MediaWiki  master
Sanitizer.php
Go to the documentation of this file.
1 <?php
31 class Sanitizer {
37  '/&([A-Za-z0-9\x80-\xff]+);
38  |&\#([0-9]+);
39  |&\#[xX]([0-9A-Fa-f]+);
40  |(&)/x';
41 
46  const ELEMENT_BITS_REGEX = '!^(/?)([A-Za-z][^\t\n\v />\0]*+)([^>]*?)(/?>)([^<]*)$!';
47 
56  const EVIL_URI_PATTERN = '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i';
57  const XMLNS_ATTRIBUTE_PATTERN = "/^xmlns:[:A-Z_a-z-.0-9]+$/";
58 
64  private static $htmlEntities = [
65  'Aacute' => 193,
66  'aacute' => 225,
67  'Acirc' => 194,
68  'acirc' => 226,
69  'acute' => 180,
70  'AElig' => 198,
71  'aelig' => 230,
72  'Agrave' => 192,
73  'agrave' => 224,
74  'alefsym' => 8501,
75  'Alpha' => 913,
76  'alpha' => 945,
77  'amp' => 38,
78  'and' => 8743,
79  'ang' => 8736,
80  'apos' => 39, // New in XHTML & HTML 5; avoid in output for compatibility with IE.
81  'Aring' => 197,
82  'aring' => 229,
83  'asymp' => 8776,
84  'Atilde' => 195,
85  'atilde' => 227,
86  'Auml' => 196,
87  'auml' => 228,
88  'bdquo' => 8222,
89  'Beta' => 914,
90  'beta' => 946,
91  'brvbar' => 166,
92  'bull' => 8226,
93  'cap' => 8745,
94  'Ccedil' => 199,
95  'ccedil' => 231,
96  'cedil' => 184,
97  'cent' => 162,
98  'Chi' => 935,
99  'chi' => 967,
100  'circ' => 710,
101  'clubs' => 9827,
102  'cong' => 8773,
103  'copy' => 169,
104  'crarr' => 8629,
105  'cup' => 8746,
106  'curren' => 164,
107  'dagger' => 8224,
108  'Dagger' => 8225,
109  'darr' => 8595,
110  'dArr' => 8659,
111  'deg' => 176,
112  'Delta' => 916,
113  'delta' => 948,
114  'diams' => 9830,
115  'divide' => 247,
116  'Eacute' => 201,
117  'eacute' => 233,
118  'Ecirc' => 202,
119  'ecirc' => 234,
120  'Egrave' => 200,
121  'egrave' => 232,
122  'empty' => 8709,
123  'emsp' => 8195,
124  'ensp' => 8194,
125  'Epsilon' => 917,
126  'epsilon' => 949,
127  'equiv' => 8801,
128  'Eta' => 919,
129  'eta' => 951,
130  'ETH' => 208,
131  'eth' => 240,
132  'Euml' => 203,
133  'euml' => 235,
134  'euro' => 8364,
135  'exist' => 8707,
136  'fnof' => 402,
137  'forall' => 8704,
138  'frac12' => 189,
139  'frac14' => 188,
140  'frac34' => 190,
141  'frasl' => 8260,
142  'Gamma' => 915,
143  'gamma' => 947,
144  'ge' => 8805,
145  'gt' => 62,
146  'harr' => 8596,
147  'hArr' => 8660,
148  'hearts' => 9829,
149  'hellip' => 8230,
150  'Iacute' => 205,
151  'iacute' => 237,
152  'Icirc' => 206,
153  'icirc' => 238,
154  'iexcl' => 161,
155  'Igrave' => 204,
156  'igrave' => 236,
157  'image' => 8465,
158  'infin' => 8734,
159  'int' => 8747,
160  'Iota' => 921,
161  'iota' => 953,
162  'iquest' => 191,
163  'isin' => 8712,
164  'Iuml' => 207,
165  'iuml' => 239,
166  'Kappa' => 922,
167  'kappa' => 954,
168  'Lambda' => 923,
169  'lambda' => 955,
170  'lang' => 9001,
171  'laquo' => 171,
172  'larr' => 8592,
173  'lArr' => 8656,
174  'lceil' => 8968,
175  'ldquo' => 8220,
176  'le' => 8804,
177  'lfloor' => 8970,
178  'lowast' => 8727,
179  'loz' => 9674,
180  'lrm' => 8206,
181  'lsaquo' => 8249,
182  'lsquo' => 8216,
183  'lt' => 60,
184  'macr' => 175,
185  'mdash' => 8212,
186  'micro' => 181,
187  'middot' => 183,
188  'minus' => 8722,
189  'Mu' => 924,
190  'mu' => 956,
191  'nabla' => 8711,
192  'nbsp' => 160,
193  'ndash' => 8211,
194  'ne' => 8800,
195  'ni' => 8715,
196  'not' => 172,
197  'notin' => 8713,
198  'nsub' => 8836,
199  'Ntilde' => 209,
200  'ntilde' => 241,
201  'Nu' => 925,
202  'nu' => 957,
203  'Oacute' => 211,
204  'oacute' => 243,
205  'Ocirc' => 212,
206  'ocirc' => 244,
207  'OElig' => 338,
208  'oelig' => 339,
209  'Ograve' => 210,
210  'ograve' => 242,
211  'oline' => 8254,
212  'Omega' => 937,
213  'omega' => 969,
214  'Omicron' => 927,
215  'omicron' => 959,
216  'oplus' => 8853,
217  'or' => 8744,
218  'ordf' => 170,
219  'ordm' => 186,
220  'Oslash' => 216,
221  'oslash' => 248,
222  'Otilde' => 213,
223  'otilde' => 245,
224  'otimes' => 8855,
225  'Ouml' => 214,
226  'ouml' => 246,
227  'para' => 182,
228  'part' => 8706,
229  'permil' => 8240,
230  'perp' => 8869,
231  'Phi' => 934,
232  'phi' => 966,
233  'Pi' => 928,
234  'pi' => 960,
235  'piv' => 982,
236  'plusmn' => 177,
237  'pound' => 163,
238  'prime' => 8242,
239  'Prime' => 8243,
240  'prod' => 8719,
241  'prop' => 8733,
242  'Psi' => 936,
243  'psi' => 968,
244  'quot' => 34,
245  'radic' => 8730,
246  'rang' => 9002,
247  'raquo' => 187,
248  'rarr' => 8594,
249  'rArr' => 8658,
250  'rceil' => 8969,
251  'rdquo' => 8221,
252  'real' => 8476,
253  'reg' => 174,
254  'rfloor' => 8971,
255  'Rho' => 929,
256  'rho' => 961,
257  'rlm' => 8207,
258  'rsaquo' => 8250,
259  'rsquo' => 8217,
260  'sbquo' => 8218,
261  'Scaron' => 352,
262  'scaron' => 353,
263  'sdot' => 8901,
264  'sect' => 167,
265  'shy' => 173,
266  'Sigma' => 931,
267  'sigma' => 963,
268  'sigmaf' => 962,
269  'sim' => 8764,
270  'spades' => 9824,
271  'sub' => 8834,
272  'sube' => 8838,
273  'sum' => 8721,
274  'sup' => 8835,
275  'sup1' => 185,
276  'sup2' => 178,
277  'sup3' => 179,
278  'supe' => 8839,
279  'szlig' => 223,
280  'Tau' => 932,
281  'tau' => 964,
282  'there4' => 8756,
283  'Theta' => 920,
284  'theta' => 952,
285  'thetasym' => 977,
286  'thinsp' => 8201,
287  'THORN' => 222,
288  'thorn' => 254,
289  'tilde' => 732,
290  'times' => 215,
291  'trade' => 8482,
292  'Uacute' => 218,
293  'uacute' => 250,
294  'uarr' => 8593,
295  'uArr' => 8657,
296  'Ucirc' => 219,
297  'ucirc' => 251,
298  'Ugrave' => 217,
299  'ugrave' => 249,
300  'uml' => 168,
301  'upsih' => 978,
302  'Upsilon' => 933,
303  'upsilon' => 965,
304  'Uuml' => 220,
305  'uuml' => 252,
306  'weierp' => 8472,
307  'Xi' => 926,
308  'xi' => 958,
309  'Yacute' => 221,
310  'yacute' => 253,
311  'yen' => 165,
312  'Yuml' => 376,
313  'yuml' => 255,
314  'Zeta' => 918,
315  'zeta' => 950,
316  'zwj' => 8205,
317  'zwnj' => 8204
318  ];
319 
323  private static $htmlEntityAliases = [
324  'רלמ' => 'rlm',
325  'رلم' => 'rlm',
326  ];
327 
331  private static $attribsRegex;
332 
340  static function getAttribsRegex() {
341  if ( self::$attribsRegex === null ) {
342  $attribFirst = '[:A-Z_a-z0-9]';
343  $attrib = '[:A-Z_a-z-.0-9]';
344  $space = '[\x09\x0a\x0c\x0d\x20]';
345  self::$attribsRegex =
346  "/(?:^|$space)({$attribFirst}{$attrib}*)
347  ($space*=$space*
348  (?:
349  # The attribute value: quoted or alone
350  \"([^\"]*)(?:\"|\$)
351  | '([^']*)(?:'|\$)
352  | (((?!$space|>).)*)
353  )
354  )?(?=$space|\$)/sx";
355  }
356  return self::$attribsRegex;
357  }
358 
365  public static function getRecognizedTagData( $extratags = [], $removetags = [] ) {
367 
368  static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
369  $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
370 
371  // Base our staticInitialised variable off of the global config state so that if the globals
372  // are changed (like in the screwed up test system) we will re-initialise the settings.
