', 'p', 'span', 'abbr', 'dfn',
381  'kbd', 'samp', 'data', 'time', 'mark'
382  ];
383  $htmlsingle = [
384  'br', 'wbr', 'hr', 'li', 'dt', 'dd', 'meta', 'link'
385  ];
386 
387  # Elements that cannot have close tags. This is (not coincidentally)
388  # also the list of tags for which the HTML 5 parsing algorithm
389  # requires you to "acknowledge the token's self-closing flag", i.e.
390  # a self-closing tag like <br/> is not an HTML 5 parse error only
391  # for this list.
392  $htmlsingleonly = [
393  'br', 'wbr', 'hr', 'meta', 'link'
394  ];
395 
396  $htmlnest = [ # Tags that can be nested--??
397  'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
398  'li', 'dl', 'dt', 'dd', 'font', 'big', 'small', 'sub', 'sup', 'span',
399  'var', 'kbd', 'samp', 'em', 'strong', 'q', 'ruby', 'bdo'
400  ];
401  $tabletags = [ # Can only appear inside table, we will close them
402  'td', 'th', 'tr',
403  ];
404  $htmllist = [ # Tags used by list
405  'ul', 'ol',
406  ];
407  $listtags = [ # Tags that can appear in a list
408  'li',
409  ];
410 
411  if ( $wgAllowImageTag ) {
412  $htmlsingle[] = 'img';
413  $htmlsingleonly[] = 'img';
414  }
415 
416  $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
417  $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
418 
419  # Convert them all to hashtables for faster lookup
420  $vars = [ 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
421  'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' ];
422  foreach ( $vars as $var ) {
423  $$var = array_flip( $$var );
424  }
425  $staticInitialised = $globalContext;
426  }
427 
428  # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
429  $extratags = array_flip( $extratags );
430  $removetags = array_flip( $removetags );
431  $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
432  $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ), $removetags );
433 
434  return [
435  'htmlpairs' => $htmlpairs,
436  'htmlsingle' => $htmlsingle,
437  'htmlsingleonly' => $htmlsingleonly,
438  'htmlnest' => $htmlnest,
439  'tabletags' => $tabletags,
440  'htmllist' => $htmllist,
441  'listtags' => $listtags,
442  'htmlsingleallowed' => $htmlsingleallowed,
443  'htmlelements' => $htmlelements,
444  ];
445  }
446 
462  public static function removeHTMLtags( $text, $processCallback = null,
463  $args = [], $extratags = [], $removetags = [], $warnCallback = null
464  ) {
465  extract( self::getRecognizedTagData( $extratags, $removetags ) );
466 
467  # Remove HTML comments
468  $text = Sanitizer::removeHTMLcomments( $text );
469  $bits = explode( '<', $text );
470  $text = str_replace( '>', '&gt;', array_shift( $bits ) );
471  if ( !MWTidy::isEnabled() ) {
472  $tagstack = $tablestack = [];
473  foreach ( $bits as $x ) {
474  $regs = [];
475  # $slash: Does the current element start with a '/'?
476  # $t: Current element name
477  # $params: String between element name and >
478  # $brace: Ending '>' or '/>'
479  # $rest: Everything until the next element of $bits
480  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
481  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
482  } else {
483  $slash = $t = $params = $brace = $rest = null;
484  }
485 
486  $badtag = false;
487  $t = strtolower( $t );
488  if ( isset( $htmlelements[$t] ) ) {
489  # Check our stack
490  if ( $slash && isset( $htmlsingleonly[$t] ) ) {
491  $badtag = true;
492  } elseif ( $slash ) {
493  # Closing a tag... is it the one we just opened?
494  MediaWiki\suppressWarnings();
495  $ot = array_pop( $tagstack );
496  MediaWiki\restoreWarnings();
497 
498  if ( $ot != $t ) {
499  if ( isset( $htmlsingleallowed[$ot] ) ) {
500  # Pop all elements with an optional close tag
501  # and see if we find a match below them
502  $optstack = [];
503  array_push( $optstack, $ot );
504  MediaWiki\suppressWarnings();
505  $ot = array_pop( $tagstack );
506  MediaWiki\restoreWarnings();
507  while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
508  array_push( $optstack, $ot );
509  MediaWiki\suppressWarnings();
510  $ot = array_pop( $tagstack );
511  MediaWiki\restoreWarnings();
512  }
513  if ( $t != $ot ) {
514  # No match. Push the optional elements back again
515  $badtag = true;
516  MediaWiki\suppressWarnings();
517  $ot = array_pop( $optstack );
518  MediaWiki\restoreWarnings();
519  while ( $ot ) {
520  array_push( $tagstack, $ot );
521  MediaWiki\suppressWarnings();
522  $ot = array_pop( $optstack );
523  MediaWiki\restoreWarnings();
524  }
525  }
526  } else {
527  MediaWiki\suppressWarnings();
528  array_push( $tagstack, $ot );
529  MediaWiki\restoreWarnings();
530 
531  # <li> can be nested in <ul> or <ol>, skip those cases:
532  if ( !isset( $htmllist[$ot] ) || !isset( $listtags[$t] ) ) {
533  $badtag = true;
534  }
535  }
536  } else {
537  if ( $t == 'table' ) {
538  $tagstack = array_pop( $tablestack );
539  }
540  }
541  $newparams = '';
542  } else {
543  # Keep track for later
544  if ( isset( $tabletags[$t] ) && !in_array( 'table', $tagstack ) ) {
545  $badtag = true;
546  } elseif ( in_array( $t, $tagstack ) && !isset( $htmlnest[$t] ) ) {
547  $badtag = true;
548  #  Is it a self closed htmlpair ? (T7487)
549  } elseif ( $brace == '/>' && isset( $htmlpairs[$t] ) ) {
550  // Eventually we'll just remove the self-closing
551  // slash, in order to be consistent with HTML5
552  // semantics.
553  // $brace = '>';
554  // For now, let's just warn authors to clean up.
555  if ( is_callable( $warnCallback ) ) {
556  call_user_func_array( $warnCallback, [ 'deprecated-self-close-category' ] );
557  }
558  $badtag = true;
559  } elseif ( isset( $htmlsingleonly[$t] ) ) {
560  # Hack to force empty tag for unclosable elements
561  $brace = '/>';
562  } elseif ( isset( $htmlsingle[$t] ) ) {
563  # Hack to not close $htmlsingle tags
564  $brace = null;
565  # Still need to push this optionally-closed tag to
566  # the tag stack so that we can match end tags
567  # instead of marking them as bad.
568  array_push( $tagstack, $t );
569  } elseif ( isset( $tabletags[$t] ) && in_array( $t, $tagstack ) ) {
570  // New table tag but forgot to close the previous one
571  $text .= "</$t>";
572  } else {
573  if ( $t == 'table' ) {
574  array_push( $tablestack, $tagstack );
575  $tagstack = [];
576  }
577  array_push( $tagstack, $t );
578  }
579 
580  # Replace any variables or template parameters with
581  # plaintext results.
