3 * XHTML sanitizer for MediaWiki
5 * Copyright (C) 2002-2005 Brion Vibber <brion@pobox.com> et al
6 * http://www.mediawiki.org/
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
21 * http://www.gnu.org/copyleft/gpl.html
28 * Regular expression to match various types of character references in
29 * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
31 define( 'MW_CHAR_REFS_REGEX',
32 '/&([A-Za-z0-9\x80-\xff]+);
39 * Regular expression to match HTML/XML attribute pairs within a tag.
40 * Allows some... latitude.
41 * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
43 $attrib = '[A-Za-z0-9]';
44 $space = '[\x09\x0a\x0d\x20]';
45 define( 'MW_ATTRIBS_REGEX',
46 "/(?:^|$space)((?:xml:|xmlns:)?$attrib+)
49 # The attribute value: quoted or alone
52 | ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
53 | (\#[0-9a-fA-F]+) # Technically wrong, but lots of
54 # colors are specified like this.
55 # We'll be normalizing it.
57 )?(?=$space|\$)/sx" );
60 * Regular expression to match URIs that could trigger script execution
62 define( 'MW_EVIL_URI_PATTERN', '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i' );
65 * Regular expression to match namespace attributes
67 define( 'MW_XMLNS_ATTRIBUTE_PATTRN', "/^xmlns:$attrib+$/" );
70 * List of all named character entities defined in HTML 4.01
71 * http://www.w3.org/TR/html4/sgml/entities.html
74 global $wgHtmlEntities;
75 $wgHtmlEntities = array(
330 * Character entity aliases accepted by MediaWiki
332 global $wgHtmlEntityAliases;
333 $wgHtmlEntityAliases = array(
340 * XHTML sanitizer for MediaWiki
345 * Cleans up HTML, removes dangerous tags and attributes, and
346 * removes HTML comments
348 * @param $text String
349 * @param $processCallback Callback to do any variable or parameter replacements in HTML attribute values
350 * @param $args Array for the processing callback
351 * @param $extratags Array for any extra tags to include
352 * @param $removetags Array for any tags (default or extra) to exclude
355 static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array(), $removetags = array() ) {
358 static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
359 $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
361 wfProfileIn( __METHOD__
);
363 if ( !$staticInitialised ) {
365 $htmlpairsStatic = array( # Tags that must be closed
366 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
367 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
368 'strike', 'strong', 'tt', 'var', 'div', 'center',
369 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
370 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u', 'abbr'
373 'br', 'hr', 'li', 'dt', 'dd'
375 $htmlsingleonly = array( # Elements that cannot have close tags
378 $htmlnest = array( # Tags that can be nested--??
379 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
380 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
382 $tabletags = array( # Can only appear inside table, we will close them
385 $htmllist = array( # Tags used by list
388 $listtags = array( # Tags that can appear in a list
392 $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
393 $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
395 # Convert them all to hashtables for faster lookup
396 $vars = array( 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
397 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' );
398 foreach ( $vars as $var ) {
399 $
$var = array_flip( $
$var );
401 $staticInitialised = true;
403 # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
404 $extratags = array_flip( $extratags );
405 $removetags = array_flip( $removetags );
406 $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
407 $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ) , $removetags );
409 # Remove HTML comments
410 $text = Sanitizer
::removeHTMLcomments( $text );
411 $bits = explode( '<', $text );
412 $text = str_replace( '>', '>', array_shift( $bits ) );
414 $tagstack = $tablestack = array();
415 foreach ( $bits as $x ) {
417 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
418 list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
420 $slash = $t = $params = $brace = $rest = null;
424 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
428 if( isset( $htmlsingleonly[$t] ) ) {
430 } elseif ( ( $ot = @array_pop
( $tagstack ) ) != $t ) {
431 if ( isset( $htmlsingleallowed[$ot] ) ) {
432 # Pop all elements with an optional close tag
433 # and see if we find a match below them
435 array_push ($optstack, $ot);
436 while ( ( ( $ot = @array_pop
( $tagstack ) ) != $t ) &&
437 isset( $htmlsingleallowed[$ot] ) )
439 array_push ($optstack, $ot);
442 # No match. Push the optinal elements back again
444 while ( $ot = @array_pop
( $optstack ) ) {
445 array_push( $tagstack, $ot );
449 @array_push
( $tagstack, $ot );
450 # <li> can be nested in <ul> or <ol>, skip those cases:
451 if(!(isset( $htmllist[$ot] ) && isset( $listtags[$t] ) )) {
456 if ( $t == 'table' ) {
457 $tagstack = array_pop( $tablestack );
462 # Keep track for later
463 if ( isset( $tabletags[$t] ) &&
464 ! in_array( 'table', $tagstack ) ) {
466 } else if ( in_array( $t, $tagstack ) &&
467 ! isset( $htmlnest [$t ] ) ) {
469 #Â Is it a self closed htmlpair ? (bug 5487)
470 } else if( $brace == '/>' &&
471 isset( $htmlpairs[$t] ) ) {
473 } elseif( isset( $htmlsingleonly[$t] ) ) {
474 # Hack to force empty tag for uncloseable elements
476 } else if( isset( $htmlsingle[$t] ) ) {
477 # Hack to not close $htmlsingle tags
479 } else if( isset( $tabletags[$t] )
480 && in_array($t ,$tagstack) ) {
481 // New table tag but forgot to close the previous one
484 if ( $t == 'table' ) {
485 array_push( $tablestack, $tagstack );
488 array_push( $tagstack, $t );
491 # Replace any variables or template parameters with
493 if( is_callable( $processCallback ) ) {
494 call_user_func_array( $processCallback, array( &$params, $args ) );
497 # Strip non-approved attributes from the tag
498 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
501 $rest = str_replace( '>', '>', $rest );
502 $close = ( $brace == '/>' && !$slash ) ?