373  $globalContext = $wgAllowImageTag;
374  if ( !$staticInitialised || $staticInitialised != $globalContext ) {
375  $htmlpairsStatic = [ # Tags that must be closed
376  'b', 'bdi', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
377  'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
378  'strike', 'strong', 'tt', 'var', 'div', 'center',
379  'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
380  'ruby', 'rb', 'rp', 'rt', 'rtc', 'p', 'span', 'abbr', 'dfn',
381  'kbd', 'samp', 'data', 'time', 'mark'
382  ];
383  $htmlsingle = [
384  'br', 'wbr', 'hr', 'li', 'dt', 'dd', 'meta', 'link'
385  ];
386 
387  # Elements that cannot have close tags. This is (not coincidentally)
388  # also the list of tags for which the HTML 5 parsing algorithm
389  # requires you to "acknowledge the token's self-closing flag", i.e.
390  # a self-closing tag like <br/> is not an HTML 5 parse error only
391  # for this list.
392  $htmlsingleonly = [
393  'br', 'wbr', 'hr', 'meta', 'link'
394  ];
395 
396  $htmlnest = [ # Tags that can be nested--??
397  'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
398  'li', 'dl', 'dt', 'dd', 'font', 'big', 'small', 'sub', 'sup', 'span',
399  'var', 'kbd', 'samp', 'em', 'strong', 'q', 'ruby', 'bdo'
400  ];
401  $tabletags = [ # Can only appear inside table, we will close them
402  'td', 'th', 'tr',
403  ];
404  $htmllist = [ # Tags used by list
405  'ul', 'ol',
406  ];
407  $listtags = [ # Tags that can appear in a list
408  'li',
409  ];
410 
411  if ( $wgAllowImageTag ) {
412  $htmlsingle[] = 'img';
413  $htmlsingleonly[] = 'img';
414  }
415 
416  $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
417  $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
418 
419  # Convert them all to hashtables for faster lookup
420  $vars = [ 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
421  'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' ];
422  foreach ( $vars as $var ) {
423  $$var = array_flip( $$var );
424  }
425  $staticInitialised = $globalContext;
426  }
427 
428  # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
429  $extratags = array_flip( $extratags );
430  $removetags = array_flip( $removetags );
431  $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
432  $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ), $removetags );
433 
434  return [
435  'htmlpairs' => $htmlpairs,
436  'htmlsingle' => $htmlsingle,
437  'htmlsingleonly' => $htmlsingleonly,
438  'htmlnest' => $htmlnest,
439  'tabletags' => $tabletags,
440  'htmllist' => $htmllist,
441  'listtags' => $listtags,
442  'htmlsingleallowed' => $htmlsingleallowed,
443  'htmlelements' => $htmlelements,
444  ];
445  }
446 
462  public static function removeHTMLtags( $text, $processCallback = null,
463  $args = [], $extratags = [], $removetags = [], $warnCallback = null
464  ) {
465  extract( self::getRecognizedTagData( $extratags, $removetags ) );
466 
467  # Remove HTML comments
468  $text = Sanitizer::removeHTMLcomments( $text );
469  $bits = explode( '<', $text );
470  $text = str_replace( '>', '&gt;', array_shift( $bits ) );
471  if ( !MWTidy::isEnabled() ) {
472  $tagstack = $tablestack = [];
473  foreach ( $bits as $x ) {
474  $regs = [];
475  # $slash: Does the current element start with a '/'?
476  # $t: Current element name
477  # $params: String between element name and >
478  # $brace: Ending '>' or '/>'
479  # $rest: Everything until the next element of $bits
480  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
481  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
482  } else {
483  $slash = $t = $params = $brace = $rest = null;
484  }
485 
486  $badtag = false;
487  $t = strtolower( $t );
488  if ( isset( $htmlelements[$t] ) ) {
489  # Check our stack
490  if ( $slash && isset( $htmlsingleonly[$t] ) ) {
491  $badtag = true;
492  } elseif ( $slash ) {
493  # Closing a tag... is it the one we just opened?
494  MediaWiki\suppressWarnings();
495  $ot = array_pop( $tagstack );
496  MediaWiki\restoreWarnings();
497 
498  if ( $ot != $t ) {
499  if ( isset( $htmlsingleallowed[$ot] ) ) {
500  # Pop all elements with an optional close tag
501  # and see if we find a match below them
502  $optstack = [];
503  array_push( $optstack, $ot );
504  MediaWiki\suppressWarnings();
505  $ot = array_pop( $tagstack );
506  MediaWiki\restoreWarnings();
507  while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
508  array_push( $optstack, $ot );
509  MediaWiki\suppressWarnings();
510  $ot = array_pop( $tagstack );
511  MediaWiki\restoreWarnings();
512  }
513  if ( $t != $ot ) {
514  # No match. Push the optional elements back again
515  $badtag = true;
516  MediaWiki\suppressWarnings();
517  $ot = array_pop( $optstack );
518  MediaWiki\restoreWarnings();
519  while ( $ot ) {
520  array_push( $tagstack, $ot );
521  MediaWiki\suppressWarnings();
522  $ot = array_pop( $optstack );
523  MediaWiki\restoreWarnings();
524  }
525  }
526  } else {
527  MediaWiki\suppressWarnings();
528  array_push( $tagstack, $ot );
529  MediaWiki\restoreWarnings();
530 
531  # <li> can be nested in <ul> or <ol>, skip those cases:
532  if ( !isset( $htmllist[$ot] ) || !isset( $listtags[$t] ) ) {
533  $badtag = true;
534  }
535  }
536  } else {
537  if ( $t == 'table' ) {
538  $tagstack = array_pop( $tablestack );
539  }
540  }
541  $newparams = '';
542  } else {
543  # Keep track for later
544  if ( isset( $tabletags[$t] ) && !in_array( 'table', $tagstack ) ) {
545  $badtag = true;
546  } elseif ( in_array( $t, $tagstack ) && !isset( $htmlnest[$t] ) ) {
547  $badtag = true;
548  #  Is it a self closed htmlpair ? (bug 5487)
549  } elseif ( $brace == '/>' && isset( $htmlpairs[$t] ) ) {
550  // Eventually we'll just remove the self-closing
551  // slash, in order to be consistent with HTML5
552  // semantics.
553  // $brace = '>';
554  // For now, let's just warn authors to clean up.
555  if ( is_callable( $warnCallback ) ) {
556  call_user_func_array( $warnCallback, [ 'deprecated-self-close-category' ] );
557  }
558  $badtag = true;
559  } elseif ( isset( $htmlsingleonly[$t] ) ) {
560  # Hack to force empty tag for unclosable elements
561  $brace = '/>';
562  } elseif ( isset( $htmlsingle[$t] ) ) {
563  # Hack to not close $htmlsingle tags
564  $brace = null;
565  # Still need to push this optionally-closed tag to
566  # the tag stack so that we can match end tags
567  # instead of marking them as bad.
568  array_push( $tagstack, $t );
569  } elseif ( isset( $tabletags[$t] ) && in_array( $t, $tagstack ) ) {
570  // New table tag but forgot to close the previous one
571  $text .= "</$t>";
572  } else {
573  if ( $t == 'table' ) {
574  array_push( $tablestack, $tagstack );
575  $tagstack = [];
576  }
577  array_push( $tagstack, $t );
578  }
579 
580  # Replace any variables or template parameters with
581  # plaintext results.