582  if ( is_callable( $processCallback ) ) {
583  call_user_func_array( $processCallback, [ &$params, $args ] );
584  }
585 
586  if ( !Sanitizer::validateTag( $params, $t ) ) {
587  $badtag = true;
588  }
589 
590  # Strip non-approved attributes from the tag
591  $newparams = Sanitizer::fixTagAttributes( $params, $t );
592  }
593  if ( !$badtag ) {
594  $rest = str_replace( '>', '&gt;', $rest );
595  $close = ( $brace == '/>' && !$slash ) ? ' /' : '';
596  $text .= "<$slash$t$newparams$close>$rest";
597  continue;
598  }
599  }
600  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
601  }
602  # Close off any remaining tags
603  while ( is_array( $tagstack ) && ( $t = array_pop( $tagstack ) ) ) {
604  $text .= "</$t>\n";
605  if ( $t == 'table' ) {
606  $tagstack = array_pop( $tablestack );
607  }
608  }
609  } else {
610  # this might be possible using tidy itself
611  foreach ( $bits as $x ) {
612  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
613  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
614 
615  $badtag = false;
616  $t = strtolower( $t );
617  if ( isset( $htmlelements[$t] ) ) {
618  if ( is_callable( $processCallback ) ) {
619  call_user_func_array( $processCallback, [ &$params, $args ] );
620  }
621 
622  if ( $brace == '/>' && !( isset( $htmlsingle[$t] ) || isset( $htmlsingleonly[$t] ) ) ) {
623  // Eventually we'll just remove the self-closing
624  // slash, in order to be consistent with HTML5
625  // semantics.
626  // $brace = '>';
627  // For now, let's just warn authors to clean up.
628  if ( is_callable( $warnCallback ) ) {
629  call_user_func_array( $warnCallback, [ 'deprecated-self-close-category' ] );
630  }
631  }
632  if ( !Sanitizer::validateTag( $params, $t ) ) {
633  $badtag = true;
634  }
635 
636  $newparams = Sanitizer::fixTagAttributes( $params, $t );
637  if ( !$badtag ) {
638  if ( $brace === '/>' && !isset( $htmlsingleonly[$t] ) ) {
639  # Interpret self-closing tags as empty tags even when
640  # HTML 5 would interpret them as start tags. Such input
641  # is commonly seen on Wikimedia wikis with this intention.
642  $brace = "></$t>";
643  }
644 
645  $rest = str_replace( '>', '&gt;', $rest );
646  $text .= "<$slash$t$newparams$brace$rest";
647  continue;
648  }
649  }
650  }
651  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
652  }
653  }
654  return $text;
655  }
656 
666  public static function removeHTMLcomments( $text ) {
667  while ( ( $start = strpos( $text, '<!--' ) ) !== false ) {
668  $end = strpos( $text, '-->', $start + 4 );
669  if ( $end === false ) {
670  # Unterminated comment; bail out
671  break;
672  }
673 
674  $end += 3;
675 
676  # Trim space and newline if the comment is both
677  # preceded and followed by a newline
678  $spaceStart = max( $start - 1, 0 );
679  $spaceLen = $end - $spaceStart;
680  while ( substr( $text, $spaceStart, 1 ) === ' ' && $spaceStart > 0 ) {
681  $spaceStart--;
682  $spaceLen++;
683  }
684  while ( substr( $text, $spaceStart + $spaceLen, 1 ) === ' ' ) {
685  $spaceLen++;
686  }
687  if ( substr( $text, $spaceStart, 1 ) === "\n"
688  && substr( $text, $spaceStart + $spaceLen, 1 ) === "\n" ) {
689  # Remove the comment, leading and trailing
690  # spaces, and leave only one newline.
691  $text = substr_replace( $text, "\n", $spaceStart, $spaceLen + 1 );
692  } else {
693  # Remove just the comment.
694  $text = substr_replace( $text, '', $start, $end - $start );
695  }
696  }
697  return $text;
698  }
699 
712  static function validateTag( $params, $element ) {
714 
715  if ( $element == 'meta' || $element == 'link' ) {
716  if ( !isset( $params['itemprop'] ) ) {
717  // <meta> and <link> must have an itemprop="" otherwise they are not valid or safe in content
718  return false;
719  }
720  if ( $element == 'meta' && !isset( $params['content'] ) ) {
721  // <meta> must have a content="" for the itemprop
722  return false;
723  }
724  if ( $element == 'link' && !isset( $params['href'] ) ) {
725  // <link> must have an associated href=""
726  return false;
727  }
728  }
729 
730  return true;
731  }
732 
748  static function validateTagAttributes( $attribs, $element ) {
750  Sanitizer::attributeWhitelist( $element ) );
751  }
752 
768  static function validateAttributes( $attribs, $whitelist ) {
769  $whitelist = array_flip( $whitelist );
770  $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
771 
772  $out = [];
773  foreach ( $attribs as $attribute => $value ) {
774  # Allow XML namespace declaration to allow RDFa
775  if ( preg_match( self::XMLNS_ATTRIBUTE_PATTERN, $attribute ) ) {
776  if ( !preg_match( self::EVIL_URI_PATTERN, $value ) ) {
777  $out[$attribute] = $value;
778  }
779 
780  continue;
781  }
782 
783  # Allow any attribute beginning with "data-"
784  # However:
785  # * Disallow data attributes used by MediaWiki code
786  # * Ensure that the attribute is not namespaced by banning
787  # colons.
788  if ( !preg_match( '/^data-[^:]*$/i', $attribute )
789  && !isset( $whitelist[$attribute] )
790  || self::isReservedDataAttribute( $attribute )
791  ) {
792  continue;
793  }
794 
795  # Strip javascript "expression" from stylesheets.
796  # https://msdn.microsoft.com/en-us/library/ms537634.aspx
797  if ( $attribute == 'style' ) {
799  }
800 
801  # Escape HTML id attributes
802  if ( $attribute === 'id' ) {
803  $value = Sanitizer::escapeId( $value, 'noninitial' );
804  }
805 
806  # Escape HTML id reference lists
807  if ( $attribute === 'aria-describedby'
808  || $attribute === 'aria-flowto'
809  || $attribute === 'aria-labelledby'
810  || $attribute === 'aria-owns'
811  ) {
813  }
814 
815  // RDFa and microdata properties allow URLs, URIs and/or CURIs.
816  // Check them for sanity.
817  if ( $attribute === 'rel' || $attribute === 'rev'
818  # RDFa
819  || $attribute === 'about' || $attribute === 'property'
820  || $attribute === 'resource' || $attribute === 'datatype'
821  || $attribute === 'typeof'
822  # HTML5 microdata
823  || $attribute === 'itemid' || $attribute === 'itemprop'
824  || $attribute === 'itemref' || $attribute === 'itemscope'
825  || $attribute === 'itemtype'
826  ) {
827  // Paranoia. Allow "simple" values but suppress javascript
828  if ( preg_match( self::EVIL_URI_PATTERN, $value ) ) {
829  continue;
830  }
831  }
832 
833  # NOTE: even though elements using href/src are not allowed directly, supply
834  # validation code that can be used by tag hook handlers, etc
835  if ( $attribute === 'href' || $attribute === 'src' || $attribute === 'poster' ) {
836  if ( !preg_match( $hrefExp, $value ) ) {
837  continue; // drop any href or src attributes not using an allowed protocol.
838  // NOTE: this also drops all relative URLs
839  }
840  }
841 
842  // If this attribute was previously set, override it.
843  // Output should only have one attribute of each name.
844  $out[$attribute] = $value;
845  }
846 
847  # itemtype, itemid, itemref don't make sense without itemscope
848  if ( !array_key_exists( 'itemscope', $out ) ) {
849  unset( $out['itemtype'] );
850  unset( $out['itemid'] );
851  unset( $out['itemref'] );
852  }
853  # TODO: Strip itemprop if we aren't descendants of an itemscope or pointed to by an itemref.
854 
855  return $out;
856  }
857 
865  public static function isReservedDataAttribute( $attr ) {
866  // data-ooui is reserved for ooui.
867  // data-mw and data-parsoid are reserved for parsoid.
868  // data-mw-<name here> is reserved for extensions (or core) if
869  // they need to communicate some data to the client and want to be
870  // sure that it isn't coming from an untrusted user.
871  // We ignore the possibility of namespaces since user-generated HTML
872  // can't use them anymore.
