* (bug 2067) Fixed crash on empty quoted HTML attribute

[lhc/web/wiklou.git] / includes / Sanitizer.php

diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index e6c56e9..faac940 100644 (file)
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -216,7 +216,10 @@ class Sanitizer {
                        return '';
                }
                
-               $attrib = '[A-Za-z0-9]'; #FIXME
+               # Unquoted attribute
+               # Since we quote this later, this can be anything distinguishable 
+               # from the end of the attribute
+               $attrib = '[A-Za-z0-9]'; 
                $space = '[\x09\x0a\x0d\x20]';
                if( !preg_match_all(
                        "/(?:^|$space)($attrib+)
@@ -225,7 +228,7 @@ class Sanitizer {
                             # The attribute value: quoted or alone
                              \"([^<\"]*)\"
                             | '([^<']*)'
-                            |  ([a-zA-Z0-9._:-]+)
+                            |  ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
                             |  (\#[0-9a-fA-F]+) # Technically wrong, but lots of
                                                 # colors are specified like this.
                                                 # We'll be normalizing it.
@@ -243,25 +246,24 @@ class Sanitizer {
                        $attribute = strtolower( $set[1] );
                        if( !isset( $whitelist[$attribute] ) ) {
                                continue;
-                       }
-                       if( !isset( $set[2] ) ) {
-                               # In XHTML, attributes must have a value.
-                               $value = $set[1];
-                       } elseif( $set[3] != '' ) {
-                               # Double-quoted
-                               $value = Sanitizer::normalizeAttributeValue( $set[3] );
-                       } elseif( $set[4] != '' ) {
+                       } elseif( isset( $set[6] ) ) {
+                               # Illegal #XXXXXX color with no quotes.
+                               $value = Sanitizer::normalizeAttributeValue( $set[6] );
+                       } elseif( isset( $set[5] ) ) {
+                               # No quotes.
+                               $value = Sanitizer::normalizeAttributeValue( $set[5] );
+                       } elseif( isset( $set[4] ) ) {
                                # Single-quoted
                                $value = str_replace( '"', '&quot;',
                                        Sanitizer::normalizeAttributeValue( $set[4] ) );
-                       } elseif( $set[5] != '' ) {
-                               # No quotes.
-                               $value = Sanitizer::normalizeAttributeValue( $set[5] );
-                       } elseif( $set[6] != '' ) {
-                               # Illegal #XXXXXX color with no quotes.
-                               $value = Sanitizer::normalizeAttributeValue( $set[6] );
+                       } elseif( isset( $set[3] ) ) {
+                               # Double-quoted
+                               $value = Sanitizer::normalizeAttributeValue( $set[3] );
+                       } elseif( !isset( $set[2] ) ) {
+                               # In XHTML, attributes must have a value.
+                               $value = $set[1];
                        } else {
-                               wfDebugDieBacktrace( "Tag conditions not met. Something's very odd." );
+                               wfDebugDieBacktrace( "Tag conditions not met. This should never happen and is a bug." );
                        }
                        
                        # Strip javascript "expression" from stylesheets.