582  if ( is_callable( $processCallback ) ) {
583  call_user_func_array( $processCallback, [ &$params, $args ] );
584  }
585 
586  if ( !Sanitizer::validateTag( $params, $t ) ) {
587  $badtag = true;
588  }
589 
590  # Strip non-approved attributes from the tag
591  $newparams = Sanitizer::fixTagAttributes( $params, $t );
592  }
593  if ( !$badtag ) {
594  $rest = str_replace( '>', '&gt;', $rest );
595  $close = ( $brace == '/>' && !$slash ) ? ' /' : '';
596  $text .= "<$slash$t$newparams$close>$rest";
597  continue;
598  }
599  }
600  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
601  }
602  # Close off any remaining tags
603  while ( is_array( $tagstack ) && ( $t = array_pop( $tagstack ) ) ) {
604  $text .= "</$t>\n";
605  if ( $t == 'table' ) {
606  $tagstack = array_pop( $tablestack );
607  }
608  }
609  } else {
610  # this might be possible using tidy itself
611  foreach ( $bits as $x ) {
612  if ( preg_match( self::ELEMENT_BITS_REGEX, $x, $regs ) ) {
613  list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
614 
615  $badtag = false;
616  $t = strtolower( $t );
617  if ( isset( $htmlelements[$t] ) ) {
618  if ( is_callable( $processCallback ) ) {
619  call_user_func_array( $processCallback, [ &$params, $args ] );
620  }
621 
622  if ( $brace == '/>' && !( isset( $htmlsingle[$t] ) || isset( $htmlsingleonly[$t] ) ) ) {
623  // Eventually we'll just remove the self-closing
624  // slash, in order to be consistent with HTML5
625  // semantics.
626  // $brace = '>';
627  // For now, let's just warn authors to clean up.
628  if ( is_callable( $warnCallback ) ) {
629  call_user_func_array( $warnCallback, [ 'deprecated-self-close-category' ] );
630  }
631  }
632  if ( !Sanitizer::validateTag( $params, $t ) ) {
633  $badtag = true;
634  }
635 
636  $newparams = Sanitizer::fixTagAttributes( $params, $t );
637  if ( !$badtag ) {
638  if ( $brace === '/>' && !isset( $htmlsingleonly[$t] ) ) {
639  # Interpret self-closing tags as empty tags even when
640  # HTML 5 would interpret them as start tags. Such input
641  # is commonly seen on Wikimedia wikis with this intention.
642  $brace = "></$t>";
643  }
644 
645  $rest = str_replace( '>', '&gt;', $rest );
646  $text .= "<$slash$t$newparams$brace$rest";
647  continue;
648  }
649  }
650  }
651  $text .= '&lt;' . str_replace( '>', '&gt;', $x );
652  }
653  }
654  return $text;
655  }
656 
666  public static function removeHTMLcomments( $text ) {
667  while ( ( $start = strpos( $text, '<!--' ) ) !== false ) {
668  $end = strpos( $text, '-->', $start + 4 );
669  if ( $end === false ) {
670  # Unterminated comment; bail out
671  break;
672  }
673 
674  $end += 3;
675 
676  # Trim space and newline if the comment is both
677  # preceded and followed by a newline
678  $spaceStart = max( $start - 1, 0 );
679  $spaceLen = $end - $spaceStart;
680  while ( substr( $text, $spaceStart, 1 ) === ' ' && $spaceStart > 0 ) {
681  $spaceStart--;
682  $spaceLen++;
683  }
684  while ( substr( $text, $spaceStart + $spaceLen, 1 ) === ' ' ) {
685  $spaceLen++;
686  }
687  if ( substr( $text, $spaceStart, 1 ) === "\n"
688  && substr( $text, $spaceStart + $spaceLen, 1 ) === "\n" ) {
689  # Remove the comment, leading and trailing
690  # spaces, and leave only one newline.
691  $text = substr_replace( $text, "\n", $spaceStart, $spaceLen + 1 );
692  } else {
693  # Remove just the comment.
694  $text = substr_replace( $text, '', $start, $end - $start );
695  }
696  }
697  return $text;
698  }
699 
712  static function validateTag( $params, $element ) {
714 
715  if ( $element == 'meta' || $element == 'link' ) {
716  if ( !isset( $params['itemprop'] ) ) {
717  // <meta> and <link> must have an itemprop="" otherwise they are not valid or safe in content
718  return false;
719  }
720  if ( $element == 'meta' && !isset( $params['content'] ) ) {
721  // <meta> must have a content="" for the itemprop
722  return false;
723  }
724  if ( $element == 'link' && !isset( $params['href'] ) ) {
725  // <link> must have an associated href=""
726  return false;
727  }
728  }
729 
730  return true;
731  }
732 
748  static function validateTagAttributes( $attribs, $element ) {
750  Sanitizer::attributeWhitelist( $element ) );
751  }
752 
768  static function validateAttributes( $attribs, $whitelist ) {
769  $whitelist = array_flip( $whitelist );
770  $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
771 
772  $out = [];
773  foreach ( $attribs as $attribute => $value ) {
774  # Allow XML namespace declaration to allow RDFa
775  if ( preg_match( self::XMLNS_ATTRIBUTE_PATTERN, $attribute ) ) {
776  if ( !preg_match( self::EVIL_URI_PATTERN, $value ) ) {
777  $out[$attribute] = $value;
778  }
779 
780  continue;
781  }
782 
783  # Allow any attribute beginning with "data-"
784  # However:
785  # * data-ooui is reserved for ooui
786  # * data-mw and data-parsoid are reserved for parsoid
787  # * data-mw-<name here> is reserved for extensions (or core) if
788  # they need to communicate some data to the client and want to be
789  # sure that it isn't coming from an untrusted user.
790  # * Ensure that the attribute is not namespaced by banning
791  # colons.
792  if ( !preg_match( '/^data-(?!ooui|mw|parsoid)[^:]*$/i', $attribute )
793  && !isset( $whitelist[$attribute] )
794  ) {
795  continue;
796  }
797 
798  # Strip javascript "expression" from stylesheets.
799  # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
800  if ( $attribute == 'style' ) {
802  }
803 
804  # Escape HTML id attributes
805  if ( $attribute === 'id' ) {
806  $value = Sanitizer::escapeId( $value, 'noninitial' );
807  }
808 
809  # Escape HTML id reference lists
810  if ( $attribute === 'aria-describedby'
811  || $attribute === 'aria-flowto'
812  || $attribute === 'aria-labelledby'
813  || $attribute === 'aria-owns'
814  ) {
816  }
817 
818  // RDFa and microdata properties allow URLs, URIs and/or CURIs.
819  // Check them for sanity.
820  if ( $attribute === 'rel' || $attribute === 'rev'
821  # RDFa
822  || $attribute === 'about' || $attribute === 'property'
823  || $attribute === 'resource' || $attribute === 'datatype'
824  || $attribute === 'typeof'
825  # HTML5 microdata
826  || $attribute === 'itemid' || $attribute === 'itemprop'
827  || $attribute === 'itemref' || $attribute === 'itemscope'
828  || $attribute === 'itemtype'
829  ) {
830  // Paranoia. Allow "simple" values but suppress javascript
831  if ( preg_match( self::EVIL_URI_PATTERN, $value ) ) {
832  continue;
833  }
834  }
835 
836  # NOTE: even though elements using href/src are not allowed directly, supply
837  # validation code that can be used by tag hook handlers, etc
838  if ( $attribute === 'href' || $attribute === 'src' ) {
839  if ( !preg_match( $hrefExp, $value ) ) {
840  continue; // drop any href or src attributes not using an allowed protocol.
841  // NOTE: this also drops all relative URLs
842  }
843  }
844 
845  // If this attribute was previously set, override it.
846  // Output should only have one attribute of each name.
847  $out[$attribute] = $value;
848  }
849 
850  # itemtype, itemid, itemref don't make sense without itemscope
851  if ( !array_key_exists( 'itemscope', $out ) ) {
852  unset( $out['itemtype'] );
853  unset( $out['itemid'] );
854  unset( $out['itemref'] );
855  }
856  # TODO: Strip itemprop if we aren't descendants of an itemscope or pointed to by an itemref.
857 
858  return $out;
859  }
860 
871  static function mergeAttributes( $a, $b ) {
872  $out = array_merge( $a, $b );
873  if ( isset( $a['class'] ) && isset( $b['class'] )
874  && is_string( $a['class'] ) && is_string( $b['class'] )
875  && $a['class'] !== $b['class']
876  ) {
877  $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
878  -1, PREG_SPLIT_NO_EMPTY );
879  $out['class'] = implode( ' ', array_unique( $classes ) );
880  }
881  return $out;
882  }
883 
893  public static function normalizeCss( $value ) {
894 
895  // Decode character references like &#123;
897 
898  // Decode escape sequences and line continuation
899  // See the grammar in the CSS 2 spec, appendix D.
900  // This has to be done AFTER decoding character references.
901  // This means it isn't possible for this function to return
902  // unsanitized escape sequences. It is possible to manufacture
903  // input that contains character references that decode to
904  // escape sequences that decode to character references, but
905  // it's OK for the return value to contain character references
906  // because the caller is supposed to escape those anyway.
