MediaWiki  master
Sanitizer.php
Go to the documentation of this file.
1 <?php
31 class Sanitizer {
37  '/&([A-Za-z0-9\x80-\xff]+);
38  |&\#([0-9]+);
39  |&\#[xX]([0-9A-Fa-f]+);
40  |(&)/x';
41 
46  const ELEMENT_BITS_REGEX = '!^(/?)([A-Za-z][^\t\n\v />\0]*+)([^>]*?)(/?>)([^<]*)$!';
47 
56  const EVIL_URI_PATTERN = '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i';
57  const XMLNS_ATTRIBUTE_PATTERN = "/^xmlns:[:A-Z_a-z-.0-9]+$/";
58 
64  private static $htmlEntities = [
65  'Aacute' => 193,
66  'aacute' => 225,
67  'Acirc' => 194,
68  'acirc' => 226,
69  'acute' => 180,
70  'AElig' => 198,
71  'aelig' => 230,
72  'Agrave' => 192,
73  'agrave' => 224,
74  'alefsym' => 8501,
75  'Alpha' => 913,
76  'alpha' => 945,
77  'amp' => 38,
78  'and' => 8743,
79  'ang' => 8736,
80  'apos' => 39, // New in XHTML & HTML 5; avoid in output for compatibility with IE.
81  'Aring' => 197,
82  'aring' => 229,
83  'asymp' => 8776,
84  'Atilde' => 195,
85  'atilde' => 227,
86  'Auml' => 196,
87  'auml' => 228,
88  'bdquo' => 8222,
89  'Beta' => 914,
90  'beta' => 946,
91  'brvbar' => 166,
92  'bull' => 8226,
93  'cap' => 8745,
94  'Ccedil' => 199,
95  'ccedil' => 231,
96  'cedil' => 184,
97  'cent' => 162,
98  'Chi' => 935,
99  'chi' => 967,
100  'circ' => 710,
101  'clubs' => 9827,
102  'cong' => 8773,
103  'copy' => 169,
104  'crarr' => 8629,
105  'cup' => 8746,
106  'curren' => 164,
107  'dagger' => 8224,
108  'Dagger' => 8225,
109  'darr' => 8595,
110  'dArr' => 8659,
111  'deg' => 176,
112  'Delta' => 916,
113  'delta' => 948,
114  'diams' => 9830,
115  'divide' => 247,
116  'Eacute' => 201,
117  'eacute' => 233,
118  'Ecirc' => 202,
119  'ecirc' => 234,
120  'Egrave' => 200,
121  'egrave' => 232,
122  'empty' => 8709,
123  'emsp' => 8195,
124  'ensp' => 8194,
125  'Epsilon' => 917,
126  'epsilon' => 949,
127  'equiv' => 8801,
128  'Eta' => 919,
129  'eta' => 951,
130  'ETH' => 208,
131  'eth' => 240,
132  'Euml' => 203,
133  'euml' => 235,
134  'euro' => 8364,
135  'exist' => 8707,
136  'fnof' => 402,
137  'forall' => 8704,
138  'frac12' => 189,
139  'frac14' => 188,
140  'frac34' => 190,
141  'frasl' => 8260,
142  'Gamma' => 915,
143  'gamma' => 947,
144  'ge' => 8805,
145  'gt' => 62,
146  'harr' => 8596,
147  'hArr' => 8660,
148  'hearts' => 9829,
149  'hellip' => 8230,
150  'Iacute' => 205,
151  'iacute' => 237,
152  'Icirc' => 206,
153  'icirc' => 238,
154  'iexcl' => 161,
155  'Igrave' => 204,
156  'igrave' => 236,
157  'image' => 8465,
158  'infin' => 8734,
159  'int' => 8747,
160  'Iota' => 921,
161  'iota' => 953,
162  'iquest' => 191,
163  'isin' => 8712,
164  'Iuml' => 207,
165  'iuml' => 239,
166  'Kappa' => 922,
167  'kappa' => 954,
168  'Lambda' => 923,
169  'lambda' => 955,
170  'lang' => 9001,
171  'laquo' => 171,
172  'larr' => 8592,
173  'lArr' => 8656,
174  'lceil' => 8968,
175  'ldquo' => 8220,
176  'le' => 8804,
177  'lfloor' => 8970,
178  'lowast' => 8727,
179  'loz' => 9674,
180  'lrm' => 8206,
181  'lsaquo' => 8249,
182  'lsquo' => 8216,
183  'lt' => 60,
184  'macr' => 175,
185  'mdash' => 8212,
186  'micro' => 181,
187  'middot' => 183,
188  'minus' => 8722,
189  'Mu' => 924,
190  'mu' => 956,
191  'nabla' => 8711,
192  'nbsp' => 160,
193  'ndash' => 8211,
194  'ne' => 8800,
195  'ni' => 8715,
196  'not' => 172,
197  'notin' => 8713,
198  'nsub' => 8836,
199  'Ntilde' => 209,
200  'ntilde' => 241,
201  'Nu' => 925,
202  'nu' => 957,
203  'Oacute' => 211,
204  'oacute' => 243,
205  'Ocirc' => 212,
206  'ocirc' => 244,
207  'OElig' => 338,
208  'oelig' => 339,
209  'Ograve' => 210,
210  'ograve' => 242,
211  'oline' => 8254,
212  'Omega' => 937,
213  'omega' => 969,
214  'Omicron' => 927,
215  'omicron' => 959,
216  'oplus' => 8853,
217  'or' => 8744,
218  'ordf' => 170,
219  'ordm' => 186,
220  'Oslash' => 216,
221  'oslash' => 248,
222  'Otilde' => 213,
223  'otilde' => 245,
224  'otimes' => 8855,
225  'Ouml' => 214,
226  'ouml' => 246,
227  'para' => 182,
228  'part' => 8706,
229  'permil' => 8240,
230  'perp' => 8869,
231  'Phi' => 934,
232  'phi' => 966,
233  'Pi' => 928,
234  'pi' => 960,
235  'piv' => 982,
236  'plusmn' => 177,
237  'pound' => 163,
238  'prime' => 8242,
239  'Prime' => 8243,
240  'prod' => 8719,
241  'prop' => 8733,
242  'Psi' => 936,
243  'psi' => 968,
244  'quot' => 34,
245  'radic' => 8730,
246  'rang' => 9002,
247  'raquo' => 187,
248  'rarr' => 8594,
249  'rArr' => 8658,
250  'rceil' => 8969,
251  'rdquo' => 8221,
252  'real' => 8476,
253  'reg' => 174,
254  'rfloor' => 8971,
255  'Rho' => 929,
256  'rho' => 961,
257  'rlm' => 8207,
258  'rsaquo' => 8250,
259  'rsquo' => 8217,
260  'sbquo' => 8218,
261  'Scaron' => 352,
262  'scaron' => 353,
263  'sdot' => 8901,
264  'sect' => 167,
265  'shy' => 173,
266  'Sigma' => 931,
267  'sigma' => 963,
268  'sigmaf' => 962,
269  'sim' => 8764,
270  'spades' => 9824,
271  'sub' => 8834,
272  'sube' => 8838,
273  'sum' => 8721,
274  'sup' => 8835,
275  'sup1' => 185,
276  'sup2' => 178,
277  'sup3' => 179,
278  'supe' => 8839,
279  'szlig' => 223,
280  'Tau' => 932,
281  'tau' => 964,
282  'there4' => 8756,
283  'Theta' => 920,
284  'theta' => 952,
285  'thetasym' => 977,
286  'thinsp' => 8201,
287  'THORN' => 222,
288  'thorn' => 254,
289  'tilde' => 732,
290  'times' => 215,
291  'trade' => 8482,
292  'Uacute' => 218,
293  'uacute' => 250,
294  'uarr' => 8593,
295  'uArr' => 8657,
296  'Ucirc' => 219,
297  'ucirc' => 251,
298  'Ugrave' => 217,
299  'ugrave' => 249,
300  'uml' => 168,
301  'upsih' => 978,
302  'Upsilon' => 933,
303  'upsilon' => 965,
304  'Uuml' => 220,
305  'uuml' => 252,
306  'weierp' => 8472,
307  'Xi' => 926,
308  'xi' => 958,
309  'Yacute' => 221,
310  'yacute' => 253,
311  'yen' => 165,
312  'Yuml' => 376,
313  'yuml' => 255,
314  'Zeta' => 918,
315  'zeta' => 950,
316  'zwj' => 8205,
317  'zwnj' => 8204
318  ];
319 
323  private static $htmlEntityAliases = [
324  'רלמ' => 'rlm',
325  'رلم' => 'rlm',
326  ];
327 
331  private static $attribsRegex;
332 
340  static function getAttribsRegex() {
341  if ( self::$attribsRegex === null ) {
342  $attribFirst = '[:A-Z_a-z0-9]';
343  $attrib = '[:A-Z_a-z-.0-9]';
344  $space = '[\x09\x0a\x0c\x0d\x20]';
345  self::$attribsRegex =
346  "/(?:^|$space)({$attribFirst}{$attrib}*)
347  ($space*=$space*
348  (?:
349  # The attribute value: quoted or alone
350  \"([^\"]*)(?:\"|\$)
351  | '([^']*)(?:'|\$)
352  | (((?!$space|>).)*)
353  )
354  )?(?=$space|\$)/sx";
355  }
356  return self::$attribsRegex;
357  }
358 
365  public static function getRecognizedTagData( $extratags = [], $removetags = [] ) {
367 
368  static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
369  $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
370 
371  // Base our staticInitialised variable off of the global config state so that if the globals
372  // are changed (like in the screwed up test system) we will re-initialise the settings.