873  return (bool)preg_match( '/^data-(ooui|mw|parsoid)/i', $attr );
874  }
875 
886  static function mergeAttributes( $a, $b ) {
887  $out = array_merge( $a, $b );
888  if ( isset( $a['class'] ) && isset( $b['class'] )
889  && is_string( $a['class'] ) && is_string( $b['class'] )
890  && $a['class'] !== $b['class']
891  ) {
892  $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
893  -1, PREG_SPLIT_NO_EMPTY );
894  $out['class'] = implode( ' ', array_unique( $classes ) );
895  }
896  return $out;
897  }
898 
908  public static function normalizeCss( $value ) {
909 
910  // Decode character references like &#123;
912 
913  // Decode escape sequences and line continuation
914  // See the grammar in the CSS 2 spec, appendix D.
915  // This has to be done AFTER decoding character references.
916  // This means it isn't possible for this function to return
917  // unsanitized escape sequences. It is possible to manufacture
918  // input that contains character references that decode to
919  // escape sequences that decode to character references, but
920  // it's OK for the return value to contain character references
921  // because the caller is supposed to escape those anyway.
922  static $decodeRegex;
923  if ( !$decodeRegex ) {
924  $space = '[\\x20\\t\\r\\n\\f]';
925  $nl = '(?:\\n|\\r\\n|\\r|\\f)';
926  $backslash = '\\\\';
927  $decodeRegex = "/ $backslash
928  (?:
929  ($nl) | # 1. Line continuation
930  ([0-9A-Fa-f]{1,6})$space? | # 2. character number
931  (.) | # 3. backslash cancelling special meaning
932  () | # 4. backslash at end of string
933  )/xu";
934  }
935  $value = preg_replace_callback( $decodeRegex,
936  [ __CLASS__, 'cssDecodeCallback' ], $value );
937 
938  // Normalize Halfwidth and Fullwidth Unicode block that IE6 might treat as ascii
939  $value = preg_replace_callback(
940  '/[!-[]-z]/u', // U+FF01 to U+FF5A, excluding U+FF3C (T60088)
941  function ( $matches ) {
943  if ( $cp === false ) {
944  return '';
945  }
946  return chr( $cp - 65248 ); // ASCII range \x21-\x7A
947  },
948  $value
949  );
950 
951  // Convert more characters IE6 might treat as ascii
952  // U+0280, U+0274, U+207F, U+029F, U+026A, U+207D, U+208D
953  $value = str_replace(
954  [ 'ʀ', 'ɴ', 'ⁿ', 'ʟ', 'ɪ', '⁽', '₍' ],
955  [ 'r', 'n', 'n', 'l', 'i', '(', '(' ],
956  $value
957  );
958 
959  // Let the value through if it's nothing but a single comment, to
960  // allow other functions which may reject it to pass some error
961  // message through.
962  if ( !preg_match( '! ^ \s* /\* [^*\\/]* \*/ \s* $ !x', $value ) ) {
963  // Remove any comments; IE gets token splitting wrong
964  // This must be done AFTER decoding character references and
965  // escape sequences, because those steps can introduce comments
966  // This step cannot introduce character references or escape
967  // sequences, because it replaces comments with spaces rather
968  // than removing them completely.
969  $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value );
970 
971  // Remove anything after a comment-start token, to guard against
972  // incorrect client implementations.
973  $commentPos = strpos( $value, '/*' );
974  if ( $commentPos !== false ) {
975  $value = substr( $value, 0, $commentPos );
976  }
977  }
978 
979  // S followed by repeat, iteration, or prolonged sound marks,
980  // which IE will treat as "ss"
981  $value = preg_replace(
982  '/s(?:
983  \xE3\x80\xB1 | # U+3031
984  \xE3\x82\x9D | # U+309D
985  \xE3\x83\xBC | # U+30FC
986  \xE3\x83\xBD | # U+30FD
987  \xEF\xB9\xBC | # U+FE7C
988  \xEF\xB9\xBD | # U+FE7D
989  \xEF\xBD\xB0 # U+FF70
990  )/ix',
991  'ss',
992  $value
993  );
994 
995  return $value;
996  }
997 
1016  static function checkCss( $value ) {
1017  $value = self::normalizeCss( $value );
1018 
1019  // Reject problematic keywords and control characters
1020  if ( preg_match( '/[\000-\010\013\016-\037\177]/', $value ) ||
1021  strpos( $value, UtfNormal\Constants::UTF8_REPLACEMENT ) !== false ) {
1022  return '/* invalid control char */';
1023  } elseif ( preg_match(
1024  '! expression
1025  | filter\s*:
1026  | accelerator\s*:
1027  | -o-link\s*:
1028  | -o-link-source\s*:
1029  | -o-replace\s*:
1030  | url\s*\(
1031  | image\s*\(
1032  | image-set\s*\(
1033  | attr\s*\([^)]+[\s,]+url
1034  !ix', $value ) ) {
1035  return '/* insecure input */';
1036  }
1037  return $value;
1038  }
1039 
1044  static function cssDecodeCallback( $matches ) {
1045  if ( $matches[1] !== '' ) {
1046  // Line continuation
1047  return '';
1048  } elseif ( $matches[2] !== '' ) {
1049  $char = UtfNormal\Utils::codepointToUtf8( hexdec( $matches[2] ) );
1050  } elseif ( $matches[3] !== '' ) {
1051  $char = $matches[3];
1052  } else {
1053  $char = '\\';
1054  }
1055  if ( $char == "\n" || $char == '"' || $char == "'" || $char == '\\' ) {
1056  // These characters need to be escaped in strings
1057  // Clean up the escape sequence to avoid parsing errors by clients
1058  return '\\' . dechex( ord( $char ) ) . ' ';
1059  } else {
1060  // Decode unnecessary escape
1061  return $char;
1062  }
1063  }
1064 
1086  static function fixTagAttributes( $text, $element, $sorted = false ) {
1087  if ( trim( $text ) == '' ) {
1088  return '';
1089  }
1090 
1091  $decoded = Sanitizer::decodeTagAttributes( $text );
1092  $stripped = Sanitizer::validateTagAttributes( $decoded, $element );
1093 
1094  if ( $sorted ) {
1095  ksort( $stripped );
1096  }
1097 
1098  return Sanitizer::safeEncodeTagAttributes( $stripped );
1099  }
1100 
1106  static function encodeAttribute( $text ) {
1107  $encValue = htmlspecialchars( $text, ENT_QUOTES );
1108 
1109  // Whitespace is normalized during attribute decoding,
1110  // so if we've been passed non-spaces we must encode them
1111  // ahead of time or they won't be preserved.
1112  $encValue = strtr( $encValue, [
1113  "\n" => '&#10;',
1114  "\r" => '&#13;',
1115  "\t" => '&#9;',
1116  ] );
1117 
1118  return $encValue;
1119  }
1120 
1127  static function safeEncodeAttribute( $text ) {
1128  $encValue = Sanitizer::encodeAttribute( $text );
1129 
1130  # Templates and links may be expanded in later parsing,
1131  # creating invalid or dangerous output. Suppress this.
1132  $encValue = strtr( $encValue, [
1133  '<' => '&lt;', // This should never happen,
1134  '>' => '&gt;', // we've received invalid input
1135  '"' => '&quot;', // which should have been escaped.