907  static $decodeRegex;
908  if ( !$decodeRegex ) {
909  $space = '[\\x20\\t\\r\\n\\f]';
910  $nl = '(?:\\n|\\r\\n|\\r|\\f)';
911  $backslash = '\\\\';
912  $decodeRegex = "/ $backslash
913  (?:
914  ($nl) | # 1. Line continuation
915  ([0-9A-Fa-f]{1,6})$space? | # 2. character number
916  (.) | # 3. backslash cancelling special meaning
917  () | # 4. backslash at end of string
918  )/xu";
919  }
920  $value = preg_replace_callback( $decodeRegex,
921  [ __CLASS__, 'cssDecodeCallback' ], $value );
922 
923  // Normalize Halfwidth and Fullwidth Unicode block that IE6 might treat as ascii
924  $value = preg_replace_callback(
925  '/[!-[]-z]/u', // U+FF01 to U+FF5A, excluding U+FF3C (bug 58088)
926  function ( $matches ) {
928  if ( $cp === false ) {
929  return '';
930  }
931  return chr( $cp - 65248 ); // ASCII range \x21-\x7A
932  },
933  $value
934  );
935 
936  // Convert more characters IE6 might treat as ascii
937  // U+0280, U+0274, U+207F, U+029F, U+026A, U+207D, U+208D
938  $value = str_replace(
939  [ 'ʀ', 'ɴ', 'ⁿ', 'ʟ', 'ɪ', '⁽', '₍' ],
940  [ 'r', 'n', 'n', 'l', 'i', '(', '(' ],
941  $value
942  );
943 
944  // Let the value through if it's nothing but a single comment, to
945  // allow other functions which may reject it to pass some error
946  // message through.
947  if ( !preg_match( '! ^ \s* /\* [^*\\/]* \*/ \s* $ !x', $value ) ) {
948  // Remove any comments; IE gets token splitting wrong
949  // This must be done AFTER decoding character references and
950  // escape sequences, because those steps can introduce comments
951  // This step cannot introduce character references or escape
952  // sequences, because it replaces comments with spaces rather
953  // than removing them completely.
954  $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value );
955 
956  // Remove anything after a comment-start token, to guard against
957  // incorrect client implementations.
958  $commentPos = strpos( $value, '/*' );
959  if ( $commentPos !== false ) {
960  $value = substr( $value, 0, $commentPos );
961  }
962  }
963 
964  // S followed by repeat, iteration, or prolonged sound marks,
965  // which IE will treat as "ss"
966  $value = preg_replace(
967  '/s(?:
968  \xE3\x80\xB1 | # U+3031
969  \xE3\x82\x9D | # U+309D
970  \xE3\x83\xBC | # U+30FC
971  \xE3\x83\xBD | # U+30FD
972  \xEF\xB9\xBC | # U+FE7C
973  \xEF\xB9\xBD | # U+FE7D
974  \xEF\xBD\xB0 # U+FF70
975  )/ix',
976  'ss',
977  $value
978  );
979 
980  return $value;
981  }
982 
1001  static function checkCss( $value ) {
1002  $value = self::normalizeCss( $value );
1003 
1004  // Reject problematic keywords and control characters
1005  if ( preg_match( '/[\000-\010\013\016-\037\177]/', $value ) ||
1006  strpos( $value, UtfNormal\Constants::UTF8_REPLACEMENT ) !== false ) {
1007  return '/* invalid control char */';
1008  } elseif ( preg_match(
1009  '! expression
1010  | filter\s*:
1011  | accelerator\s*:
1012  | -o-link\s*:
1013  | -o-link-source\s*:
1014  | -o-replace\s*:
1015  | url\s*\(
1016  | image\s*\(
1017  | image-set\s*\(
1018  !ix', $value ) ) {
1019  return '/* insecure input */';
1020  }
1021  return $value;
1022  }
1023 
1028  static function cssDecodeCallback( $matches ) {
1029  if ( $matches[1] !== '' ) {
1030  // Line continuation
1031  return '';
1032  } elseif ( $matches[2] !== '' ) {
1033  $char = UtfNormal\Utils::codepointToUtf8( hexdec( $matches[2] ) );
1034  } elseif ( $matches[3] !== '' ) {
1035  $char = $matches[3];
1036  } else {
1037  $char = '\\';
1038  }
1039  if ( $char == "\n" || $char == '"' || $char == "'" || $char == '\\' ) {
1040  // These characters need to be escaped in strings
1041  // Clean up the escape sequence to avoid parsing errors by clients
1042  return '\\' . dechex( ord( $char ) ) . ' ';
1043  } else {
1044  // Decode unnecessary escape
1045  return $char;
1046  }
1047  }
1048 
1070  static function fixTagAttributes( $text, $element, $sorted = false ) {
1071  if ( trim( $text ) == '' ) {
1072  return '';
1073  }
1074 
1075  $decoded = Sanitizer::decodeTagAttributes( $text );
1076  $stripped = Sanitizer::validateTagAttributes( $decoded, $element );
1077 
1078  if ( $sorted ) {
1079  ksort( $stripped );
1080  }
1081 
1082  return Sanitizer::safeEncodeTagAttributes( $stripped );
1083  }
1084 
1090  static function encodeAttribute( $text ) {
1091  $encValue = htmlspecialchars( $text, ENT_QUOTES );
1092 
1093  // Whitespace is normalized during attribute decoding,
1094  // so if we've been passed non-spaces we must encode them
1095  // ahead of time or they won't be preserved.
1096  $encValue = strtr( $encValue, [
1097  "\n" => '&#10;',
1098  "\r" => '&#13;',
1099  "\t" => '&#9;',
1100  ] );
1101 
1102  return $encValue;
1103  }
1104 
1111  static function safeEncodeAttribute( $text ) {
1112  $encValue = Sanitizer::encodeAttribute( $text );
1113 
1114  # Templates and links may be expanded in later parsing,
1115  # creating invalid or dangerous output. Suppress this.
1116  $encValue = strtr( $encValue, [
1117  '<' => '&lt;', // This should never happen,
1118  '>' => '&gt;', // we've received invalid input
1119  '"' => '&quot;', // which should have been escaped.
1120  '{' => '&#123;',
1121  '[' => '&#91;',
1122  "''" => '&#39;&#39;',
1123  'ISBN' => '&#73;SBN',
1124  'RFC' => '&#82;FC',
1125  'PMID' => '&#80;MID',
1126  '|' => '&#124;',
1127  '__' => '&#95;_',
1128  ] );
1129 
1130  # Stupid hack
1131  $encValue = preg_replace_callback(
1132  '/((?i)' . wfUrlProtocols() . ')/',
1133  [ 'Sanitizer', 'armorLinksCallback' ],
1134  $encValue );
1135  return $encValue;
1136  }
1137 
1169  static function escapeId( $id, $options = [] ) {
1171  $options = (array)$options;
1172 
1173  $id = Sanitizer::decodeCharReferences( $id );
1174 
1175  if ( $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) {
1176  $id = preg_replace( '/[ \t\n\r\f_\'"&#%]+/', '_', $id );
1177  $id = trim( $id, '_' );
1178  if ( $id === '' ) {
1179  // Must have been all whitespace to start with.
1180  return '_';
1181  } else {
1182  return $id;
1183  }
1184  }
1185 
1186  // HTML4-style escaping
1187  static $replace = [
1188  '%3A' => ':',
1189  '%' => '.'
1190  ];
1191 
1192  $id = urlencode( strtr( $id, ' ', '_' ) );
1193  $id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
1194 
1195  if ( !preg_match( '/^[a-zA-Z]/', $id ) && !in_array( 'noninitial', $options ) ) {
1196  // Initial character must be a letter!
1197  $id = "x$id";
1198  }
1199  return $id;
1200  }
1201 
1219  static function escapeIdReferenceList( $referenceString, $options = [] ) {
1220  # Explode the space delimited list string into an array of tokens
1221  $references = preg_split( '/\s+/', "{$referenceString}", -1, PREG_SPLIT_NO_EMPTY );
1222 
1223  # Escape each token as an id
1224  foreach ( $references as &$ref ) {
1225  $ref = Sanitizer::escapeId( $ref, $options );
1226  }
1227 
1228  # Merge the array back to a space delimited list string
1229  # If the array is empty, the result will be an empty string ('')
1230  $referenceString = implode( ' ', $references );
1231 
1232  return $referenceString;
1233  }
1234 
1246  static function escapeClass( $class ) {
1247  // Convert ugly stuff to underscores and kill underscores in ugly places
1248  return rtrim( preg_replace(
1249  [ '/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/', '/_+/' ],
1250  '_',
1251  $class ), '_' );
1252  }
1253 
1261  static function escapeHtmlAllowEntities( $html ) {
1263  # It seems wise to escape ' as well as ", as a matter of course. Can't
1264  # hurt.