373  $globalContext = $wgAllowImageTag;
374  if ( !$staticInitialised || $staticInitialised != $globalContext ) {
375  $htmlpairsStatic = [ # Tags that must be closed
376  'b', 'bdi', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
377  'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
378  'strike', 'strong', 'tt', 'var', 'div', 'center',
379  'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
380  'ruby', 'rb', 'rp', 'rt', 'rtc', 'p', 'span', 'abbr', 'dfn',
381  'kbd', 'samp', 'data', 'time', 'mark'
382  ];
383  $htmlsingle = [
384  'br', 'wbr', 'hr', 'li', 'dt', 'dd'
385  ];
386  $htmlsingleonly = [ # Elements that cannot have close tags
387  'br', 'wbr', 'hr'
388  ];
389 
390  $htmlsingle[] = $htmlsingleonly[] = 'meta';
391  $htmlsingle[] = $htmlsingleonly[] = 'link';
392 
393  $htmlnest = [ # Tags that can be nested--??
394  'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
395  'li', 'dl', 'dt', 'dd', 'font', 'big', 'small', 'sub', 'sup', 'span',
396  'var', 'kbd', 'samp', 'em', 'strong', 'q', 'ruby', 'bdo'
397  ];
398  $tabletags = [ # Can only appear inside table, we will close them
399  'td', 'th', 'tr',
400  ];
401  $htmllist = [ # Tags used by list
402  'ul', 'ol',
403  ];
404  $listtags = [ # Tags that can appear in a list
405  'li',
406  ];
407 
408  if ( $wgAllowImageTag ) {
409  $htmlsingle[] = 'img';
410  $htmlsingleonly[] = 'img';
411  }
412 
413  $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
414  $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
415 
416  # Convert them all to hashtables for faster lookup
417  $vars = [ 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
418  'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' ];
419  foreach ( $vars as $var ) {
420  $$var = array_flip( $$var );
421  }
422  $staticInitialised = $globalContext;
423  }
424 
425  # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
426  $extratags = array_flip( $extratags );
427  $removetags = array_flip( $removetags );
428  $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
429  $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ), $removetags );
430 
431  return [
432  'htmlpairs' => $htmlpairs,
433  'htmlsingle' => $htmlsingle,
434  'htmlsingleonly' => $htmlsingleonly,
435  'htmlnest' => $htmlnest,
436  'tabletags' => $tabletags,
437  'htmllist' => $htmllist,
438  'listtags' => $listtags,
439  'htmlsingleallowed' => $htmlsingleallowed,
440  'htmlelements' => $htmlelements,
441  ];
442  }
443 
455  public static function removeHTMLtags( $text, $processCallback = null,
456  $args = [], $extratags = [], $removetags = []
457  ) {
458  extract( self::getRecognizedTagData( $extratags, $removetags ) );
459 
460  # Remove HTML comments
461  $text = Sanitizer::removeHTMLcomments( $text );
462  $bits = explode( '<', $text );
463  $text = str_replace( '>', '&gt;', array_shift( $bits ) );
464  if ( !MWTidy::isEnabled() ) {
465  $tagstack = $tablestack = [];
466  foreach ( $bits as $x ) {
467  $regs = [];
468  # $slash: Does the current element start with a '/'?
469  # $t: Current element name
470  # $params: String between element name and >
471  # $brace: Ending '>' or '/>'
472  # $rest: Everything until the next element of $bits
473  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
474  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
475  } else {
476  $slash = $t = $params = $brace = $rest = null;
477  }
478 
479  $badtag = false;
480  $t = strtolower( $t );
481  if ( isset( $htmlelements[$t] ) ) {
482  # Check our stack
483  if ( $slash && isset( $htmlsingleonly[$t] ) ) {
484  $badtag = true;
485  } elseif ( $slash ) {
486  # Closing a tag... is it the one we just opened?
487  MediaWiki\suppressWarnings();
488  $ot = array_pop( $tagstack );
489  MediaWiki\restoreWarnings();
490 
491  if ( $ot != $t ) {
492  if ( isset( $htmlsingleallowed[$ot] ) ) {
493  # Pop all elements with an optional close tag
494  # and see if we find a match below them
495  $optstack = [];
496  array_push( $optstack, $ot );
497  MediaWiki\suppressWarnings();
498  $ot = array_pop( $tagstack );
499  MediaWiki\restoreWarnings();
500  while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
501  array_push( $optstack, $ot );
502  MediaWiki\suppressWarnings();
503  $ot = array_pop( $tagstack );
504  MediaWiki\restoreWarnings();
505  }
506  if ( $t != $ot ) {
507  # No match. Push the optional elements back again
508  $badtag = true;
509  MediaWiki\suppressWarnings();
510  $ot = array_pop( $optstack );
511  MediaWiki\restoreWarnings();
512  while ( $ot ) {
513  array_push( $tagstack, $ot );
514  MediaWiki\suppressWarnings();
515  $ot = array_pop( $optstack );
516  MediaWiki\restoreWarnings();
517  }
518  }
519  } else {
520  MediaWiki\suppressWarnings();
521  array_push( $tagstack, $ot );
522  MediaWiki\restoreWarnings();
523 
524  # <li> can be nested in <ul> or <ol>, skip those cases:
525  if ( !isset( $htmllist[$ot] ) || !isset( $listtags[$t] ) ) {
526  $badtag = true;
527  }
528  }
529  } else {
530  if ( $t == 'table' ) {
531  $tagstack = array_pop( $tablestack );
532  }
533  }
534  $newparams = '';
535  } else {
536  # Keep track for later
537  if ( isset( $tabletags[$t] ) && !in_array( 'table', $tagstack ) ) {
538  $badtag = true;
539  } elseif ( in_array( $t, $tagstack ) && !isset( $htmlnest[$t] ) ) {
540  $badtag = true;
541  #  Is it a self closed htmlpair ? (bug 5487)
542  } elseif ( $brace == '/>' && isset( $htmlpairs[$t] ) ) {
543  $badtag = true;
544  } elseif ( isset( $htmlsingleonly[$t] ) ) {
545  # Hack to force empty tag for unclosable elements
546  $brace = '/>';
547  } elseif ( isset( $htmlsingle[$t] ) ) {
548  # Hack to not close $htmlsingle tags
549  $brace = null;
550  # Still need to push this optionally-closed tag to
551  # the tag stack so that we can match end tags
552  # instead of marking them as bad.
553  array_push( $tagstack, $t );
554  } elseif ( isset( $tabletags[$t] ) && in_array( $t, $tagstack ) ) {
555  // New table tag but forgot to close the previous one
556  $text .= "</$t>";
557  } else {
558  if ( $t == 'table' ) {
559  array_push( $tablestack, $tagstack );
560  $tagstack = [];
561  }
562  array_push( $tagstack, $t );
563  }
564 
565  # Replace any variables or template parameters with
566  # plaintext results.