1136  '{' => '&#123;',
1137  '}' => '&#125;', // prevent unpaired language conversion syntax
1138  '[' => '&#91;',
1139  "''" => '&#39;&#39;',
1140  'ISBN' => '&#73;SBN',
1141  'RFC' => '&#82;FC',
1142  'PMID' => '&#80;MID',
1143  '|' => '&#124;',
1144  '__' => '&#95;_',
1145  ] );
1146 
1147  # Stupid hack
1148  $encValue = preg_replace_callback(
1149  '/((?i)' . wfUrlProtocols() . ')/',
1150  [ 'Sanitizer', 'armorLinksCallback' ],
1151  $encValue );
1152  return $encValue;
1153  }
1154 
1186  static function escapeId( $id, $options = [] ) {
1188  $options = (array)$options;
1189 
1190  $id = Sanitizer::decodeCharReferences( $id );
1191 
1192  if ( $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) {
1193  $id = preg_replace( '/[ \t\n\r\f_\'"&#%]+/', '_', $id );
1194  $id = trim( $id, '_' );
1195  if ( $id === '' ) {
1196  // Must have been all whitespace to start with.
1197  return '_';
1198  } else {
1199  return $id;
1200  }
1201  }
1202 
1203  // HTML4-style escaping
1204  static $replace = [
1205  '%3A' => ':',
1206  '%' => '.'
1207  ];
1208 
1209  $id = urlencode( strtr( $id, ' ', '_' ) );
1210  $id = strtr( $id, $replace );
1211 
1212  if ( !preg_match( '/^[a-zA-Z]/', $id ) && !in_array( 'noninitial', $options ) ) {
1213  // Initial character must be a letter!
1214  $id = "x$id";
1215  }
1216  return $id;
1217  }
1218 
1236  static function escapeIdReferenceList( $referenceString, $options = [] ) {
1237  # Explode the space delimited list string into an array of tokens
1238  $references = preg_split( '/\s+/', "{$referenceString}", -1, PREG_SPLIT_NO_EMPTY );
1239 
1240  # Escape each token as an id
1241  foreach ( $references as &$ref ) {
1242  $ref = Sanitizer::escapeId( $ref, $options );
1243  }
1244 
1245  # Merge the array back to a space delimited list string
1246  # If the array is empty, the result will be an empty string ('')
1247  $referenceString = implode( ' ', $references );
1248 
1249  return $referenceString;
1250  }
1251 
1263  static function escapeClass( $class ) {
1264  // Convert ugly stuff to underscores and kill underscores in ugly places
1265  return rtrim( preg_replace(
1266  [ '/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/', '/_+/' ],
1267  '_',
1268  $class ), '_' );
1269  }
1270 
1278  static function escapeHtmlAllowEntities( $html ) {
1280  # It seems wise to escape ' as well as ", as a matter of course. Can't
1281  # hurt. Use ENT_SUBSTITUTE so that incorrectly truncated multibyte characters
1282  # don't cause the entire string to disappear.
1283  $html = htmlspecialchars( $html, ENT_QUOTES | ENT_SUBSTITUTE );
1284  return $html;
1285  }
1286 
1292  private static function armorLinksCallback( $matches ) {
1293  return str_replace( ':', '&#58;', $matches[1] );
1294  }
1295 
1304  public static function decodeTagAttributes( $text ) {
1305  if ( trim( $text ) == '' ) {
1306  return [];
1307  }
1308 
1309  $attribs = [];
1310  $pairs = [];
1311  if ( !preg_match_all(
1312  self::getAttribsRegex(),
1313  $text,
1314  $pairs,
1315  PREG_SET_ORDER ) ) {
1316  return $attribs;
1317  }
1318 
1319  foreach ( $pairs as $set ) {
1320  $attribute = strtolower( $set[1] );
1322 
1323  // Normalize whitespace
1324  $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1325  $value = trim( $value );
1326 
1327  // Decode character references
1329  }
1330  return $attribs;
1331  }
1332 
1340  public static function safeEncodeTagAttributes( $assoc_array ) {
1341  $attribs = [];
1342  foreach ( $assoc_array as $attribute => $value ) {
1343  $encAttribute = htmlspecialchars( $attribute );
1344  $encValue = Sanitizer::safeEncodeAttribute( $value );
1345 
1346  $attribs[] = "$encAttribute=\"$encValue\"";
1347  }
1348  return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : '';
1349  }
1350 
1359  private static function getTagAttributeCallback( $set ) {
1360  if ( isset( $set[5] ) ) {
1361  # No quotes.
1362  return $set[5];
1363  } elseif ( isset( $set[4] ) ) {
1364  # Single-quoted
1365  return $set[4];
1366  } elseif ( isset( $set[3] ) ) {
1367  # Double-quoted
1368  return $set[3];
1369  } elseif ( !isset( $set[2] ) ) {
1370  # In XHTML, attributes must have a value so return an empty string.
1371  # See "Empty attribute syntax",
1372  # https://www.w3.org/TR/html5/syntax.html#syntax-attribute-name
1373  return "";
1374  } else {
1375  throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1376  }
1377  }
1378 
1383  private static function normalizeWhitespace( $text ) {
1384  return preg_replace(
1385  '/\r\n|[\x20\x0d\x0a\x09]/',
1386  ' ',
1387  $text );
1388  }
1389 
1399  return trim( preg_replace( '/[ _]+/', ' ', $section ) );
1400  }
1401 
1417  static function normalizeCharReferences( $text ) {
1418  return preg_replace_callback(
1419  self::CHAR_REFS_REGEX,
1420  [ 'Sanitizer', 'normalizeCharReferencesCallback' ],
1421  $text );
1422  }
1423 
1429  $ret = null;
1430  if ( $matches[1] != '' ) {
1432  } elseif ( $matches[2] != '' ) {
1434  } elseif ( $matches[3] != '' ) {
1436  }
1437  if ( is_null( $ret ) ) {
1438  return htmlspecialchars( $matches[0] );
1439  } else {
1440  return $ret;
1441  }
1442  }
1443 
1454  static function normalizeEntity( $name ) {
1455  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1456  return '&' . self::$htmlEntityAliases[$name] . ';';
1457  } elseif ( in_array( $name, [ 'lt', 'gt', 'amp', 'quot' ] ) ) {
1458  return "&$name;";
1459  } elseif ( isset( self::$htmlEntities[$name] ) ) {
1460  return '&#' . self::$htmlEntities[$name] . ';';
1461  } else {
1462  return "&amp;$name;";
1463  }
1464  }
1465 
1470  static function decCharReference( $codepoint ) {
1471  $point = intval( $codepoint );
1472  if ( Sanitizer::validateCodepoint( $point ) ) {
1473  return sprintf( '&#%d;', $point );
1474  } else {
1475  return null;
1476  }
1477  }
1478 
1483  static function hexCharReference( $codepoint ) {
1484  $point = hexdec( $codepoint );
1485  if ( Sanitizer::validateCodepoint( $point ) ) {
1486  return sprintf( '&#x%x;', $point );
1487  } else {
1488  return null;
1489  }
1490  }
1491 
1498  private static function validateCodepoint( $codepoint ) {
1499  # U+000C is valid in HTML5 but not allowed in XML.
1500  # U+000D is valid in XML but not allowed in HTML5.
1501  # U+007F - U+009F are disallowed in HTML5 (control characters).