1265  $html = htmlspecialchars( $html, ENT_QUOTES );
1266  return $html;
1267  }
1268 
1274  private static function armorLinksCallback( $matches ) {
1275  return str_replace( ':', '&#58;', $matches[1] );
1276  }
1277 
1286  public static function decodeTagAttributes( $text ) {
1287  if ( trim( $text ) == '' ) {
1288  return [];
1289  }
1290 
1291  $attribs = [];
1292  $pairs = [];
1293  if ( !preg_match_all(
1294  self::getAttribsRegex(),
1295  $text,
1296  $pairs,
1297  PREG_SET_ORDER ) ) {
1298  return $attribs;
1299  }
1300 
1301  foreach ( $pairs as $set ) {
1302  $attribute = strtolower( $set[1] );
1304 
1305  // Normalize whitespace
1306  $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1307  $value = trim( $value );
1308 
1309  // Decode character references
1311  }
1312  return $attribs;
1313  }
1314 
1322  public static function safeEncodeTagAttributes( $assoc_array ) {
1323  $attribs = [];
1324  foreach ( $assoc_array as $attribute => $value ) {
1325  $encAttribute = htmlspecialchars( $attribute );
1326  $encValue = Sanitizer::safeEncodeAttribute( $value );
1327 
1328  $attribs[] = "$encAttribute=\"$encValue\"";
1329  }
1330  return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : '';
1331  }
1332 
1341  private static function getTagAttributeCallback( $set ) {
1342  if ( isset( $set[5] ) ) {
1343  # No quotes.
1344  return $set[5];
1345  } elseif ( isset( $set[4] ) ) {
1346  # Single-quoted
1347  return $set[4];
1348  } elseif ( isset( $set[3] ) ) {
1349  # Double-quoted
1350  return $set[3];
1351  } elseif ( !isset( $set[2] ) ) {
1352  # In XHTML, attributes must have a value so return an empty string.
1353  # See "Empty attribute syntax",
1354  # http://www.w3.org/TR/html5/syntax.html#syntax-attribute-name
1355  return "";
1356  } else {
1357  throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1358  }
1359  }
1360 
1365  private static function normalizeWhitespace( $text ) {
1366  return preg_replace(
1367  '/\r\n|[\x20\x0d\x0a\x09]/',
1368  ' ',
1369  $text );
1370  }
1371 
1381  return trim( preg_replace( '/[ _]+/', ' ', $section ) );
1382  }
1383 
1399  static function normalizeCharReferences( $text ) {
1400  return preg_replace_callback(
1401  self::CHAR_REFS_REGEX,
1402  [ 'Sanitizer', 'normalizeCharReferencesCallback' ],
1403  $text );
1404  }
1405 
1411  $ret = null;
1412  if ( $matches[1] != '' ) {
1414  } elseif ( $matches[2] != '' ) {
1416  } elseif ( $matches[3] != '' ) {
1418  }
1419  if ( is_null( $ret ) ) {
1420  return htmlspecialchars( $matches[0] );
1421  } else {
1422  return $ret;
1423  }
1424  }
1425 
1436  static function normalizeEntity( $name ) {
1437  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1438  return '&' . self::$htmlEntityAliases[$name] . ';';
1439  } elseif ( in_array( $name, [ 'lt', 'gt', 'amp', 'quot' ] ) ) {
1440  return "&$name;";
1441  } elseif ( isset( self::$htmlEntities[$name] ) ) {
1442  return '&#' . self::$htmlEntities[$name] . ';';
1443  } else {
1444  return "&amp;$name;";
1445  }
1446  }
1447 
1452  static function decCharReference( $codepoint ) {
1453  $point = intval( $codepoint );
1454  if ( Sanitizer::validateCodepoint( $point ) ) {
1455  return sprintf( '&#%d;', $point );
1456  } else {
1457  return null;
1458  }
1459  }
1460 
1465  static function hexCharReference( $codepoint ) {
1466  $point = hexdec( $codepoint );
1467  if ( Sanitizer::validateCodepoint( $point ) ) {
1468  return sprintf( '&#x%x;', $point );
1469  } else {
1470  return null;
1471  }
1472  }
1473 
1480  private static function validateCodepoint( $codepoint ) {
1481  # U+000C is valid in HTML5 but not allowed in XML.
1482  # U+000D is valid in XML but not allowed in HTML5.
1483  # U+007F - U+009F are disallowed in HTML5 (control characters).
1484  return $codepoint == 0x09
1485  || $codepoint == 0x0a
1486  || ( $codepoint >= 0x20 && $codepoint <= 0x7e )
1487  || ( $codepoint >= 0xa0 && $codepoint <= 0xd7ff )
1488  || ( $codepoint >= 0xe000 && $codepoint <= 0xfffd )
1489  || ( $codepoint >= 0x10000 && $codepoint <= 0x10ffff );
1490  }
1491 
1499  public static function decodeCharReferences( $text ) {
1500  return preg_replace_callback(
1501  self::CHAR_REFS_REGEX,
1502  [ 'Sanitizer', 'decodeCharReferencesCallback' ],
1503  $text );
1504  }
1505 
1516  public static function decodeCharReferencesAndNormalize( $text ) {
1518  $text = preg_replace_callback(
1519  self::CHAR_REFS_REGEX,
1520  [ 'Sanitizer', 'decodeCharReferencesCallback' ],
1521  $text, /* limit */ -1, $count );
1522 
1523  if ( $count ) {
1524  return $wgContLang->normalize( $text );
1525  } else {
1526  return $text;
1527  }
1528  }
1529 
1535  if ( $matches[1] != '' ) {
1536  return Sanitizer::decodeEntity( $matches[1] );
1537  } elseif ( $matches[2] != '' ) {
1538  return Sanitizer::decodeChar( intval( $matches[2] ) );
1539  } elseif ( $matches[3] != '' ) {
1540  return Sanitizer::decodeChar( hexdec( $matches[3] ) );
1541  }
1542  # Last case should be an ampersand by itself
1543  return $matches[0];
1544  }
1545 
1553  static function decodeChar( $codepoint ) {
1554  if ( Sanitizer::validateCodepoint( $codepoint ) ) {
1555  return UtfNormal\Utils::codepointToUtf8( $codepoint );
1556  } else {
1558  }
1559  }
1560 
1569  static function decodeEntity( $name ) {
1570  if ( isset( self::$htmlEntityAliases[$name] ) ) {
1571  $name = self::$htmlEntityAliases[$name];
1572  }
1573  if ( isset( self::$htmlEntities[$name] ) ) {
1574  return UtfNormal\Utils::codepointToUtf8( self::$htmlEntities[$name] );
1575  } else {
1576  return "&$name;";
1577  }
1578  }
1579 
1586  static function attributeWhitelist( $element ) {
1588  return isset( $list[$element] )
1589  ? $list[$element]
1590  : [];
1591  }
1592 
1598  static function setupAttributeWhitelist() {
1599  static $whitelist;
1600 
1601  if ( $whitelist !== null ) {
1602  return $whitelist;
1603  }
1604 
1605  $common = [
1606  # HTML
1607  'id',
1608  'class',
1609  'style',
1610  'lang',
1611  'dir',
1612  'title',
1613 
1614  # WAI-ARIA
1615  'aria-describedby',
1616  'aria-flowto',
1617  'aria-label',
1618  'aria-labelledby',
1619  'aria-owns',
1620  'role',
1621 
1622  # RDFa
1623  # These attributes are specified in section 9 of
1624  # http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1625  'about',
1626  'property',
1627  'resource',
1628  'datatype',
1629  'typeof',
1630 
1631  # Microdata. These are specified by
1632  # http://www.whatwg.org/html/microdata.html#the-microdata-model
1633  'itemid',
1634  'itemprop',
1635  'itemref',
1636  'itemscope',
1637  'itemtype',
1638  ];
1639 
1640  $block = array_merge( $common, [ 'align' ] );
1641  $tablealign = [ 'align', 'valign' ];
1642  $tablecell = [
1643  'abbr',
1644  'axis',
1645  'headers',
1646  'scope',
1647  'rowspan',
1648  'colspan',
1649  'nowrap', # deprecated
1650  'width', # deprecated
1651  'height', # deprecated
1652  'bgcolor', # deprecated
1653  ];
1654 
1655  # Numbers refer to sections in HTML 4.01 standard describing the element.