567  if ( is_callable( $processCallback ) ) {
568  call_user_func_array( $processCallback, [ &$params, $args ] );
569  }
570 
571  if ( !Sanitizer::validateTag( $params, $t ) ) {
572  $badtag = true;
573  }
574 
575  # Strip non-approved attributes from the tag
576  $newparams = Sanitizer::fixTagAttributes( $params, $t );
577  }
578  if ( !$badtag ) {
579  $rest = str_replace( '>', '&gt;', $rest );
580  $close = ( $brace == '/>' && !$slash ) ? ' /' : '';
581  $text .= "<$slash$t$newparams$close>$rest";
582  continue;
583  }
584  }
585  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
586  }
587  # Close off any remaining tags
588  while ( is_array( $tagstack ) && ( $t = array_pop( $tagstack ) ) ) {
589  $text .= "</$t>\n";
590  if ( $t == 'table' ) {
591  $tagstack = array_pop( $tablestack );
592  }
593  }
594  } else {
595  # this might be possible using tidy itself
596  foreach ( $bits as $x ) {
597  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
598  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
599 
600  $badtag = false;
601  $t = strtolower( $t );
602  if ( isset( $htmlelements[$t] ) ) {
603  if ( is_callable( $processCallback ) ) {
604  call_user_func_array( $processCallback, [ &$params, $args ] );
605  }
606 
607  if ( !Sanitizer::validateTag( $params, $t ) ) {
608  $badtag = true;
609  }
610 
611  $newparams = Sanitizer::fixTagAttributes( $params, $t );
612  if ( !$badtag ) {
613  $rest = str_replace( '>', '&gt;', $rest );
614  $text .= "<$slash$t$newparams$brace$rest";
615  continue;
616  }
617  }
618  }
619  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
620  }
621  }
622  return $text;
623  }
624 
634  public static function removeHTMLcomments( $text ) {
635  while ( ( $start = strpos( $text, '<!--' ) ) !== false ) {
636  $end = strpos( $text, '-->', $start + 4 );
637  if ( $end === false ) {
638  # Unterminated comment; bail out
639  break;
640  }
641 
642  $end += 3;
643 
644  # Trim space and newline if the comment is both
645  # preceded and followed by a newline
646  $spaceStart = max( $start - 1, 0 );
647  $spaceLen = $end - $spaceStart;
648  while ( substr( $text, $spaceStart, 1 ) === ' ' && $spaceStart > 0 ) {
649  $spaceStart--;
650  $spaceLen++;
651  }
652  while ( substr( $text, $spaceStart + $spaceLen, 1 ) === ' ' ) {
653  $spaceLen++;
654  }
655  if ( substr( $text, $spaceStart, 1 ) === "\n"
656  && substr( $text, $spaceStart + $spaceLen, 1 ) === "\n" ) {
657  # Remove the comment, leading and trailing
658  # spaces, and leave only one newline.
659  $text = substr_replace( $text, "\n", $spaceStart, $spaceLen + 1 );
660  } else {
661  # Remove just the comment.
662  $text = substr_replace( $text, '', $start, $end - $start );
663  }
664  }
665  return $text;
666  }
667 
680  static function validateTag( $params, $element ) {
682 
683  if ( $element == 'meta' || $element == 'link' ) {
684  if ( !isset( $params['itemprop'] ) ) {
685  // <meta> and <link> must have an itemprop="" otherwise they are not valid or safe in content
686  return false;
687  }
688  if ( $element == 'meta' && !isset( $params['content'] ) ) {
689  // <meta> must have a content="" for the itemprop
690  return false;
691  }
692  if ( $element == 'link' && !isset( $params['href'] ) ) {
693  // <link> must have an associated href=""
694  return false;
695  }
696  }
697 
698  return true;
699  }
700 
716  static function validateTagAttributes( $attribs, $element ) {
718  Sanitizer::attributeWhitelist( $element ) );
719  }
720 
736  static function validateAttributes( $attribs, $whitelist ) {
737  $whitelist = array_flip( $whitelist );
738  $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
739 
740  $out = [];
741  foreach ( $attribs as $attribute => $value ) {
742  # Allow XML namespace declaration to allow RDFa
743  if ( preg_match( self::XMLNS_ATTRIBUTE_PATTERN, $attribute ) ) {
744  if ( !preg_match( self::EVIL_URI_PATTERN, $value ) ) {
745  $out[$attribute] = $value;
746  }
747 
748  continue;
749  }
750 
751  # Allow any attribute beginning with "data-"
752  # However:
753  # * data-ooui is reserved for ooui
754  # * data-mw and data-parsoid are reserved for parsoid
755  # * data-mw-<name here> is reserved for extensions (or core) if
756  # they need to communicate some data to the client and want to be
757  # sure that it isn't coming from an untrusted user.
758  # * Ensure that the attribute is not namespaced by banning
759  # colons.
760  if ( !preg_match( '/^data-(?!ooui|mw|parsoid)[^:]*$/i', $attribute )
761  && !isset( $whitelist[$attribute] )
762  ) {
763  continue;
764  }
765 
766  # Strip javascript "expression" from stylesheets.
767  # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
768  if ( $attribute == 'style' ) {
770  }
771 
772  # Escape HTML id attributes
773  if ( $attribute === 'id' ) {
774  $value = Sanitizer::escapeId( $value, 'noninitial' );
775  }
776 
777  # Escape HTML id reference lists
778  if ( $attribute === 'aria-describedby'
779  || $attribute === 'aria-flowto'
780  || $attribute === 'aria-labelledby'
781  || $attribute === 'aria-owns'
782  ) {
784  }
785 
786  // RDFa and microdata properties allow URLs, URIs and/or CURIs.
787  // Check them for sanity.
788  if ( $attribute === 'rel' || $attribute === 'rev'
789  # RDFa
790  || $attribute === 'about' || $attribute === 'property'
791  || $attribute === 'resource' || $attribute === 'datatype'
792  || $attribute === 'typeof'
793  # HTML5 microdata
794  || $attribute === 'itemid' || $attribute === 'itemprop'
795  || $attribute === 'itemref' || $attribute === 'itemscope'
796  || $attribute === 'itemtype'
797  ) {
798  // Paranoia. Allow "simple" values but suppress javascript
799  if ( preg_match( self::EVIL_URI_PATTERN, $value ) ) {
800  continue;
801  }
802  }
803 
804  # NOTE: even though elements using href/src are not allowed directly, supply
805  # validation code that can be used by tag hook handlers, etc
806  if ( $attribute === 'href' || $attribute === 'src' ) {
807  if ( !preg_match( $hrefExp, $value ) ) {
808  continue; // drop any href or src attributes not using an allowed protocol.
809  // NOTE: this also drops all relative URLs
810  }
811  }
812 
813  // If this attribute was previously set, override it.
814  // Output should only have one attribute of each name.
815  $out[$attribute] = $value;
816  }
817 
818  # itemtype, itemid, itemref don't make sense without itemscope
819  if ( !array_key_exists( 'itemscope', $out ) ) {
820  unset( $out['itemtype'] );
821  unset( $out['itemid'] );
822  unset( $out['itemref'] );
823  }
824  # TODO: Strip itemprop if we aren't descendants of an itemscope or pointed to by an itemref.
825 
826  return $out;
827  }
828 
839  static function mergeAttributes( $a, $b ) {
840  $out = array_merge( $a, $b );
841  if ( isset( $a['class'] ) && isset( $b['class'] )
842  && is_string( $a['class'] ) && is_string( $b['class'] )
843  && $a['class'] !== $b['class']
844  ) {
845  $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
846  -1, PREG_SPLIT_NO_EMPTY );
847  $out['class'] = implode( ' ', array_unique( $classes ) );
848  }
849  return $out;
850  }
851 
861  public static function normalizeCss( $value ) {
862 
863  // Decode character references like &#123;
865 
866  // Decode escape sequences and line continuation
867  // See the grammar in the CSS 2 spec, appendix D.
868  // This has to be done AFTER decoding character references.
869  // This means it isn't possible for this function to return
870  // unsanitized escape sequences. It is possible to manufacture
871  // input that contains character references that decode to
872  // escape sequences that decode to character references, but
873  // it's OK for the return value to contain character references
874  // because the caller is supposed to escape those anyway.