1502  return $codepoint == 0x09
1503  || $codepoint == 0x0a
1504  || ( $codepoint >= 0x20 && $codepoint <= 0x7e )
1505  || ( $codepoint >= 0xa0 && $codepoint <= 0xd7ff )
1506  || ( $codepoint >= 0xe000 && $codepoint <= 0xfffd )
1507  || ( $codepoint >= 0x10000 && $codepoint <= 0x10ffff );
1508  }
1509 
1517  public static function decodeCharReferences( $text ) {
1518  return preg_replace_callback(
1519  self::CHAR_REFS_REGEX,
1520  [ 'Sanitizer', 'decodeCharReferencesCallback' ],
1521  $text );
1522  }
1523 
1534  public static function decodeCharReferencesAndNormalize( $text ) {
1536  $text = preg_replace_callback(
1537  self::CHAR_REFS_REGEX,
1538  [ 'Sanitizer', 'decodeCharReferencesCallback' ],
1539  $text, /* limit */ -1, $count );
1540 
1541  if ( $count ) {
1542  return $wgContLang->normalize( $text );
1543  } else {
1544  return $text;
1545  }
1546  }
1547 
1553  if ( $matches[1] != '' ) {
1554  return Sanitizer::decodeEntity( $matches[1] );
1555  } elseif ( $matches[2] != '' ) {
1556  return Sanitizer::decodeChar( intval( $matches[2] ) );
1557  } elseif ( $matches[3] != '' ) {
1558  return Sanitizer::decodeChar( hexdec( $matches[3] ) );
1559  }
1560  # Last case should be an ampersand by itself
1561  return $matches[0];
1562  }
1563 
1571  static function decodeChar( $codepoint ) {
1572  if ( Sanitizer::validateCodepoint( $codepoint ) ) {
1573  return UtfNormal\Utils::codepointToUtf8( $codepoint );
1574  } else {
1576  }
1577  }
1578 
1587  static function decodeEntity( $name ) {
1588  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1589  $name = self::$htmlEntityAliases[$name];
1590  }
1591  if ( isset( self::$htmlEntities[$name] ) ) {
1592  return UtfNormal\Utils::codepointToUtf8( self::$htmlEntities[$name] );
1593  } else {
1594  return "&$name;";
1595  }
1596  }
1597 
1604  static function attributeWhitelist( $element ) {
1606  return isset( $list[$element] )
1607  ? $list[$element]
1608  : [];
1609  }
1610 
1616  static function setupAttributeWhitelist() {
1617  static $whitelist;
1618 
1619  if ( $whitelist !== null ) {
1620  return $whitelist;
1621  }
1622 
1623  $common = [
1624  # HTML
1625  'id',
1626  'class',
1627  'style',
1628  'lang',
1629  'dir',
1630  'title',
1631 
1632  # WAI-ARIA
1633  'aria-describedby',
1634  'aria-flowto',
1635  'aria-label',
1636  'aria-labelledby',
1637  'aria-owns',
1638  'role',
1639 
1640  # RDFa
1641  # These attributes are specified in section 9 of
1642  # https://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1643  'about',
1644  'property',
1645  'resource',
1646  'datatype',
1647  'typeof',
1648 
1649  # Microdata. These are specified by
1650  # https://html.spec.whatwg.org/multipage/microdata.html#the-microdata-model
1651  'itemid',
1652  'itemprop',
1653  'itemref',
1654  'itemscope',
1655  'itemtype',
1656  ];
1657 
1658  $block = array_merge( $common, [ 'align' ] );
1659  $tablealign = [ 'align', 'valign' ];
1660  $tablecell = [
1661  'abbr',
1662  'axis',
1663  'headers',
1664  'scope',
1665  'rowspan',
1666  'colspan',
1667  'nowrap', # deprecated
1668  'width', # deprecated
1669  'height', # deprecated
1670  'bgcolor', # deprecated
1671  ];
1672 
1673  # Numbers refer to sections in HTML 4.01 standard describing the element.
1674  # See: https://www.w3.org/TR/html4/
1675  $whitelist = [
1676  # 7.5.4
1677  'div' => $block,
1678  'center' => $common, # deprecated
1679  'span' => $common,
1680 
1681  # 7.5.5
1682  'h1' => $block,
1683  'h2' => $block,
1684  'h3' => $block,
1685  'h4' => $block,
1686  'h5' => $block,
1687  'h6' => $block,
1688 
1689  # 7.5.6
1690  # address
1691 
1692  # 8.2.4
1693  'bdo' => $common,
1694 
1695  # 9.2.1
1696  'em' => $common,
1697  'strong' => $common,
1698  'cite' => $common,
1699  'dfn' => $common,
1700  'code' => $common,
1701  'samp' => $common,
1702  'kbd' => $common,
1703  'var' => $common,
1704  'abbr' => $common,
1705  # acronym
1706 
1707  # 9.2.2
1708  'blockquote' => array_merge( $common, [ 'cite' ] ),
1709  'q' => array_merge( $common, [ 'cite' ] ),
1710 
1711  # 9.2.3
1712  'sub' => $common,
1713  'sup' => $common,
1714 
1715  # 9.3.1
1716  'p' => $block,
1717 
1718  # 9.3.2
1719  'br' => array_merge( $common, [ 'clear' ] ),
1720 
1721  # https://www.w3.org/TR/html5/text-level-semantics.html#the-wbr-element
1722  'wbr' => $common,
1723 
1724  # 9.3.4
1725  'pre' => array_merge( $common, [ 'width' ] ),
1726 
1727  # 9.4
1728  'ins' => array_merge( $common, [ 'cite', 'datetime' ] ),
1729  'del' => array_merge( $common, [ 'cite', 'datetime' ] ),
1730 
1731  # 10.2
1732  'ul' => array_merge( $common, [ 'type' ] ),
1733  'ol' => array_merge( $common, [ 'type', 'start', 'reversed' ] ),
1734  'li' => array_merge( $common, [ 'type', 'value' ] ),
1735 
1736  # 10.3
1737  'dl' => $common,
1738  'dd' => $common,
1739  'dt' => $common,
1740 
1741  # 11.2.1
1742  'table' => array_merge( $common,
1743  [ 'summary', 'width', 'border', 'frame',
1744  'rules', 'cellspacing', 'cellpadding',
1745  'align', 'bgcolor',
1746  ] ),
1747 
1748  # 11.2.2
1749  'caption' => $block,
1750 
1751  # 11.2.3
1752  'thead' => $common,
1753  'tfoot' => $common,
1754  'tbody' => $common,
1755 
1756  # 11.2.4
1757  'colgroup' => array_merge( $common, [ 'span' ] ),
1758  'col' => array_merge( $common, [ 'span' ] ),
1759 
1760  # 11.2.5
1761  'tr' => array_merge( $common, [ 'bgcolor' ], $tablealign ),
1762 
1763  # 11.2.6
1764  'td' => array_merge( $common, $tablecell, $tablealign ),
1765  'th' => array_merge( $common, $tablecell, $tablealign ),
1766 
1767  # 12.2
1768  # NOTE: <a> is not allowed directly, but the attrib
1769  # whitelist is used from the Parser object
1770  'a' => array_merge( $common, [ 'href', 'rel', 'rev' ] ), # rel/rev esp. for RDFa
1771 
1772  # 13.2
1773  # Not usually allowed, but may be used for extension-style hooks
1774  # such as <math> when it is rasterized, or if $wgAllowImageTag is
1775  # true
1776  'img' => array_merge( $common, [ 'alt', 'src', 'width', 'height' ] ),
1777 
1778  'video' => array_merge( $common, [ 'poster', 'controls', 'preload', 'width', 'height' ] ),
1779  'source' => array_merge( $common, [ 'type', 'src' ] ),
1780  'track' => array_merge( $common, [ 'type', 'src', 'srclang', 'kind', 'label' ] ),
1781 
1782  # 15.2.1
1783  'tt' => $common,
1784  'b' => $common,
1785  'i' => $common,
1786  'big' => $common,
1787  'small' => $common,
1788  'strike' => $common,
1789  's' => $common,
1790  'u' => $common,
1791 
1792  # 15.2.2
1793  'font' => array_merge( $common, [ 'size', 'color', 'face' ] ),
1794  # basefont
1795 
1796  # 15.3
1797  'hr' => array_merge( $common, [ 'width' ] ),
1798 
1799  # HTML Ruby annotation text module, simple ruby only.