1656  # See: http://www.w3.org/TR/html4/
1657  $whitelist = [
1658  # 7.5.4
1659  'div' => $block,
1660  'center' => $common, # deprecated
1661  'span' => $common,
1662 
1663  # 7.5.5
1664  'h1' => $block,
1665  'h2' => $block,
1666  'h3' => $block,
1667  'h4' => $block,
1668  'h5' => $block,
1669  'h6' => $block,
1670 
1671  # 7.5.6
1672  # address
1673 
1674  # 8.2.4
1675  'bdo' => $common,
1676 
1677  # 9.2.1
1678  'em' => $common,
1679  'strong' => $common,
1680  'cite' => $common,
1681  'dfn' => $common,
1682  'code' => $common,
1683  'samp' => $common,
1684  'kbd' => $common,
1685  'var' => $common,
1686  'abbr' => $common,
1687  # acronym
1688 
1689  # 9.2.2
1690  'blockquote' => array_merge( $common, [ 'cite' ] ),
1691  'q' => array_merge( $common, [ 'cite' ] ),
1692 
1693  # 9.2.3
1694  'sub' => $common,
1695  'sup' => $common,
1696 
1697  # 9.3.1
1698  'p' => $block,
1699 
1700  # 9.3.2
1701  'br' => array_merge( $common, [ 'clear' ] ),
1702 
1703  # http://www.whatwg.org/html/text-level-semantics.html#the-wbr-element
1704  'wbr' => $common,
1705 
1706  # 9.3.4
1707  'pre' => array_merge( $common, [ 'width' ] ),
1708 
1709  # 9.4
1710  'ins' => array_merge( $common, [ 'cite', 'datetime' ] ),
1711  'del' => array_merge( $common, [ 'cite', 'datetime' ] ),
1712 
1713  # 10.2
1714  'ul' => array_merge( $common, [ 'type' ] ),
1715  'ol' => array_merge( $common, [ 'type', 'start', 'reversed' ] ),
1716  'li' => array_merge( $common, [ 'type', 'value' ] ),
1717 
1718  # 10.3
1719  'dl' => $common,
1720  'dd' => $common,
1721  'dt' => $common,
1722 
1723  # 11.2.1
1724  'table' => array_merge( $common,
1725  [ 'summary', 'width', 'border', 'frame',
1726  'rules', 'cellspacing', 'cellpadding',
1727  'align', 'bgcolor',
1728  ] ),
1729 
1730  # 11.2.2
1731  'caption' => $block,
1732 
1733  # 11.2.3
1734  'thead' => $common,
1735  'tfoot' => $common,
1736  'tbody' => $common,
1737 
1738  # 11.2.4
1739  'colgroup' => array_merge( $common, [ 'span' ] ),
1740  'col' => array_merge( $common, [ 'span' ] ),
1741 
1742  # 11.2.5
1743  'tr' => array_merge( $common, [ 'bgcolor' ], $tablealign ),
1744 
1745  # 11.2.6
1746  'td' => array_merge( $common, $tablecell, $tablealign ),
1747  'th' => array_merge( $common, $tablecell, $tablealign ),
1748 
1749  # 12.2
1750  # NOTE: <a> is not allowed directly, but the attrib
1751  # whitelist is used from the Parser object
1752  'a' => array_merge( $common, [ 'href', 'rel', 'rev' ] ), # rel/rev esp. for RDFa
1753 
1754  # 13.2
1755  # Not usually allowed, but may be used for extension-style hooks
1756  # such as <math> when it is rasterized, or if $wgAllowImageTag is
1757  # true
1758  'img' => array_merge( $common, [ 'alt', 'src', 'width', 'height' ] ),
1759 
1760  # 15.2.1
1761  'tt' => $common,
1762  'b' => $common,
1763  'i' => $common,
1764  'big' => $common,
1765  'small' => $common,
1766  'strike' => $common,
1767  's' => $common,
1768  'u' => $common,
1769 
1770  # 15.2.2
1771  'font' => array_merge( $common, [ 'size', 'color', 'face' ] ),
1772  # basefont
1773 
1774  # 15.3
1775  'hr' => array_merge( $common, [ 'width' ] ),
1776 
1777  # HTML Ruby annotation text module, simple ruby only.
1778  # http://www.whatwg.org/html/text-level-semantics.html#the-ruby-element
1779  'ruby' => $common,
1780  # rbc
1781  'rb' => $common,
1782  'rp' => $common,
1783  'rt' => $common, # array_merge( $common, array( 'rbspan' ) ),
1784  'rtc' => $common,
1785 
1786  # MathML root element, where used for extensions
1787  # 'title' may not be 100% valid here; it's XHTML
1788  # http://www.w3.org/TR/REC-MathML/
1789  'math' => [ 'class', 'style', 'id', 'title' ],
1790 
1791  # HTML 5 section 4.6
1792  'bdi' => $common,
1793 
1794  # HTML5 elements, defined by:
1795  # http://www.whatwg.org/html/
1796  'data' => array_merge( $common, [ 'value' ] ),
1797  'time' => array_merge( $common, [ 'datetime' ] ),
1798  'mark' => $common,
1799 
1800  // meta and link are only permitted by removeHTMLtags when Microdata
1801  // is enabled so we don't bother adding a conditional to hide these
1802  // Also meta and link are only valid in WikiText as Microdata elements
1803  // (ie: validateTag rejects tags missing the attributes needed for Microdata)
1804  // So we don't bother including $common attributes that have no purpose.
1805  'meta' => [ 'itemprop', 'content' ],
1806  'link' => [ 'itemprop', 'href' ],
1807  ];
1808 
1809  return $whitelist;
1810  }
1811 
1822  static function stripAllTags( $text ) {
1823  # Actual <tags>
1824  $text = StringUtils::delimiterReplace( '<', '>', '', $text );
1825 
1826  # Normalize &entities and whitespace
1827  $text = self::decodeCharReferences( $text );
1828  $text = self::normalizeWhitespace( $text );
1829 
1830  return $text;
1831  }
1832 
1842  static function hackDocType() {
1843  $out = "<!DOCTYPE html [\n";
1844  foreach ( self::$htmlEntities as $entity => $codepoint ) {
1845  $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1846  }
1847  $out .= "]>\n";
1848  return $out;
1849  }
1850 
1855  static function cleanUrl( $url ) {
1856  # Normalize any HTML entities in input. They will be
1857  # re-escaped by makeExternalLink().
1858  $url = Sanitizer::decodeCharReferences( $url );
1859 
1860  # Escape any control characters introduced by the above step
1861  $url = preg_replace_callback( '/[\][<>"\\x00-\\x20\\x7F\|]/',
1862  [ __CLASS__, 'cleanUrlCallback' ], $url );
1863 
1864  # Validate hostname portion
1865  $matches = [];
1866  if ( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1867  list( /* $whole */, $protocol, $host, $rest ) = $matches;
1868 
1869  // Characters that will be ignored in IDNs.
1870  // http://tools.ietf.org/html/3454#section-3.1
1871  // Strip them before further processing so blacklists and such work.
1872  $strip = "/
1873  \\s| # general whitespace
1874  \xc2\xad| # 00ad SOFT HYPHEN
1875  \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1876  \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1877  \xe2\x81\xa0| # 2060 WORD JOINER
1878  \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1879  \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
1880  \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1881  \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1882  \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1883  \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1884  \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1885  [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe0f VARIATION SELECTOR-1-16
1886  /xuD";
1887 
1888  $host = preg_replace( $strip, '', $host );
1889 
1890  // IPv6 host names are bracketed with []. Url-decode these.
1891  if ( substr_compare( "//%5B", $host, 0, 5 ) === 0 &&
1892  preg_match( '!^//%5B([0-9A-Fa-f:.]+)%5D((:\d+)?)$!', $host, $matches )
1893  ) {
1894  $host = '//[' . $matches[1] . ']' . $matches[2];
1895  }
1896 
1897  // @todo FIXME: Validate hostnames here
1898 
1899  return $protocol . $host . $rest;
1900  } else {
1901  return $url;
1902  }
1903  }
1904 
1909  static function cleanUrlCallback( $matches ) {
1910  return urlencode( $matches[0] );
1911  }
1912 
1941  public static function validateEmail( $addr ) {
1942  $result = null;
1943  if ( !Hooks::run( 'isValidEmailAddr', [ $addr, &$result ] ) ) {
1944  return $result;
1945  }
1946 
1947  // Please note strings below are enclosed in brackets [], this make the
1948  // hyphen "-" a range indicator. Hence it is double backslashed below.
