return '';
}
- $attrib = '[A-Za-z0-9]'; #FIXME
+ # Unquoted attribute
+ # Since we quote this later, this can be anything distinguishable
+ # from the end of the attribute
+ $attrib = '[A-Za-z0-9]';
$space = '[\x09\x0a\x0d\x20]';
if( !preg_match_all(
"/(?:^|$space)($attrib+)
# The attribute value: quoted or alone
\"([^<\"]*)\"
| '([^<']*)'
- | ([a-zA-Z0-9._:-]+)
+ | ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
| (\#[0-9a-fA-F]+) # Technically wrong, but lots of
# colors are specified like this.
# We'll be normalizing it.
$attribute = strtolower( $set[1] );
if( !isset( $whitelist[$attribute] ) ) {
continue;
- }
- if( $set[2] == '' ) {
- # In XHTML, attributes must have a value.
- $value = $set[1];
- } elseif( $set[3] != '' ) {
- # Double-quoted
- $value = Sanitizer::normalizeAttributeValue( $set[3] );
- } elseif( $set[4] != '' ) {
+ } elseif( isset( $set[6] ) ) {
+ # Illegal #XXXXXX color with no quotes.
+ $value = Sanitizer::normalizeAttributeValue( $set[6] );
+ } elseif( isset( $set[5] ) ) {
+ # No quotes.
+ $value = Sanitizer::normalizeAttributeValue( $set[5] );
+ } elseif( isset( $set[4] ) ) {
# Single-quoted
$value = str_replace( '"', '"',
Sanitizer::normalizeAttributeValue( $set[4] ) );
- } elseif( $set[5] != '' ) {
- # No quotes.
- $value = Sanitizer::normalizeAttributeValue( $set[5] );
- } elseif( $set[6] != '' ) {
- # Illegal #XXXXXX color with no quotes.
- $value = Sanitizer::normalizeAttributeValue( $set[6] );
+ } elseif( isset( $set[3] ) ) {
+ # Double-quoted
+ $value = Sanitizer::normalizeAttributeValue( $set[3] );
+ } elseif( !isset( $set[2] ) ) {
+ # In XHTML, attributes must have a value.
+ $value = $set[1];
} else {
- wfDebugDieBacktrace( "Tag conditions not met. Something's very odd." );
+ wfDebugDieBacktrace( "Tag conditions not met. This should never happen and is a bug." );
}
# Strip javascript "expression" from stylesheets.