1800  # https://www.w3.org/TR/html5/text-level-semantics.html#the-ruby-element
1801  'ruby' => $common,
1802  # rbc
1803  'rb' => $common,
1804  'rp' => $common,
1805  'rt' => $common, # array_merge( $common, array( 'rbspan' ) ),
1806  'rtc' => $common,
1807 
1808  # MathML root element, where used for extensions
1809  # 'title' may not be 100% valid here; it's XHTML
1810  # https://www.w3.org/TR/REC-MathML/
1811  'math' => [ 'class', 'style', 'id', 'title' ],
1812 
1813  # HTML 5 section 4.6
1814  'bdi' => $common,
1815 
1816  # HTML5 elements, defined by:
1817  # https://html.spec.whatwg.org/multipage/semantics.html#the-data-element
1818  'data' => array_merge( $common, [ 'value' ] ),
1819  'time' => array_merge( $common, [ 'datetime' ] ),
1820  'mark' => $common,
1821 
1822  // meta and link are only permitted by removeHTMLtags when Microdata
1823  // is enabled so we don't bother adding a conditional to hide these
1824  // Also meta and link are only valid in WikiText as Microdata elements
1825  // (ie: validateTag rejects tags missing the attributes needed for Microdata)
1826  // So we don't bother including $common attributes that have no purpose.
1827  'meta' => [ 'itemprop', 'content' ],
1828  'link' => [ 'itemprop', 'href' ],
1829  ];
1830 
1831  return $whitelist;
1832  }
1833 
1844  static function stripAllTags( $text ) {
1845  # Actual <tags>
1846  $text = StringUtils::delimiterReplace( '<', '>', '', $text );
1847 
1848  # Normalize &entities and whitespace
1849  $text = self::decodeCharReferences( $text );
1850  $text = self::normalizeWhitespace( $text );
1851 
1852  return $text;
1853  }
1854 
1864  static function hackDocType() {
1865  $out = "<!DOCTYPE html [\n";
1866  foreach ( self::$htmlEntities as $entity => $codepoint ) {
1867  $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1868  }
1869  $out .= "]>\n";
1870  return $out;
1871  }
1872 
1877  static function cleanUrl( $url ) {
1878  # Normalize any HTML entities in input. They will be
1879  # re-escaped by makeExternalLink().
1880  $url = Sanitizer::decodeCharReferences( $url );
1881 
1882  # Escape any control characters introduced by the above step
1883  $url = preg_replace_callback( '/[\][<>"\\x00-\\x20\\x7F\|]/',
1884  [ __CLASS__, 'cleanUrlCallback' ], $url );
1885 
1886  # Validate hostname portion
1887  $matches = [];
1888  if ( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1889  list( /* $whole */, $protocol, $host, $rest ) = $matches;
1890 
1891  // Characters that will be ignored in IDNs.
1892  // https://tools.ietf.org/html/rfc3454#section-3.1
1893  // Strip them before further processing so blacklists and such work.
1894  $strip = "/
1895  \\s| # general whitespace
1896  \xc2\xad| # 00ad SOFT HYPHEN
1897  \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1898  \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1899  \xe2\x81\xa0| # 2060 WORD JOINER
1900  \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1901  \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
1902  \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1903  \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1904  \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1905  \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1906  \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1907  [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe0f VARIATION SELECTOR-1-16
1908  /xuD";
1909 
1910  $host = preg_replace( $strip, '', $host );
1911 
1912  // IPv6 host names are bracketed with []. Url-decode these.
1913  if ( substr_compare( "//%5B", $host, 0, 5 ) === 0 &&
1914  preg_match( '!^//%5B([0-9A-Fa-f:.]+)%5D((:\d+)?)$!', $host, $matches )
1915  ) {
1916  $host = '//[' . $matches[1] . ']' . $matches[2];
1917  }
1918 
1919  // @todo FIXME: Validate hostnames here
1920 
1921  return $protocol . $host . $rest;
1922  } else {
1923  return $url;
1924  }
1925  }
1926 
1931  static function cleanUrlCallback( $matches ) {
1932  return urlencode( $matches[0] );
1933  }
1934 
1963  public static function validateEmail( $addr ) {
1964  $result = null;
1965  if ( !Hooks::run( 'isValidEmailAddr', [ $addr, &$result ] ) ) {
1966  return $result;
1967  }
1968 
1969  // Please note strings below are enclosed in brackets [], this make the
1970  // hyphen "-" a range indicator. Hence it is double backslashed below.
1971  // See T28948
1972  $rfc5322_atext = "a-z0-9!#$%&'*+\\-\/=?^_`{|}~";
1973  $rfc1034_ldh_str = "a-z0-9\\-";
1974 
1975  $html5_email_regexp = "/
1976  ^ # start of string
1977  [$rfc5322_atext\\.]+ # user part which is liberal :p
1978  @ # 'apostrophe'
1979  [$rfc1034_ldh_str]+ # First domain part
1980  (\\.[$rfc1034_ldh_str]+)* # Following part prefixed with a dot
1981  $ # End of string
1982  /ix"; // case Insensitive, eXtended
1983 
1984  return (bool)preg_match( $html5_email_regexp, $addr );
1985  }
1986 }
utf8ToCodepoint($char)
Determine the Unicode codepoint of a single-character UTF-8 sequence.
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if that
Definition: deferred.txt:11
static decCharReference($codepoint)
Definition: Sanitizer.php:1470
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses & $html
Definition: hooks.txt:1966
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global list
Definition: deferred.txt:11
static decodeTagAttributes($text)
Return an associative array of attribute names and values from a partial tag string.
Definition: Sanitizer.php:1304
this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that probably a stub it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output $out
Definition: hooks.txt:784
static normalizeEntity($name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the equivalent numeric entity re...
Definition: Sanitizer.php:1454
the array() calling protocol came about after MediaWiki 1.4rc1.
static safeEncodeTagAttributes($assoc_array)
Build a partial tag string from an associative array of attribute names and values as returned by dec...
Definition: Sanitizer.php:1340
static normalizeCharReferencesCallback($matches)
Definition: Sanitizer.php:1428
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses & $ret
Definition: hooks.txt:1966
static setupAttributeWhitelist()
Foreach array key (an allowed HTML element), return an array of allowed attributes.
Definition: Sanitizer.php:1616
static isEnabled()
Definition: MWTidy.php:79
static fixTagAttributes($text, $element, $sorted=false)
Take a tag soup fragment listing an HTML element's attributes and normalize it to well-formed XML...
Definition: Sanitizer.php:1086
static decodeCharReferencesCallback($matches)
Definition: Sanitizer.php:1552
static cssDecodeCallback($matches)
Definition: Sanitizer.php:1044
you don t have to do a grep find to see where the $wgReverseTitle variable is used
Definition: hooks.txt:117
null for the local wiki Added in
Definition: hooks.txt:1582
$value
static escapeClass($class)
Given a value, escape it so that it can be used as a CSS class and return it.
Definition: Sanitizer.php:1263
static hackDocType()
Hack up a private DOCTYPE with HTML's standard entity declarations.
Definition: Sanitizer.php:1864
static cleanUrl($url)
Definition: Sanitizer.php:1877
static stripAllTags($text)
Take a fragment of (potentially invalid) HTML and return a version with any tags removed, encoded as plain text.
Definition: Sanitizer.php:1844
when a variable name is used in a it is silently declared as a new local masking the global
Definition: design.txt:93
const UTF8_REPLACEMENT
static hexCharReference($codepoint)
Definition: Sanitizer.php:1483
static validateTagAttributes($attribs, $element)
Take an array of attribute names and values and normalize or discard illegal values for the given ele...