1949  // See bug 26948
1950  $rfc5322_atext = "a-z0-9!#$%&'*+\\-\/=?^_`{|}~";
1951  $rfc1034_ldh_str = "a-z0-9\\-";
1952 
1953  $html5_email_regexp = "/
1954  ^ # start of string
1955  [$rfc5322_atext\\.]+ # user part which is liberal :p
1956  @ # 'apostrophe'
1957  [$rfc1034_ldh_str]+ # First domain part
1958  (\\.[$rfc1034_ldh_str]+)* # Following part prefixed with a dot
1959  $ # End of string
1960  /ix"; // case Insensitive, eXtended
1961 
1962  return (bool)preg_match( $html5_email_regexp, $addr );
1963  }
1964 }
utf8ToCodepoint($char)
Determine the Unicode codepoint of a single-character UTF-8 sequence.
you don t have to do a grep find to see where the $wgReverseTitle variable is used
Definition: hooks.txt:117
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if that
Definition: deferred.txt:11
static decCharReference($codepoint)
Definition: Sanitizer.php:1452
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses & $html
Definition: hooks.txt:1816
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global list
Definition: deferred.txt:11
static decodeTagAttributes($text)
Return an associative array of attribute names and values from a partial tag string.
Definition: Sanitizer.php:1286
this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that probably a stub it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output $out
Definition: hooks.txt:776
static normalizeEntity($name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the equivalent numeric entity re...
Definition: Sanitizer.php:1436
the array() calling protocol came about after MediaWiki 1.4rc1.
static safeEncodeTagAttributes($assoc_array)
Build a partial tag string from an associative array of attribute names and values as returned by dec...
Definition: Sanitizer.php:1322
static normalizeCharReferencesCallback($matches)
Definition: Sanitizer.php:1410
static setupAttributeWhitelist()
Foreach array key (an allowed HTML element), return an array of allowed attributes.
Definition: Sanitizer.php:1598
static isEnabled()
Definition: MWTidy.php:74
static fixTagAttributes($text, $element, $sorted=false)
Take a tag soup fragment listing an HTML element's attributes and normalize it to well-formed XML...
Definition: Sanitizer.php:1070
static decodeCharReferencesCallback($matches)
Definition: Sanitizer.php:1534
static cssDecodeCallback($matches)
Definition: Sanitizer.php:1028
null for the local wiki Added in
Definition: hooks.txt:1435
$value
static escapeClass($class)
Given a value, escape it so that it can be used as a CSS class and return it.
Definition: Sanitizer.php:1246
static hackDocType()
Hack up a private DOCTYPE with HTML's standard entity declarations.
Definition: Sanitizer.php:1842
static cleanUrl($url)
Definition: Sanitizer.php:1855
static stripAllTags($text)
Take a fragment of (potentially invalid) HTML and return a version with any tags removed, encoded as plain text.
Definition: Sanitizer.php:1822
when a variable name is used in a it is silently declared as a new local masking the global
Definition: design.txt:93
const UTF8_REPLACEMENT
static hexCharReference($codepoint)
Definition: Sanitizer.php:1465
static validateTagAttributes($attribs, $element)
Take an array of attribute names and values and normalize or discard illegal values for the given ele...
Definition: Sanitizer.php:748
static normalizeWhitespace($text)
Definition: Sanitizer.php:1365
static static static $attribsRegex
Lazy-initialised attributes regex, see getAttribsRegex()
Definition: Sanitizer.php:325
The index of the header message $result[1]=The index of the body text message $result[2 through n]=Parameters passed to body text message.Please note the header message cannot receive/use parameters. 'ImportHandleLogItemXMLTag':When parsing a XML tag in a log item.Return false to stop further processing of the tag $reader:XMLReader object $logInfo:Array of information 'ImportHandlePageXMLTag':When parsing a XML tag in a page.Return false to stop further processing of the tag $reader:XMLReader object &$pageInfo:Array of information 'ImportHandleRevisionXMLTag':When parsing a XML tag in a page revision.Return false to stop further processing of the tag $reader:XMLReader object $pageInfo:Array of page information $revisionInfo:Array of revision information 'ImportHandleToplevelXMLTag':When parsing a top level XML tag.Return false to stop further processing of the tag $reader:XMLReader object 'ImportHandleUploadXMLTag':When parsing a XML tag in a file upload.Return false to stop further processing of the tag $reader:XMLReader object $revisionInfo:Array of information 'ImportLogInterwikiLink':Hook to change the interwiki link used in log entries and edit summaries for transwiki imports.&$fullInterwikiPrefix:Interwiki prefix, may contain colons.&$pageTitle:String that contains page title. 'ImportSources':Called when reading from the $wgImportSources configuration variable.Can be used to lazy-load the import sources list.&$importSources:The value of $wgImportSources.Modify as necessary.See the comment in DefaultSettings.php for the detail of how to structure this array. 'InfoAction':When building information to display on the action=info page.$context:IContextSource object &$pageInfo:Array of information 'InitializeArticleMaybeRedirect':MediaWiki check to see if title is a redirect.&$title:Title object for the current page &$request:WebRequest &$ignoreRedirect:boolean to skip redirect check &$target:Title/string of redirect target &$article:Article object 'InternalParseBeforeLinks':during Parser's internalParse method before links but after nowiki/noinclude/includeonly/onlyinclude and other processings.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InternalParseBeforeSanitize':during Parser's internalParse method just before the parser removes unwanted/dangerous HTML tags and after nowiki/noinclude/includeonly/onlyinclude and other processings.Ideal for syntax-extensions after template/parser function execution which respect nowiki and HTML-comments.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InterwikiLoadPrefix':When resolving if a given prefix is an interwiki or not.Return true without providing an interwiki to continue interwiki search.$prefix:interwiki prefix we are looking for.&$iwData:output array describing the interwiki with keys iw_url, iw_local, iw_trans and optionally iw_api and iw_wikiid. 'InvalidateEmailComplete':Called after a user's email has been invalidated successfully.$user:user(object) whose email is being invalidated 'IRCLineURL':When constructing the URL to use in an IRC notification.Callee may modify $url and $query, URL will be constructed as $url.$query &$url:URL to index.php &$query:Query string $rc:RecentChange object that triggered url generation 'IsFileCacheable':Override the result of Article::isFileCacheable()(if true) &$article:article(object) being checked 'IsTrustedProxy':Override the result of IP::isTrustedProxy() &$ip:IP being check &$result:Change this value to override the result of IP::isTrustedProxy() 'IsUploadAllowedFromUrl':Override the result of UploadFromUrl::isAllowedUrl() $url:URL used to upload from &$allowed:Boolean indicating if uploading is allowed for given URL 'isValidEmailAddr':Override the result of Sanitizer::validateEmail(), for instance to return false if the domain name doesn't match your organization.$addr:The e-mail address entered by the user &$result:Set this and return false to override the internal checks 'isValidPassword':Override the result of User::isValidPassword() $password:The password entered by the user &$result:Set this and return false to override the internal checks $user:User the password is being validated for 'Language::getMessagesFileName':$code:The language code or the language we're looking for a messages file for &$file:The messages file path, you can override this to change the location. 'LanguageGetMagic':DEPRECATED!Use $magicWords in a file listed in $wgExtensionMessagesFiles instead.Use this to define synonyms of magic words depending of the language &$magicExtensions:associative array of magic words synonyms $lang:language code(string) 'LanguageGetNamespaces':Provide custom ordering for namespaces or remove namespaces.Do not use this hook to add namespaces.Use CanonicalNamespaces for that.&$namespaces:Array of namespaces indexed by their numbers 'LanguageGetSpecialPageAliases':DEPRECATED!Use $specialPageAliases in a file listed in $wgExtensionMessagesFiles instead.Use to define aliases of special pages names depending of the language &$specialPageAliases:associative array of magic words synonyms $lang:language code(string) 'LanguageGetTranslatedLanguageNames':Provide translated language names.&$names:array of language code=> language name $code:language of the preferred translations 'LanguageLinks':Manipulate a page's language links.This is called in various places to allow extensions to define the effective language links for a page.$title:The page's Title.&$links:Associative array mapping language codes to prefixed links of the form"language:title".&$linkFlags:Associative array mapping prefixed links to arrays of flags.Currently unused, but planned to provide support for marking individual language links in the UI, e.g.for featured articles. 'LanguageSelector':Hook to change the language selector available on a page.$out:The output page.$cssClassName:CSS class name of the language selector. 'LinkBegin':DEPRECATED!Use HtmlPageLinkRendererBegin instead.Used when generating internal and interwiki links in Linker::link(), before processing starts.Return false to skip default processing and return $ret.See documentation for Linker::link() for details on the expected meanings of parameters.$skin:the Skin object $target:the Title that the link is pointing to &$html:the contents that the< a > tag should have(raw HTML) $result
Definition: hooks.txt:1814
if($line===false) $args
Definition: cdb.php:64
static decodeCharReferences($text)
Decode any character references, numeric or named entities, in the text and return a UTF-8 string...