875  static $decodeRegex;
876  if ( !$decodeRegex ) {
877  $space = '[\\x20\\t\\r\\n\\f]';
878  $nl = '(?:\\n|\\r\\n|\\r|\\f)';
879  $backslash = '\\\\';
880  $decodeRegex = "/ $backslash
881  (?:
882  ($nl) | # 1. Line continuation
883  ([0-9A-Fa-f]{1,6})$space? | # 2. character number
884  (.) | # 3. backslash cancelling special meaning
885  () | # 4. backslash at end of string
886  )/xu";
887  }
888  $value = preg_replace_callback( $decodeRegex,
889  [ __CLASS__, 'cssDecodeCallback' ], $value );
890 
891  // Normalize Halfwidth and Fullwidth Unicode block that IE6 might treat as ascii
892  $value = preg_replace_callback(
893  '/[!-[]-z]/u', // U+FF01 to U+FF5A, excluding U+FF3C (bug 58088)
894  function ( $matches ) {
896  if ( $cp === false ) {
897  return '';
898  }
899  return chr( $cp - 65248 ); // ASCII range \x21-\x7A
900  },
901  $value
902  );
903 
904  // Convert more characters IE6 might treat as ascii
905  // U+0280, U+0274, U+207F, U+029F, U+026A, U+207D, U+208D
906  $value = str_replace(
907  [ 'ʀ', 'ɴ', 'ⁿ', 'ʟ', 'ɪ', '⁽', '₍' ],
908  [ 'r', 'n', 'n', 'l', 'i', '(', '(' ],
909  $value
910  );
911 
912  // Let the value through if it's nothing but a single comment, to
913  // allow other functions which may reject it to pass some error
914  // message through.
915  if ( !preg_match( '! ^ \s* /\* [^*\\/]* \*/ \s* $ !x', $value ) ) {
916  // Remove any comments; IE gets token splitting wrong
917  // This must be done AFTER decoding character references and
918  // escape sequences, because those steps can introduce comments
919  // This step cannot introduce character references or escape
920  // sequences, because it replaces comments with spaces rather
921  // than removing them completely.
922  $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value );
923 
924  // Remove anything after a comment-start token, to guard against
925  // incorrect client implementations.
926  $commentPos = strpos( $value, '/*' );
927  if ( $commentPos !== false ) {
928  $value = substr( $value, 0, $commentPos );
929  }
930  }
931 
932  // S followed by repeat, iteration, or prolonged sound marks,
933  // which IE will treat as "ss"
934  $value = preg_replace(
935  '/s(?:
936  \xE3\x80\xB1 | # U+3031
937  \xE3\x82\x9D | # U+309D
938  \xE3\x83\xBC | # U+30FC
939  \xE3\x83\xBD | # U+30FD
940  \xEF\xB9\xBC | # U+FE7C
941  \xEF\xB9\xBD | # U+FE7D
942  \xEF\xBD\xB0 # U+FF70
943  )/ix',
944  'ss',
945  $value
946  );
947 
948  return $value;
949  }
950 
969  static function checkCss( $value ) {
970  $value = self::normalizeCss( $value );
971 
972  // Reject problematic keywords and control characters
973  if ( preg_match( '/[\000-\010\013\016-\037\177]/', $value ) ||
974  strpos( $value, UtfNormal\Constants::UTF8_REPLACEMENT ) !== false ) {
975  return '/* invalid control char */';
976  } elseif ( preg_match(
977  '! expression
978  | filter\s*:
979  | accelerator\s*:
980  | -o-link\s*:
981  | -o-link-source\s*:
982  | -o-replace\s*:
983  | url\s*\(
984  | image\s*\(
985  | image-set\s*\(
986  !ix', $value ) ) {
987  return '/* insecure input */';
988  }
989  return $value;
990  }
991 
996  static function cssDecodeCallback( $matches ) {
997  if ( $matches[1] !== '' ) {
998  // Line continuation
999  return '';
1000  } elseif ( $matches[2] !== '' ) {
1001  $char = UtfNormal\Utils::codepointToUtf8( hexdec( $matches[2] ) );
1002  } elseif ( $matches[3] !== '' ) {
1003  $char = $matches[3];
1004  } else {
1005  $char = '\\';
1006  }
1007  if ( $char == "\n" || $char == '"' || $char == "'" || $char == '\\' ) {
1008  // These characters need to be escaped in strings
1009  // Clean up the escape sequence to avoid parsing errors by clients
1010  return '\\' . dechex( ord( $char ) ) . ' ';
1011  } else {
1012  // Decode unnecessary escape
1013  return $char;
1014  }
1015  }
1016 
1036  static function fixTagAttributes( $text, $element ) {
1037  if ( trim( $text ) == '' ) {
1038  return '';
1039  }
1040 
1041  $decoded = Sanitizer::decodeTagAttributes( $text );
1042  $stripped = Sanitizer::validateTagAttributes( $decoded, $element );
1043 
1044  return Sanitizer::safeEncodeTagAttributes( $stripped );
1045  }
1046 
1052  static function encodeAttribute( $text ) {
1053  $encValue = htmlspecialchars( $text, ENT_QUOTES );
1054 
1055  // Whitespace is normalized during attribute decoding,
1056  // so if we've been passed non-spaces we must encode them
1057  // ahead of time or they won't be preserved.
1058  $encValue = strtr( $encValue, [
1059  "\n" => '&#10;',
1060  "\r" => '&#13;',
1061  "\t" => '&#9;',
1062  ] );
1063 
1064  return $encValue;
1065  }
1066 
1073  static function safeEncodeAttribute( $text ) {
1074  $encValue = Sanitizer::encodeAttribute( $text );
1075 
1076  # Templates and links may be expanded in later parsing,
1077  # creating invalid or dangerous output. Suppress this.
1078  $encValue = strtr( $encValue, [
1079  '<' => '&lt;', // This should never happen,
1080  '>' => '&gt;', // we've received invalid input
1081  '"' => '&quot;', // which should have been escaped.
1082  '{' => '&#123;',
1083  '[' => '&#91;',
1084  "''" => '&#39;&#39;',
1085  'ISBN' => '&#73;SBN',
1086  'RFC' => '&#82;FC',
1087  'PMID' => '&#80;MID',
1088  '|' => '&#124;',
1089  '__' => '&#95;_',
1090  ] );
1091 
1092  # Stupid hack
1093  $encValue = preg_replace_callback(
1094  '/((?i)' . wfUrlProtocols() . ')/',
1095  [ 'Sanitizer', 'armorLinksCallback' ],
1096  $encValue );
1097  return $encValue;
1098  }
1099 
1131  static function escapeId( $id, $options = [] ) {
1133  $options = (array)$options;
1134 
1135  $id = Sanitizer::decodeCharReferences( $id );
1136 
1137  if ( $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) {
1138  $id = preg_replace( '/[ \t\n\r\f_\'"&#%]+/', '_', $id );
1139  $id = trim( $id, '_' );
1140  if ( $id === '' ) {
1141  // Must have been all whitespace to start with.
1142  return '_';
1143  } else {
1144  return $id;
1145  }
1146  }
1147 
1148  // HTML4-style escaping
1149  static $replace = [
1150  '%3A' => ':',
1151  '%' => '.'
1152  ];
1153 
1154  $id = urlencode( strtr( $id, ' ', '_' ) );
1155  $id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
1156 
1157  if ( !preg_match( '/^[a-zA-Z]/', $id ) && !in_array( 'noninitial', $options ) ) {
1158  // Initial character must be a letter!
1159  $id = "x$id";
1160  }
1161  return $id;
1162  }
1163 
1181  static function escapeIdReferenceList( $referenceString, $options = [] ) {
1182  # Explode the space delimited list string into an array of tokens
1183  $references = preg_split( '/\s+/', "{$referenceString}", -1, PREG_SPLIT_NO_EMPTY );
1184 
1185  # Escape each token as an id
1186  foreach ( $references as &$ref ) {
1187  $ref = Sanitizer::escapeId( $ref, $options );
1188  }
1189 
1190  # Merge the array back to a space delimited list string
1191  # If the array is empty, the result will be an empty string ('')
1192  $referenceString = implode( ' ', $references );
1193 
1194  return $referenceString;
1195  }
1196 
1208  static function escapeClass( $class ) {
1209  // Convert ugly stuff to underscores and kill underscores in ugly places
1210  return rtrim( preg_replace(
1211  [ '/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/', '/_+/' ],
1212  '_',
1213  $class ), '_' );
1214  }
1215 
1223  static function escapeHtmlAllowEntities( $html ) {
1225  # It seems wise to escape ' as well as ", as a matter of course. Can't
1226  # hurt.