Definition: Sanitizer.php:748
static normalizeWhitespace($text)
Definition: Sanitizer.php:1383
static isReservedDataAttribute($attr)
Given an attribute name, checks whether it is a reserved data attribute (such as data-mw-foo) which i...
Definition: Sanitizer.php:865
static static static $attribsRegex
Lazy-initialised attributes regex, see getAttribsRegex()
Definition: Sanitizer.php:325
The index of the header message $result[1]=The index of the body text message $result[2 through n]=Parameters passed to body text message.Please note the header message cannot receive/use parameters. 'ImportHandleLogItemXMLTag':When parsing a XML tag in a log item.Return false to stop further processing of the tag $reader:XMLReader object $logInfo:Array of information 'ImportHandlePageXMLTag':When parsing a XML tag in a page.Return false to stop further processing of the tag $reader:XMLReader object &$pageInfo:Array of information 'ImportHandleRevisionXMLTag':When parsing a XML tag in a page revision.Return false to stop further processing of the tag $reader:XMLReader object $pageInfo:Array of page information $revisionInfo:Array of revision information 'ImportHandleToplevelXMLTag':When parsing a top level XML tag.Return false to stop further processing of the tag $reader:XMLReader object 'ImportHandleUploadXMLTag':When parsing a XML tag in a file upload.Return false to stop further processing of the tag $reader:XMLReader object $revisionInfo:Array of information 'ImportLogInterwikiLink':Hook to change the interwiki link used in log entries and edit summaries for transwiki imports.&$fullInterwikiPrefix:Interwiki prefix, may contain colons.&$pageTitle:String that contains page title. 'ImportSources':Called when reading from the $wgImportSources configuration variable.Can be used to lazy-load the import sources list.&$importSources:The value of $wgImportSources.Modify as necessary.See the comment in DefaultSettings.php for the detail of how to structure this array. 'InfoAction':When building information to display on the action=info page.$context:IContextSource object &$pageInfo:Array of information 'InitializeArticleMaybeRedirect':MediaWiki check to see if title is a redirect.&$title:Title object for the current page &$request:WebRequest &$ignoreRedirect:boolean to skip redirect check &$target:Title/string of redirect target &$article:Article object 'InternalParseBeforeLinks':during Parser's internalParse method before links but after nowiki/noinclude/includeonly/onlyinclude and other processings.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InternalParseBeforeSanitize':during Parser's internalParse method just before the parser removes unwanted/dangerous HTML tags and after nowiki/noinclude/includeonly/onlyinclude and other processings.Ideal for syntax-extensions after template/parser function execution which respect nowiki and HTML-comments.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InterwikiLoadPrefix':When resolving if a given prefix is an interwiki or not.Return true without providing an interwiki to continue interwiki search.$prefix:interwiki prefix we are looking for.&$iwData:output array describing the interwiki with keys iw_url, iw_local, iw_trans and optionally iw_api and iw_wikiid. 'InvalidateEmailComplete':Called after a user's email has been invalidated successfully.$user:user(object) whose email is being invalidated 'IRCLineURL':When constructing the URL to use in an IRC notification.Callee may modify $url and $query, URL will be constructed as $url.$query &$url:URL to index.php &$query:Query string $rc:RecentChange object that triggered url generation 'IsFileCacheable':Override the result of Article::isFileCacheable()(if true) &$article:article(object) being checked 'IsTrustedProxy':Override the result of IP::isTrustedProxy() &$ip:IP being check &$result:Change this value to override the result of IP::isTrustedProxy() 'IsUploadAllowedFromUrl':Override the result of UploadFromUrl::isAllowedUrl() $url:URL used to upload from &$allowed:Boolean indicating if uploading is allowed for given URL 'isValidEmailAddr':Override the result of Sanitizer::validateEmail(), for instance to return false if the domain name doesn't match your organization.$addr:The e-mail address entered by the user &$result:Set this and return false to override the internal checks 'isValidPassword':Override the result of User::isValidPassword() $password:The password entered by the user &$result:Set this and return false to override the internal checks $user:User the password is being validated for 'Language::getMessagesFileName':$code:The language code or the language we're looking for a messages file for &$file:The messages file path, you can override this to change the location. 'LanguageGetMagic':DEPRECATED!Use $magicWords in a file listed in $wgExtensionMessagesFiles instead.Use this to define synonyms of magic words depending of the language &$magicExtensions:associative array of magic words synonyms $lang:language code(string) 'LanguageGetNamespaces':Provide custom ordering for namespaces or remove namespaces.Do not use this hook to add namespaces.Use CanonicalNamespaces for that.&$namespaces:Array of namespaces indexed by their numbers 'LanguageGetSpecialPageAliases':DEPRECATED!Use $specialPageAliases in a file listed in $wgExtensionMessagesFiles instead.Use to define aliases of special pages names depending of the language &$specialPageAliases:associative array of magic words synonyms $lang:language code(string) 'LanguageGetTranslatedLanguageNames':Provide translated language names.&$names:array of language code=> language name $code:language of the preferred translations 'LanguageLinks':Manipulate a page's language links.This is called in various places to allow extensions to define the effective language links for a page.$title:The page's Title.&$links:Array with elements of the form"language:title"in the order that they will be output.&$linkFlags:Associative array mapping prefixed links to arrays of flags.Currently unused, but planned to provide support for marking individual language links in the UI, e.g.for featured articles. 'LanguageSelector':Hook to change the language selector available on a page.$out:The output page.$cssClassName:CSS class name of the language selector. 'LinkBegin':DEPRECATED!Use HtmlPageLinkRendererBegin instead.Used when generating internal and interwiki links in Linker::link(), before processing starts.Return false to skip default processing and return $ret.See documentation for Linker::link() for details on the expected meanings of parameters.$skin:the Skin object $target:the Title that the link is pointing to &$html:the contents that the< a > tag should have(raw HTML) $result
Definition: hooks.txt:1964
if($line===false) $args
Definition: cdb.php:63
static decodeCharReferences($text)
Decode any character references, numeric or named entities, in the text and return a UTF-8 string...
Definition: Sanitizer.php:1517
static validateCodepoint($codepoint)
Returns true if a given Unicode codepoint is a valid character in both HTML5 and XML.
Definition: Sanitizer.php:1498
const EVIL_URI_PATTERN
Blacklist for evil uris like javascript: WARNING: DO NOT use this in any place that actually requires...
Definition: Sanitizer.php:56
const ELEMENT_BITS_REGEX
Acceptable tag name charset from HTML5 parsing spec https://www.w3.org/TR/html5/syntax.html#tag-open-state.
Definition: Sanitizer.php:46
Unicode normalization routines for working with UTF-8 strings.
Definition: UtfNormal.php:48
static decodeChar($codepoint)
Return UTF-8 string for a codepoint if that is a valid character reference, otherwise U+FFFD REPLACEM...
Definition: Sanitizer.php:1571
static normalizeSectionNameWhitespace($section)
Normalizes whitespace in a section name, such as might be returned by Parser::stripSectionName(), for use in the id's that are used for section links.
Definition: Sanitizer.php:1398
static delimiterReplace($startDelim, $endDelim, $replace, $subject, $flags= '')
Perform an operation equivalent to preg_replace() with flags.
static $htmlEntities
List of all named character entities defined in HTML 4.01 https://www.w3.org/TR/html4/sgml/entities.html As well as ' which is only defined starting in XHTML1.
Definition: Sanitizer.php:64
static attributeWhitelist($element)
Fetch the whitelist of acceptable attributes for a given element name.