Definition: Sanitizer.php:1499
static validateCodepoint($codepoint)
Returns true if a given Unicode codepoint is a valid character in both HTML5 and XML.
Definition: Sanitizer.php:1480
const EVIL_URI_PATTERN
Blacklist for evil uris like javascript: WARNING: DO NOT use this in any place that actually requires...
Definition: Sanitizer.php:56
const ELEMENT_BITS_REGEX
Acceptable tag name charset from HTML5 parsing spec http://www.w3.org/TR/html5/syntax.html#tag-open-state.
Definition: Sanitizer.php:46
Unicode normalization routines for working with UTF-8 strings.
Definition: UtfNormal.php:48
static decodeChar($codepoint)
Return UTF-8 string for a codepoint if that is a valid character reference, otherwise U+FFFD REPLACEM...
Definition: Sanitizer.php:1553
static normalizeSectionNameWhitespace($section)
Normalizes whitespace in a section name, such as might be returned by Parser::stripSectionName(), for use in the id's that are used for section links.
Definition: Sanitizer.php:1380
static $htmlEntities
List of all named character entities defined in HTML 4.01 http://www.w3.org/TR/html4/sgml/entities.html As well as ' which is only defined starting in XHTML1.
Definition: Sanitizer.php:64
static attributeWhitelist($element)
Fetch the whitelist of acceptable attributes for a given element name.
Definition: Sanitizer.php:1586
this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist e g Watchlist removed from all revisions and log entries to which it was applied This gives extensions a chance to take it off their books as the deletion has already been partly carried out by this point or something similar the user will be unable to create the tag set and then return false from the hook function Ensure you consume the ChangeTagAfterDelete hook to carry out custom deletion actions as context called by AbstractContent::getParserOutput May be used to override the normal model specific rendering of page content as context as context $options
Definition: hooks.txt:1020
static escapeHtmlAllowEntities($html)
Given HTML input, escape with htmlspecialchars but un-escape entities.
Definition: Sanitizer.php:1261
static validateTag($params, $element)
Takes attribute names and values for a tag and the tag name and validates that the tag is allowed to ...
Definition: Sanitizer.php:712
static mergeAttributes($a, $b)
Merge two sets of HTML attributes.
Definition: Sanitizer.php:871
MediaWiki exception.
Definition: MWException.php:26
const CHAR_REFS_REGEX
Regular expression to match various types of character references in Sanitizer::normalizeCharReferenc...
Definition: Sanitizer.php:36
static getRecognizedTagData($extratags=[], $removetags=[])
Return the various lists of recognized tags.
Definition: Sanitizer.php:365
$params
static validateAttributes($attribs, $whitelist)
Take an array of attribute names and values and normalize or discard illegal values for the given whi...
Definition: Sanitizer.php:768
static decodeCharReferencesAndNormalize($text)
Decode any character references, numeric or named entities, in the next and normalize the resulting s...
Definition: Sanitizer.php:1516
static run($event, array $args=[], $deprecatedVersion=null)
Call hook functions defined in Hooks::register and $wgHooks.
Definition: Hooks.php:131
static static $htmlEntityAliases
Character entity aliases accepted by MediaWiki.
Definition: Sanitizer.php:323
static escapeIdReferenceList($referenceString, $options=[])
Given a string containing a space delimited list of ids, escape each id to match ids escaped by the e...
Definition: Sanitizer.php:1219
Apache License January AND DISTRIBUTION Definitions License shall mean the terms and conditions for and distribution as defined by Sections through of this document Licensor shall mean the copyright owner or entity authorized by the copyright owner that is granting the License Legal Entity shall mean the union of the acting entity and all other entities that control are controlled by or are under common control with that entity For the purposes of this definition control direct or to cause the direction or management of such whether by contract or including but not limited to software source documentation and configuration files Object form shall mean any form resulting from mechanical transformation or translation of a Source including but not limited to compiled object generated and conversions to other media types Work shall mean the work of whether in Source or Object made available under the as indicated by a copyright notice that is included in or attached to the whether in Source or Object that is based or other modifications as a an original work of authorship For the purposes of this Derivative Works shall not include works that remain separable or merely the Work and Derivative Works thereof Contribution shall mean any work of including the original version of the Work and any modifications or additions to that Work or Derivative Works that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner For the purposes of this submitted means any form of or written communication sent to the Licensor or its including but not limited to communication on electronic mailing source code control and issue tracking systems that are managed by
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses & $ret
Definition: hooks.txt:1816
static cleanUrlCallback($matches)
Definition: Sanitizer.php:1909
This document is intended to provide useful advice for parties seeking to redistribute MediaWiki to end users It s targeted particularly at maintainers for Linux since it s been observed that distribution packages of MediaWiki often break We ve consistently had to recommend that users seeking support use official tarballs instead of their distribution s and this often solves whatever problem the user is having It would be nice if this could such as
Definition: distributors.txt:9
usually copyright or history_copyright This message must be in HTML not wikitext if the section is included from a template $section
Definition: hooks.txt:2767
static armorLinksCallback($matches)
Regex replace callback for armoring links against further processing.
Definition: Sanitizer.php:1274
static escapeId($id, $options=[])
Given a value, escape it so that it can be used in an id attribute and return it. ...
Definition: Sanitizer.php:1169
wfUrlProtocols($includeProtocolRelative=true)
Returns a regular expression of url protocols.
static normalizeCss($value)
Normalize CSS into a format we can easily search for hostile input.
Definition: Sanitizer.php:893
const XMLNS_ATTRIBUTE_PATTERN
Definition: Sanitizer.php:57
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency which acts as the top level factory for services in MediaWiki which can be used to gain access to default instances of various services MediaWikiServices however also allows new services to be defined and default services to be redefined Services are defined or redefined by providing a callback the instantiator that will return a new instance of the service When it will create an instance of MediaWikiServices and populate it with the services defined in the files listed by thereby bootstrapping the DI framework Per $wgServiceWiringFiles lists includes ServiceWiring php
Definition: injection.txt:35
static removeHTMLtags($text, $processCallback=null, $args=[], $extratags=[], $removetags=[], $warnCallback=null)
Cleans up HTML, removes dangerous tags and attributes, and removes HTML comments. ...
Definition: Sanitizer.php:462
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global then executing the whole list after the page is displayed We don t do anything smart like collating updates to the same table or such because the list is almost always going to have just one item on if so it s not worth the trouble Since there is a job queue in the jobs table
Definition: deferred.txt:11
$wgAllowImageTag
A different approach to the above: simply allow the "<img>" tag to be used.
static normalizeCharReferences($text)
Ensure that any entities and character references are legal for XML and XHTML specifically.
Definition: Sanitizer.php:1399
this class mediates it Skin Encapsulates a look and feel for the wiki All of the functions that render HTML and make choices about how to render it are here and are called from various other places when and is meant to be subclassed with other skins that may override some of its functions The User object contains a reference to a and so rather than having a global skin object we just rely on the global User and get the skin with $wgUser and also has some character encoding functions and other locale stuff The current user interface language is instantiated as and the local content language as $wgContLang
Definition: design.txt:56
$wgExperimentalHtmlIds
Should we allow a broader set of characters in id attributes, per HTML5? If not, use only HTML 4-comp...
$count
static removeHTMLcomments($text)
Remove '', and everything between.
Definition: Sanitizer.php:666
static getAttribsRegex()
Regular expression to match HTML/XML attribute pairs within a tag.
Definition: Sanitizer.php:340
codepointToUtf8($codepoint)
Return UTF-8 sequence for a given Unicode code point.
static validateEmail($addr)
Does a string look like an e-mail address?
Definition: Sanitizer.php:1941
static checkCss($value)
Pick apart some CSS and check it for forbidden or unsafe structures.
Definition: Sanitizer.php:1001
static getTagAttributeCallback($set)
Pick the appropriate attribute value from a match set from the attribs regex matches.
Definition: Sanitizer.php:1341
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses after processing & $attribs
Definition: hooks.txt:1816
</td >< td > &</td >< td > t want your writing to be edited mercilessly and redistributed at will
HTML sanitizer for MediaWiki.
Definition: Sanitizer.php:31
static decodeEntity($name)
If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, return the UTF-8 encoding of that chara...
Definition: Sanitizer.php:1569
static safeEncodeAttribute($text)
Encode an attribute value for HTML tags, with extra armoring against further wiki processing...
Definition: Sanitizer.php:1111
static configuration should be added through ResourceLoaderGetConfigVars instead & $vars
Definition: hooks.txt:2044
static encodeAttribute($text)
Encode an attribute value for HTML output.
Definition: Sanitizer.php:1090
$matches
Allows to change the fields on the form that will be generated $name
Definition: hooks.txt:310