1227  $html = htmlspecialchars( $html, ENT_QUOTES );
1228  return $html;
1229  }
1230 
1236  private static function armorLinksCallback( $matches ) {
1237  return str_replace( ':', '&#58;', $matches[1] );
1238  }
1239 
1248  public static function decodeTagAttributes( $text ) {
1249  if ( trim( $text ) == '' ) {
1250  return [];
1251  }
1252 
1253  $attribs = [];
1254  $pairs = [];
1255  if ( !preg_match_all(
1256  self::getAttribsRegex(),
1257  $text,
1258  $pairs,
1259  PREG_SET_ORDER ) ) {
1260  return $attribs;
1261  }
1262 
1263  foreach ( $pairs as $set ) {
1264  $attribute = strtolower( $set[1] );
1266 
1267  // Normalize whitespace
1268  $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1269  $value = trim( $value );
1270 
1271  // Decode character references
1273  }
1274  return $attribs;
1275  }
1276 
1284  public static function safeEncodeTagAttributes( $assoc_array ) {
1285  $attribs = [];
1286  foreach ( $assoc_array as $attribute => $value ) {
1287  $encAttribute = htmlspecialchars( $attribute );
1288  $encValue = Sanitizer::safeEncodeAttribute( $value );
1289 
1290  $attribs[] = "$encAttribute=\"$encValue\"";
1291  }
1292  return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : '';
1293  }
1294 
1303  private static function getTagAttributeCallback( $set ) {
1304  if ( isset( $set[5] ) ) {
1305  # No quotes.
1306  return $set[5];
1307  } elseif ( isset( $set[4] ) ) {
1308  # Single-quoted
1309  return $set[4];
1310  } elseif ( isset( $set[3] ) ) {
1311  # Double-quoted
1312  return $set[3];
1313  } elseif ( !isset( $set[2] ) ) {
1314  # In XHTML, attributes must have a value so return an empty string.
1315  # See "Empty attribute syntax",
1316  # http://www.w3.org/TR/html5/syntax.html#syntax-attribute-name
1317  return "";
1318  } else {
1319  throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1320  }
1321  }
1322 
1327  private static function normalizeWhitespace( $text ) {
1328  return preg_replace(
1329  '/\r\n|[\x20\x0d\x0a\x09]/',
1330  ' ',
1331  $text );
1332  }
1333 
1343  return trim( preg_replace( '/[ _]+/', ' ', $section ) );
1344  }
1345 
1361  static function normalizeCharReferences( $text ) {
1362  return preg_replace_callback(
1363  self::CHAR_REFS_REGEX,
1364  [ 'Sanitizer', 'normalizeCharReferencesCallback' ],
1365  $text );
1366  }
1367 
1373  $ret = null;
1374  if ( $matches[1] != '' ) {
1376  } elseif ( $matches[2] != '' ) {
1378  } elseif ( $matches[3] != '' ) {
1380  }
1381  if ( is_null( $ret ) ) {
1382  return htmlspecialchars( $matches[0] );
1383  } else {
1384  return $ret;
1385  }
1386  }
1387 
1398  static function normalizeEntity( $name ) {
1399  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1400  return '&' . self::$htmlEntityAliases[$name] . ';';
1401  } elseif ( in_array( $name, [ 'lt', 'gt', 'amp', 'quot' ] ) ) {
1402  return "&$name;";
1403  } elseif ( isset( self::$htmlEntities[$name] ) ) {
1404  return '&#' . self::$htmlEntities[$name] . ';';
1405  } else {
1406  return "&amp;$name;";
1407  }
1408  }
1409 
1414  static function decCharReference( $codepoint ) {
1415  $point = intval( $codepoint );
1416  if ( Sanitizer::validateCodepoint( $point ) ) {
1417  return sprintf( '&#%d;', $point );
1418  } else {
1419  return null;
1420  }
1421  }
1422 
1427  static function hexCharReference( $codepoint ) {
1428  $point = hexdec( $codepoint );
1429  if ( Sanitizer::validateCodepoint( $point ) ) {
1430  return sprintf( '&#x%x;', $point );
1431  } else {
1432  return null;
1433  }
1434  }
1435 
1442  private static function validateCodepoint( $codepoint ) {
1443  # U+000C is valid in HTML5 but not allowed in XML.
1444  # U+000D is valid in XML but not allowed in HTML5.
1445  # U+007F - U+009F are disallowed in HTML5 (control characters).
1446  return $codepoint == 0x09
1447  || $codepoint == 0x0a
1448  || ( $codepoint >= 0x20 && $codepoint <= 0x7e )
1449  || ( $codepoint >= 0xa0 && $codepoint <= 0xd7ff )
1450  || ( $codepoint >= 0xe000 && $codepoint <= 0xfffd )
1451  || ( $codepoint >= 0x10000 && $codepoint <= 0x10ffff );
1452  }
1453 
1461  public static function decodeCharReferences( $text ) {
1462  return preg_replace_callback(
1463  self::CHAR_REFS_REGEX,
1464  [ 'Sanitizer', 'decodeCharReferencesCallback' ],
1465  $text );
1466  }
1467 
1478  public static function decodeCharReferencesAndNormalize( $text ) {
1480  $text = preg_replace_callback(
1481  self::CHAR_REFS_REGEX,
1482  [ 'Sanitizer', 'decodeCharReferencesCallback' ],
1483  $text, /* limit */ -1, $count );
1484 
1485  if ( $count ) {
1486  return $wgContLang->normalize( $text );
1487  } else {
1488  return $text;
1489  }
1490  }
1491 
1497  if ( $matches[1] != '' ) {
1498  return Sanitizer::decodeEntity( $matches[1] );
1499  } elseif ( $matches[2] != '' ) {
1500  return Sanitizer::decodeChar( intval( $matches[2] ) );
1501  } elseif ( $matches[3] != '' ) {
1502  return Sanitizer::decodeChar( hexdec( $matches[3] ) );
1503  }
1504  # Last case should be an ampersand by itself
1505  return $matches[0];
1506  }
1507 
1515  static function decodeChar( $codepoint ) {
1516  if ( Sanitizer::validateCodepoint( $codepoint ) ) {
1517  return UtfNormal\Utils::codepointToUtf8( $codepoint );
1518  } else {
1520  }
1521  }
1522 
1531  static function decodeEntity( $name ) {
1532  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1533  $name = self::$htmlEntityAliases[$name];
1534  }
1535  if ( isset( self::$htmlEntities[$name] ) ) {
1536  return UtfNormal\Utils::codepointToUtf8( self::$htmlEntities[$name] );
1537  } else {
1538  return "&$name;";
1539  }
1540  }
1541 
1548  static function attributeWhitelist( $element ) {
1550  return isset( $list[$element] )
1551  ? $list[$element]
1552  : [];
1553  }
1554 
1560  static function setupAttributeWhitelist() {
1561  static $whitelist;
1562 
1563  if ( $whitelist !== null ) {
1564  return $whitelist;
1565  }
1566 
1567  $common = [
1568  # HTML
1569  'id',
1570  'class',
1571  'style',
1572  'lang',
1573  'dir',
1574  'title',
1575 
1576  # WAI-ARIA
1577  'aria-describedby',
1578  'aria-flowto',
1579  'aria-label',
1580  'aria-labelledby',
1581  'aria-owns',
1582  'role',
1583 
1584  # RDFa
1585  # These attributes are specified in section 9 of
1586  # http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1587  'about',
1588  'property',
1589  'resource',
1590  'datatype',
1591  'typeof',
1592 
1593  # Microdata. These are specified by
1594  # http://www.whatwg.org/html/microdata.html#the-microdata-model
1595  'itemid',
1596  'itemprop',
1597  'itemref',
1598  'itemscope',
1599  'itemtype',
1600  ];
1601 
1602  $block = array_merge( $common, [ 'align' ] );
1603  $tablealign = [ 'align', 'valign' ];
1604  $tablecell = [
1605  'abbr',
1606  'axis',
1607  'headers',
1608  'scope',
1609  'rowspan',
1610  'colspan',
1611  'nowrap', # deprecated
1612  'width', # deprecated
1613  'height', # deprecated
1614  'bgcolor', # deprecated
1615  ];
1616 
1617  # Numbers refer to sections in HTML 4.01 standard describing the element.