Definition: Sanitizer.php:1604
this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist Do not use this to implement individual filters if they are compatible with the ChangesListFilter and ChangesListFilterGroup structure use sub classes of those in conjunction with the ChangesListSpecialPageStructuredFilters hook This hook can be used to implement filters that do not implement that or custom behavior that is not an individual filter e g Watchlist and Watchlist you will want to construct new ChangesListBooleanFilter or ChangesListStringOptionsFilter objects When constructing you specify which group they belong to You can reuse existing or create your you must register them with $special registerFilterGroup removed from all revisions and log entries to which it was applied This gives extensions a chance to take it off their books as the deletion has already been partly carried out by this point or something similar the user will be unable to create the tag set and then return false from the hook function Ensure you consume the ChangeTagAfterDelete hook to carry out custom deletion actions as context called by AbstractContent::getParserOutput May be used to override the normal model specific rendering of page content as context as context $options
Definition: hooks.txt:1050
static escapeHtmlAllowEntities($html)
Given HTML input, escape with htmlspecialchars but un-escape entities.
Definition: Sanitizer.php:1278
static validateTag($params, $element)
Takes attribute names and values for a tag and the tag name and validates that the tag is allowed to ...
Definition: Sanitizer.php:712
static mergeAttributes($a, $b)
Merge two sets of HTML attributes.
Definition: Sanitizer.php:886
const CHAR_REFS_REGEX
Regular expression to match various types of character references in Sanitizer::normalizeCharReferenc...
Definition: Sanitizer.php:36
static getRecognizedTagData($extratags=[], $removetags=[])
Return the various lists of recognized tags.
Definition: Sanitizer.php:365
$params
static validateAttributes($attribs, $whitelist)
Take an array of attribute names and values and normalize or discard illegal values for the given whi...
Definition: Sanitizer.php:768
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses after processing & $attribs
Definition: hooks.txt:1966
static decodeCharReferencesAndNormalize($text)
Decode any character references, numeric or named entities, in the next and normalize the resulting s...
Definition: Sanitizer.php:1534
static run($event, array $args=[], $deprecatedVersion=null)
Call hook functions defined in Hooks::register and $wgHooks.
Definition: Hooks.php:131
static static $htmlEntityAliases
Character entity aliases accepted by MediaWiki.
Definition: Sanitizer.php:323
static escapeIdReferenceList($referenceString, $options=[])
Given a string containing a space delimited list of ids, escape each id to match ids escaped by the e...
Definition: Sanitizer.php:1236
Apache License January AND DISTRIBUTION Definitions License shall mean the terms and conditions for and distribution as defined by Sections through of this document Licensor shall mean the copyright owner or entity authorized by the copyright owner that is granting the License Legal Entity shall mean the union of the acting entity and all other entities that control are controlled by or are under common control with that entity For the purposes of this definition control direct or to cause the direction or management of such whether by contract or including but not limited to software source documentation and configuration files Object form shall mean any form resulting from mechanical transformation or translation of a Source including but not limited to compiled object generated and conversions to other media types Work shall mean the work of whether in Source or Object made available under the as indicated by a copyright notice that is included in or attached to the whether in Source or Object that is based or other modifications as a an original work of authorship For the purposes of this Derivative Works shall not include works that remain separable or merely the Work and Derivative Works thereof Contribution shall mean any work of including the original version of the Work and any modifications or additions to that Work or Derivative Works that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner For the purposes of this submitted means any form of or written communication sent to the Licensor or its including but not limited to communication on electronic mailing source code control and issue tracking systems that are managed by
static cleanUrlCallback($matches)
Definition: Sanitizer.php:1931
This document is intended to provide useful advice for parties seeking to redistribute MediaWiki to end users It s targeted particularly at maintainers for Linux since it s been observed that distribution packages of MediaWiki often break We ve consistently had to recommend that users seeking support use official tarballs instead of their distribution s and this often solves whatever problem the user is having It would be nice if this could such as
Definition: distributors.txt:9
this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist Do not use this to implement individual filters if they are compatible with the ChangesListFilter and ChangesListFilterGroup structure use sub classes of those in conjunction with the ChangesListSpecialPageStructuredFilters hook This hook can be used to implement filters that do not implement that or custom behavior that is not an individual filter e g Watchlist and Watchlist you will want to construct new ChangesListBooleanFilter or ChangesListStringOptionsFilter objects When constructing them
Definition: hooks.txt:991
usually copyright or history_copyright This message must be in HTML not wikitext if the section is included from a template $section
Definition: hooks.txt:2976
static armorLinksCallback($matches)
Regex replace callback for armoring links against further processing.
Definition: Sanitizer.php:1292
static escapeId($id, $options=[])
Given a value, escape it so that it can be used in an id attribute and return it. ...
Definition: Sanitizer.php:1186
wfUrlProtocols($includeProtocolRelative=true)
Returns a regular expression of url protocols.
static normalizeCss($value)
Normalize CSS into a format we can easily search for hostile input.
Definition: Sanitizer.php:908
const XMLNS_ATTRIBUTE_PATTERN
Definition: Sanitizer.php:57
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency which acts as the top level factory for services in MediaWiki which can be used to gain access to default instances of various services MediaWikiServices however also allows new services to be defined and default services to be redefined Services are defined or redefined by providing a callback the instantiator that will return a new instance of the service When it will create an instance of MediaWikiServices and populate it with the services defined in the files listed by thereby bootstrapping the DI framework Per $wgServiceWiringFiles lists includes ServiceWiring php
Definition: injection.txt:35
static removeHTMLtags($text, $processCallback=null, $args=[], $extratags=[], $removetags=[], $warnCallback=null)
Cleans up HTML, removes dangerous tags and attributes, and removes HTML comments. ...
Definition: Sanitizer.php:462
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if so it s not worth the trouble Since there is a job queue in the jobs table
Definition: deferred.txt:11
static normalizeCharReferences($text)
Ensure that any entities and character references are legal for XML and XHTML specifically.
Definition: Sanitizer.php:1417
this class mediates it Skin Encapsulates a look and feel for the wiki All of the functions that render HTML and make choices about how to render it are here and are called from various other places when and is meant to be subclassed with other skins that may override some of its functions The User object contains a reference to a and so rather than having a global skin object we just rely on the global User and get the skin with $wgUser and also has some character encoding functions and other locale stuff The current user interface language is instantiated as and the local content language as $wgContLang
Definition: design.txt:56
$wgExperimentalHtmlIds
Should we allow a broader set of characters in id attributes, per HTML5? If not, use only HTML 4-comp...
Allows to change the fields on the form that will be generated $name
Definition: hooks.txt:304
static removeHTMLcomments($text)
Remove '', and everything between.
Definition: Sanitizer.php:666
static getAttribsRegex()
Regular expression to match HTML/XML attribute pairs within a tag.
Definition: Sanitizer.php:340
codepointToUtf8($codepoint)
Return UTF-8 sequence for a given Unicode code point.
static validateEmail($addr)
Does a string look like an e-mail address?
Definition: Sanitizer.php:1963
static checkCss($value)
Pick apart some CSS and check it for forbidden or unsafe structures.
Definition: Sanitizer.php:1016
static getTagAttributeCallback($set)
Pick the appropriate attribute value from a match set from the attribs regex matches.
Definition: Sanitizer.php:1359
</td >< td > &</td >< td > t want your writing to be edited mercilessly and redistributed at will
static decodeEntity($name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the UTF-8 encoding of that chara...
Definition: Sanitizer.php:1587
static safeEncodeAttribute($text)
Encode an attribute value for HTML tags, with extra armoring against further wiki processing...
Definition: Sanitizer.php:1127
static configuration should be added through ResourceLoaderGetConfigVars instead & $vars
Definition: hooks.txt:2199
static encodeAttribute($text)
Encode an attribute value for HTML output.
Definition: Sanitizer.php:1106
$matches