1618  # See: http://www.w3.org/TR/html4/
1619  $whitelist = [
1620  # 7.5.4
1621  'div' => $block,
1622  'center' => $common, # deprecated
1623  'span' => $common,
1624 
1625  # 7.5.5
1626  'h1' => $block,
1627  'h2' => $block,
1628  'h3' => $block,
1629  'h4' => $block,
1630  'h5' => $block,
1631  'h6' => $block,
1632 
1633  # 7.5.6
1634  # address
1635 
1636  # 8.2.4
1637  'bdo' => $common,
1638 
1639  # 9.2.1
1640  'em' => $common,
1641  'strong' => $common,
1642  'cite' => $common,
1643  'dfn' => $common,
1644  'code' => $common,
1645  'samp' => $common,
1646  'kbd' => $common,
1647  'var' => $common,
1648  'abbr' => $common,
1649  # acronym
1650 
1651  # 9.2.2
1652  'blockquote' => array_merge( $common, [ 'cite' ] ),
1653  'q' => array_merge( $common, [ 'cite' ] ),
1654 
1655  # 9.2.3
1656  'sub' => $common,
1657  'sup' => $common,
1658 
1659  # 9.3.1
1660  'p' => $block,
1661 
1662  # 9.3.2
1663  'br' => array_merge( $common, [ 'clear' ] ),
1664 
1665  # http://www.whatwg.org/html/text-level-semantics.html#the-wbr-element
1666  'wbr' => $common,
1667 
1668  # 9.3.4
1669  'pre' => array_merge( $common, [ 'width' ] ),
1670 
1671  # 9.4
1672  'ins' => array_merge( $common, [ 'cite', 'datetime' ] ),
1673  'del' => array_merge( $common, [ 'cite', 'datetime' ] ),
1674 
1675  # 10.2
1676  'ul' => array_merge( $common, [ 'type' ] ),
1677  'ol' => array_merge( $common, [ 'type', 'start', 'reversed' ] ),
1678  'li' => array_merge( $common, [ 'type', 'value' ] ),
1679 
1680  # 10.3
1681  'dl' => $common,
1682  'dd' => $common,
1683  'dt' => $common,
1684 
1685  # 11.2.1
1686  'table' => array_merge( $common,
1687  [ 'summary', 'width', 'border', 'frame',
1688  'rules', 'cellspacing', 'cellpadding',
1689  'align', 'bgcolor',
1690  ] ),
1691 
1692  # 11.2.2
1693  'caption' => $block,
1694 
1695  # 11.2.3
1696  'thead' => $common,
1697  'tfoot' => $common,
1698  'tbody' => $common,
1699 
1700  # 11.2.4
1701  'colgroup' => array_merge( $common, [ 'span' ] ),
1702  'col' => array_merge( $common, [ 'span' ] ),
1703 
1704  # 11.2.5
1705  'tr' => array_merge( $common, [ 'bgcolor' ], $tablealign ),
1706 
1707  # 11.2.6
1708  'td' => array_merge( $common, $tablecell, $tablealign ),
1709  'th' => array_merge( $common, $tablecell, $tablealign ),
1710 
1711  # 12.2
1712  # NOTE: <a> is not allowed directly, but the attrib
1713  # whitelist is used from the Parser object
1714  'a' => array_merge( $common, [ 'href', 'rel', 'rev' ] ), # rel/rev esp. for RDFa
1715 
1716  # 13.2
1717  # Not usually allowed, but may be used for extension-style hooks
1718  # such as <math> when it is rasterized, or if $wgAllowImageTag is
1719  # true
1720  'img' => array_merge( $common, [ 'alt', 'src', 'width', 'height' ] ),
1721 
1722  # 15.2.1
1723  'tt' => $common,
1724  'b' => $common,
1725  'i' => $common,
1726  'big' => $common,
1727  'small' => $common,
1728  'strike' => $common,
1729  's' => $common,
1730  'u' => $common,
1731 
1732  # 15.2.2
1733  'font' => array_merge( $common, [ 'size', 'color', 'face' ] ),
1734  # basefont
1735 
1736  # 15.3
1737  'hr' => array_merge( $common, [ 'width' ] ),
1738 
1739  # HTML Ruby annotation text module, simple ruby only.
1740  # http://www.whatwg.org/html/text-level-semantics.html#the-ruby-element
1741  'ruby' => $common,
1742  # rbc
1743  'rb' => $common,
1744  'rp' => $common,
1745  'rt' => $common, # array_merge( $common, array( 'rbspan' ) ),
1746  'rtc' => $common,
1747 
1748  # MathML root element, where used for extensions
1749  # 'title' may not be 100% valid here; it's XHTML
1750  # http://www.w3.org/TR/REC-MathML/
1751  'math' => [ 'class', 'style', 'id', 'title' ],
1752 
1753  # HTML 5 section 4.6
1754  'bdi' => $common,
1755 
1756  # HTML5 elements, defined by:
1757  # http://www.whatwg.org/html/
1758  'data' => array_merge( $common, [ 'value' ] ),
1759  'time' => array_merge( $common, [ 'datetime' ] ),
1760  'mark' => $common,
1761 
1762  // meta and link are only permitted by removeHTMLtags when Microdata
1763  // is enabled so we don't bother adding a conditional to hide these
1764  // Also meta and link are only valid in WikiText as Microdata elements
1765  // (ie: validateTag rejects tags missing the attributes needed for Microdata)
1766  // So we don't bother including $common attributes that have no purpose.
1767  'meta' => [ 'itemprop', 'content' ],
1768  'link' => [ 'itemprop', 'href' ],
1769  ];
1770 
1771  return $whitelist;
1772  }
1773 
1784  static function stripAllTags( $text ) {
1785  # Actual <tags>
1786  $text = StringUtils::delimiterReplace( '<', '>', '', $text );
1787 
1788  # Normalize &entities and whitespace
1789  $text = self::decodeCharReferences( $text );
1790  $text = self::normalizeWhitespace( $text );
1791 
1792  return $text;
1793  }
1794 
1804  static function hackDocType() {
1805  $out = "<!DOCTYPE html [\n";
1806  foreach ( self::$htmlEntities as $entity => $codepoint ) {
1807  $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1808  }
1809  $out .= "]>\n";
1810  return $out;
1811  }
1812 
1817  static function cleanUrl( $url ) {
1818  # Normalize any HTML entities in input. They will be
1819  # re-escaped by makeExternalLink().
1820  $url = Sanitizer::decodeCharReferences( $url );
1821 
1822  # Escape any control characters introduced by the above step
1823  $url = preg_replace_callback( '/[\][<>"\\x00-\\x20\\x7F\|]/',
1824  [ __CLASS__, 'cleanUrlCallback' ], $url );
1825 
1826  # Validate hostname portion
1827  $matches = [];
1828  if ( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1829  list( /* $whole */, $protocol, $host, $rest ) = $matches;
1830 
1831  // Characters that will be ignored in IDNs.
1832  // http://tools.ietf.org/html/3454#section-3.1
1833  // Strip them before further processing so blacklists and such work.
1834  $strip = "/
1835  \\s| # general whitespace
1836  \xc2\xad| # 00ad SOFT HYPHEN
1837  \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1838  \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1839  \xe2\x81\xa0| # 2060 WORD JOINER
1840  \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1841  \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
1842  \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1843  \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1844  \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1845  \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1846  \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1847  [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe0f VARIATION SELECTOR-1-16
1848  /xuD";
1849 
1850  $host = preg_replace( $strip, '', $host );
1851 
1852  // IPv6 host names are bracketed with []. Url-decode these.
1853  if ( substr_compare( "//%5B", $host, 0, 5 ) === 0 &&
1854  preg_match( '!^//%5B([0-9A-Fa-f:.]+)%5D((:\d+)?)$!', $host, $matches )
1855  ) {
1856  $host = '//[' . $matches[1] . ']' . $matches[2];
1857  }
1858 
1859  // @todo FIXME: Validate hostnames here
1860 
1861  return $protocol . $host . $rest;
1862  } else {
1863  return $url;
1864  }
1865  }
1866 
1871  static function cleanUrlCallback( $matches ) {
1872  return urlencode( $matches[0] );
1873  }
1874 
1903  public static function validateEmail( $addr ) {
1904  $result = null;
1905  if ( !Hooks::run( 'isValidEmailAddr', [ $addr, &$result ] ) ) {
1906  return $result;
1907  }
1908 
1909  // Please note strings below are enclosed in brackets [], this make the
1910  // hyphen "-" a range indicator. Hence it is double backslashed below.
1911  // See bug 26948
1912  $rfc5322_atext = "a-z0-9!#$%&'*+\\-\/=?^_`{|}~";
1913  $rfc1034_ldh_str = "a-z0-9\\-";
1914 
1915  $html5_email_regexp = "/
1916  ^ # start of string
1917  [$rfc5322_atext\\.]+ # user part which is liberal :p
1918  @ # 'apostrophe'
1919  [$rfc1034_ldh_str]+ # First domain part
1920  (\\.[$rfc1034_ldh_str]+)* # Following part prefixed with a dot
1921  $ # End of string
1922  /ix"; // case Insensitive, eXtended
1923 
1924  return (bool)preg_match( $html5_email_regexp, $addr );
1925  }
1926 }
utf8ToCodepoint($char)
Determine the Unicode codepoint of a single-character UTF-8 sequence.
you don t have to do a grep find to see where the $wgReverseTitle variable is used
Definition: hooks.txt:117
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if that
Definition: deferred.txt:11
static decCharReference($codepoint)
Definition: Sanitizer.php:1414
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses & $html
Definition: hooks.txt:1795
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global list
Definition: deferred.txt:11
static decodeTagAttributes($text)
Return an associative array of attribute names and values from a partial tag string.
Definition: Sanitizer.php:1248
this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that probably a stub it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output $out
Definition: hooks.txt:758
static normalizeEntity($name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the equivalent numeric entity re...
Definition: Sanitizer.php:1398
the array() calling protocol came about after MediaWiki 1.4rc1.
static safeEncodeTagAttributes($assoc_array)
Build a partial tag string from an associative array of attribute names and values as returned by dec...
Definition: Sanitizer.php:1284
static normalizeCharReferencesCallback($matches)
Definition: Sanitizer.php:1372
static setupAttributeWhitelist()
Foreach array key (an allowed HTML element), return an array of allowed attributes.
Definition: Sanitizer.php:1560
static isEnabled()
Definition: MWTidy.php:92
static decodeCharReferencesCallback($matches)
Definition: Sanitizer.php:1496
static cssDecodeCallback($matches)
Definition: Sanitizer.php:996
null for the local wiki Added in
Definition: hooks.txt:1414
$value
static escapeClass($class)
Given a value, escape it so that it can be used as a CSS class and return it.
Definition: Sanitizer.php:1208
static hackDocType()
Hack up a private DOCTYPE with HTML's standard entity declarations.
Definition: Sanitizer.php:1804
static cleanUrl($url)
Definition: Sanitizer.php:1817
static stripAllTags($text)
Take a fragment of (potentially invalid) HTML and return a version with any tags removed, encoded as plain text.
Definition: Sanitizer.php:1784
when a variable name is used in a it is silently declared as a new local masking the global
Definition: design.txt:93
const UTF8_REPLACEMENT
static hexCharReference($codepoint)
Definition: Sanitizer.php:1427
static validateTagAttributes($attribs, $element)
Take an array of attribute names and values and normalize or discard illegal values for the given ele...
Definition: Sanitizer.php:716
static normalizeWhitespace($text)
Definition: Sanitizer.php:1327
static static static $attribsRegex
Lazy-initialised attributes regex, see getAttribsRegex()
Definition: Sanitizer.php:325
The index of the header message $result[1]=The index of the body text message $result[2 through n]=Parameters passed to body text message.Please note the header message cannot receive/use parameters. 'ImportHandleLogItemXMLTag':When parsing a XML tag in a log item.Return false to stop further processing of the tag $reader:XMLReader object $logInfo:Array of information 'ImportHandlePageXMLTag':When parsing a XML tag in a page.Return false to stop further processing of the tag $reader:XMLReader object &$pageInfo:Array of information 'ImportHandleRevisionXMLTag':When parsing a XML tag in a page revision.Return false to stop further processing of the tag $reader:XMLReader object $pageInfo:Array of page information $revisionInfo:Array of revision information 'ImportHandleToplevelXMLTag':When parsing a top level XML tag.Return false to stop further processing of the tag $reader:XMLReader object 'ImportHandleUploadXMLTag':When parsing a XML tag in a file upload.Return false to stop further processing of the tag $reader:XMLReader object $revisionInfo:Array of information 'ImportLogInterwikiLink':Hook to change the interwiki link used in log entries and edit summaries for transwiki imports.&$fullInterwikiPrefix:Interwiki prefix, may contain colons.&$pageTitle:String that contains page title. 'ImportSources':Called when reading from the $wgImportSources configuration variable.Can be used to lazy-load the import sources list.&$importSources:The value of $wgImportSources.Modify as necessary.See the comment in DefaultSettings.php for the detail of how to structure this array. 'InfoAction':When building information to display on the action=info page.$context:IContextSource object &$pageInfo:Array of information 'InitializeArticleMaybeRedirect':MediaWiki check to see if title is a redirect.&$title:Title object for the current page &$request:WebRequest &$ignoreRedirect:boolean to skip redirect check &$target:Title/string of redirect target &$article:Article object 'InternalParseBeforeLinks':during Parser's internalParse method before links but after nowiki/noinclude/includeonly/onlyinclude and other processings.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InternalParseBeforeSanitize':during Parser's internalParse method just before the parser removes unwanted/dangerous HTML tags and after nowiki/noinclude/includeonly/onlyinclude and other processings.Ideal for syntax-extensions after template/parser function execution which respect nowiki and HTML-comments.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InterwikiLoadPrefix':When resolving if a given prefix is an interwiki or not.Return true without providing an interwiki to continue interwiki search.$prefix:interwiki prefix we are looking for.&$iwData:output array describing the interwiki with keys iw_url, iw_local, iw_trans and optionally iw_api and iw_wikiid. 'InvalidateEmailComplete':Called after a user's email has been invalidated successfully.$user:user(object) whose email is being invalidated 'IRCLineURL':When constructing the URL to use in an IRC notification.Callee may modify $url and $query, URL will be constructed as $url.$query &$url:URL to index.php &$query:Query string $rc:RecentChange object that triggered url generation 'IsFileCacheable':Override the result of Article::isFileCacheable()(if true) &$article:article(object) being checked 'IsTrustedProxy':Override the result of IP::isTrustedProxy() &$ip:IP being check &$result:Change this value to override the result of IP::isTrustedProxy() 'IsUploadAllowedFromUrl':Override the result of UploadFromUrl::isAllowedUrl() $url:URL used to upload from &$allowed:Boolean indicating if uploading is allowed for given URL 'isValidEmailAddr':Override the result of Sanitizer::validateEmail(), for instance to return false if the domain name doesn't match your organization.$addr:The e-mail address entered by the user &$result:Set this and return false to override the internal checks 'isValidPassword':Override the result of User::isValidPassword() $password:The password entered by the user &$result:Set this and return false to override the internal checks $user:User the password is being validated for 'Language::getMessagesFileName':$code:The language code or the language we're looking for a messages file for &$file:The messages file path, you can override this to change the location. 'LanguageGetMagic':DEPRECATED!Use $magicWords in a file listed in $wgExtensionMessagesFiles instead.Use this to define synonyms of magic words depending of the language &$magicExtensions:associative array of magic words synonyms $lang:language code(string) 'LanguageGetNamespaces':Provide custom ordering for namespaces or remove namespaces.Do not use this hook to add namespaces.Use CanonicalNamespaces for that.&$namespaces:Array of namespaces indexed by their numbers 'LanguageGetSpecialPageAliases':DEPRECATED!Use $specialPageAliases in a file listed in $wgExtensionMessagesFiles instead.Use to define aliases of special pages names depending of the language &$specialPageAliases:associative array of magic words synonyms $lang:language code(string) 'LanguageGetTranslatedLanguageNames':Provide translated language names.&$names:array of language code=> language name $code:language of the preferred translations 'LanguageLinks':Manipulate a page's language links.This is called in various places to allow extensions to define the effective language links for a page.$title:The page's Title.&$links:Associative array mapping language codes to prefixed links of the form"language:title".&$linkFlags:Associative array mapping prefixed links to arrays of flags.Currently unused, but planned to provide support for marking individual language links in the UI, e.g.for featured articles. 'LanguageSelector':Hook to change the language selector available on a page.$out:The output page.$cssClassName:CSS class name of the language selector. 'LinkBegin':DEPRECATED!Use HtmlPageLinkRendererBegin instead.Used when generating internal and interwiki links in Linker::link(), before processing starts.Return false to skip default processing and return $ret.See documentation for Linker::link() for details on the expected meanings of parameters.$skin:the Skin object $target:the Title that the link is pointing to &$html:the contents that the< a > tag should have(raw HTML) $result
Definition: hooks.txt:1793
if($line===false) $args
Definition: cdb.php:64
static decodeCharReferences($text)
Decode any character references, numeric or named entities, in the text and return a UTF-8 string...
Definition: Sanitizer.php:1461
static validateCodepoint($codepoint)
Returns true if a given Unicode codepoint is a valid character in both HTML5 and XML.
Definition: Sanitizer.php:1442
const EVIL_URI_PATTERN
Blacklist for evil uris like javascript: WARNING: DO NOT use this in any place that actually requires...
Definition: Sanitizer.php:56
const ELEMENT_BITS_REGEX
Acceptable tag name charset from HTML5 parsing spec http://www.w3.org/TR/html5/syntax.html#tag-open-state.
Definition: Sanitizer.php:46
Unicode normalization routines for working with UTF-8 strings.
Definition: UtfNormal.php:48
static decodeChar($codepoint)
Return UTF-8 string for a codepoint if that is a valid character reference, otherwise U+FFFD REPLACEM...
Definition: Sanitizer.php:1515
static normalizeSectionNameWhitespace($section)
Normalizes whitespace in a section name, such as might be returned by Parser::stripSectionName(), for use in the id's that are used for section links.
Definition: Sanitizer.php:1342
static $htmlEntities
List of all named character entities defined in HTML 4.01 http://www.w3.org/TR/html4/sgml/entities.html As well as ' which is only defined starting in XHTML1.
Definition: Sanitizer.php:64
static attributeWhitelist($element)
Fetch the whitelist of acceptable attributes for a given element name.
Definition: Sanitizer.php:1548
this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist e g Watchlist removed from all revisions and log entries to which it was applied This gives extensions a chance to take it off their books as the deletion has already been partly carried out by this point or something similar the user will be unable to create the tag set and then return false from the hook function Ensure you consume the ChangeTagAfterDelete hook to carry out custom deletion actions as context called by AbstractContent::getParserOutput May be used to override the normal model specific rendering of page content as context as context $options
Definition: hooks.txt:1000
static escapeHtmlAllowEntities($html)
Given HTML input, escape with htmlspecialchars but un-escape entities.
Definition: Sanitizer.php:1223
static validateTag($params, $element)
Takes attribute names and values for a tag and the tag name and validates that the tag is allowed to ...
Definition: Sanitizer.php:680
static mergeAttributes($a, $b)
Merge two sets of HTML attributes.
Definition: Sanitizer.php:839
MediaWiki exception.
Definition: MWException.php:26
const CHAR_REFS_REGEX
Regular expression to match various types of character references in Sanitizer::normalizeCharReferenc...
Definition: Sanitizer.php:36
static getRecognizedTagData($extratags=[], $removetags=[])
Return the various lists of recognized tags.
Definition: Sanitizer.php:365
$params
static validateAttributes($attribs, $whitelist)
Take an array of attribute names and values and normalize or discard illegal values for the given whi...
Definition: Sanitizer.php:736
static decodeCharReferencesAndNormalize($text)
Decode any character references, numeric or named entities, in the next and normalize the resulting s...
Definition: Sanitizer.php:1478
static run($event, array $args=[], $deprecatedVersion=null)
Call hook functions defined in Hooks::register and $wgHooks.
Definition: Hooks.php:131
static static $htmlEntityAliases
Character entity aliases accepted by MediaWiki.
Definition: Sanitizer.php:323
static escapeIdReferenceList($referenceString, $options=[])
Given a string containing a space delimited list of ids, escape each id to match ids escaped by the e...
Definition: Sanitizer.php:1181
Apache License January AND DISTRIBUTION Definitions License shall mean the terms and conditions for and distribution as defined by Sections through of this document Licensor shall mean the copyright owner or entity authorized by the copyright owner that is granting the License Legal Entity shall mean the union of the acting entity and all other entities that control are controlled by or are under common control with that entity For the purposes of this definition control direct or to cause the direction or management of such whether by contract or including but not limited to software source documentation and configuration files Object form shall mean any form resulting from mechanical transformation or translation of a Source including but not limited to compiled object generated and conversions to other media types Work shall mean the work of whether in Source or Object made available under the as indicated by a copyright notice that is included in or attached to the whether in Source or Object that is based or other modifications as a an original work of authorship For the purposes of this Derivative Works shall not include works that remain separable or merely the Work and Derivative Works thereof Contribution shall mean any work of including the original version of the Work and any modifications or additions to that Work or Derivative Works that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner For the purposes of this submitted means any form of or written communication sent to the Licensor or its including but not limited to communication on electronic mailing source code control and issue tracking systems that are managed by
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses & $ret
Definition: hooks.txt:1795
static cleanUrlCallback($matches)
Definition: Sanitizer.php:1871
This document is intended to provide useful advice for parties seeking to redistribute MediaWiki to end users It s targeted particularly at maintainers for Linux since it s been observed that distribution packages of MediaWiki often break We ve consistently had to recommend that users seeking support use official tarballs instead of their distribution s and this often solves whatever problem the user is having It would be nice if this could such as
Definition: distributors.txt:9
usually copyright or history_copyright This message must be in HTML not wikitext if the section is included from a template $section
Definition: hooks.txt:2744
static armorLinksCallback($matches)
Regex replace callback for armoring links against further processing.
Definition: Sanitizer.php:1236
static escapeId($id, $options=[])
Given a value, escape it so that it can be used in an id attribute and return it. ...
Definition: Sanitizer.php:1131
wfUrlProtocols($includeProtocolRelative=true)
Returns a regular expression of url protocols.
static normalizeCss($value)
Normalize CSS into a format we can easily search for hostile input.
Definition: Sanitizer.php:861
const XMLNS_ATTRIBUTE_PATTERN
Definition: Sanitizer.php:57
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency which acts as the top level factory for services in MediaWiki which can be used to gain access to default instances of various services MediaWikiServices however also allows new services to be defined and default services to be redefined Services are defined or redefined by providing a callback the instantiator that will return a new instance of the service When it will create an instance of MediaWikiServices and populate it with the services defined in the files listed by thereby bootstrapping the DI framework Per $wgServiceWiringFiles lists includes ServiceWiring php
Definition: injection.txt:35
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if so it s not worth the trouble Since there is a job queue in the jobs table
Definition: deferred.txt:11
$wgAllowImageTag
A different approach to the above: simply allow the "<img>" tag to be used.
static normalizeCharReferences($text)
Ensure that any entities and character references are legal for XML and XHTML specifically.
Definition: Sanitizer.php:1361
this class mediates it Skin Encapsulates a look and feel for the wiki All of the functions that render HTML and make choices about how to render it are here and are called from various other places when and is meant to be subclassed with other skins that may override some of its functions The User object contains a reference to a and so rather than having a global skin object we just rely on the global User and get the skin with $wgUser and also has some character encoding functions and other locale stuff The current user interface language is instantiated as and the local content language as $wgContLang
Definition: design.txt:56
$wgExperimentalHtmlIds
Should we allow a broader set of characters in id attributes, per HTML5? If not, use only HTML 4-comp...
$count
static fixTagAttributes($text, $element)
Take a tag soup fragment listing an HTML element's attributes and normalize it to well-formed XML...
Definition: Sanitizer.php:1036
static removeHTMLcomments($text)
Remove '', and everything between.
Definition: Sanitizer.php:634
static getAttribsRegex()
Regular expression to match HTML/XML attribute pairs within a tag.
Definition: Sanitizer.php:340
codepointToUtf8($codepoint)
Return UTF-8 sequence for a given Unicode code point.
static validateEmail($addr)
Does a string look like an e-mail address?
Definition: Sanitizer.php:1903
static removeHTMLtags($text, $processCallback=null, $args=[], $extratags=[], $removetags=[])
Cleans up HTML, removes dangerous tags and attributes, and removes HTML comments. ...
Definition: Sanitizer.php:455
static checkCss($value)
Pick apart some CSS and check it for forbidden or unsafe structures.
Definition: Sanitizer.php:969
static getTagAttributeCallback($set)
Pick the appropriate attribute value from a match set from the attribs regex matches.
Definition: Sanitizer.php:1303
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses after processing & $attribs
Definition: hooks.txt:1795
</td >< td > &</td >< td > t want your writing to be edited mercilessly and redistributed at will
HTML sanitizer for MediaWiki.
Definition: Sanitizer.php:31
static decodeEntity($name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the UTF-8 encoding of that chara...
Definition: Sanitizer.php:1531
static safeEncodeAttribute($text)
Encode an attribute value for HTML tags, with extra armoring against further wiki processing...
Definition: Sanitizer.php:1073
static configuration should be added through ResourceLoaderGetConfigVars instead & $vars
Definition: hooks.txt:2023
static encodeAttribute($text)
Encode an attribute value for HTML output.
Definition: Sanitizer.php:1052
$matches
Allows to change the fields on the form that will be generated $name
Definition: hooks.txt:310