' /' : '';
503 $text .= "<$slash$t$newparams$close>$rest";
507 $text .= '<' . str_replace( '>', '>', $x);
509 # Close off any remaining tags
510 while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
512 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
515 # this might be possible using tidy itself
516 foreach ( $bits as $x ) {
517 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
519 @list
( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
520 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
521 if( is_callable( $processCallback ) ) {
522 call_user_func_array( $processCallback, array( &$params, $args ) );
524 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
525 $rest = str_replace( '>', '>', $rest );
526 $text .= "<$slash$t$newparams$brace$rest";
528 $text .= '<' . str_replace( '>', '>', $x);
532 wfProfileOut( __METHOD__
);
537 * Remove '<!--', '-->', and everything between.
538 * To avoid leaving blank lines, when a comment is both preceded
539 * and followed by a newline (ignoring spaces), trim leading and
540 * trailing spaces and one of the newlines.
543 * @param $text String
546 static function removeHTMLcomments( $text ) {
547 wfProfileIn( __METHOD__
);
548 while (($start = strpos($text, '<!--')) !== false) {
549 $end = strpos($text, '-->', $start +
4);
550 if ($end === false) {
551 # Unterminated comment; bail out
557 # Trim space and newline if the comment is both
558 # preceded and followed by a newline
559 $spaceStart = max($start - 1, 0);
560 $spaceLen = $end - $spaceStart;
561 while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
565 while (substr($text, $spaceStart +
$spaceLen, 1) === ' ')
567 if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart +
$spaceLen, 1) === "\n") {
568 # Remove the comment, leading and trailing
569 # spaces, and leave only one newline.
570 $text = substr_replace($text, "\n", $spaceStart, $spaceLen +
1);
573 # Remove just the comment.
574 $text = substr_replace($text, '', $start, $end - $start);
577 wfProfileOut( __METHOD__
);
582 * Take an array of attribute names and values and normalize or discard
583 * illegal values for the given element type.
585 * - Discards attributes not on a whitelist for the given element
586 * - Unsafe style attributes are discarded
587 * - Invalid id attributes are reencoded
589 * @param $attribs Array
590 * @param $element String
593 * @todo Check for legal values where the DTD limits things.
594 * @todo Check for unique id attribute :P
596 static function validateTagAttributes( $attribs, $element ) {
597 return Sanitizer
::validateAttributes( $attribs,
598 Sanitizer
::attributeWhitelist( $element ) );
602 * Take an array of attribute names and values and normalize or discard
603 * illegal values for the given whitelist.
605 * - Discards attributes not the given whitelist
606 * - Unsafe style attributes are discarded
607 * - Invalid id attributes are reencoded
609 * @param $attribs Array
610 * @param $whitelist Array: list of allowed attribute names
613 * @todo Check for legal values where the DTD limits things.
614 * @todo Check for unique id attribute :P
616 static function validateAttributes( $attribs, $whitelist ) {
617 $whitelist = array_flip( $whitelist );
618 $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
621 foreach( $attribs as $attribute => $value ) {
622 #allow XML namespace declaration. Useful especially with RDFa
623 print "($attribute=$value)";
625 if ( preg_match( MW_XMLNS_ATTRIBUTE_PATTRN
, $attribute ) ) {
626 if ( !preg_match( MW_EVIL_URI_PATTERN
, $value ) ) {
627 $out[$attribute] = $value;
633 if( !isset( $whitelist[$attribute] ) ) {
637 # Strip javascript "expression" from stylesheets.
638 # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
639 if( $attribute == 'style' ) {
640 $value = Sanitizer
::checkCss( $value );
641 if( $value === false ) {
647 if ( $attribute === 'id' ) {
648 global $wgEnforceHtmlIds;
649 $value = Sanitizer
::escapeId( $value,
650 $wgEnforceHtmlIds ?
'noninitial' : 'xml' );
653 //RDFa and microdata properties allow URIs. check them
654 if ( $attribute === 'rel' ||
$attribute === 'rev' ||
655 $attribute === 'about' ||
$attribute === 'property' ||
$attribute === 'resource' ||
656 $attribute === 'datatype' ||
$attribute === 'typeof' ||
657 $attribute === 'item' ||
$attribute === 'itemprop' ||
$attribute === 'subject' ) {
659 //Paranoia. Allow "simple" values but suppress javascript
660 if ( preg_match( MW_EVIL_URI_PATTERN
, $value ) ) {
665 # NOTE: even though elements using href/src are not allowed directly, supply
666 # validation code that can be used by tag hook handlers, etc
667 if ( $attribute === 'href' ||
$attribute === 'src' ) {
668 if ( !preg_match( $hrefExp, $value ) ) {
669 continue; //drop any href or src attributes not using an allowed protocol.
670 //NOTE: this also drops all relative URLs
674 // If this attribute was previously set, override it.
675 // Output should only have one attribute of each name.
676 $out[$attribute] = $value;
682 * Merge two sets of HTML attributes. Conflicting items in the second set
683 * will override those in the first, except for 'class' attributes which
684 * will be combined (if they're both strings).
686 * @todo implement merging for other attributes such as style
691 static function mergeAttributes( $a, $b ) {
692 $out = array_merge( $a, $b );
693 if( isset( $a['class'] ) && isset( $b['class'] )
694 && is_string( $a['class'] ) && is_string( $b['class'] )
695 && $a['class'] !== $b['class'] ) {
696 $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
697 -1, PREG_SPLIT_NO_EMPTY
);
698 $out['class'] = implode( ' ', array_unique( $classes ) );
704 * Pick apart some CSS and check it for forbidden or unsafe structures.
705 * Returns a sanitized string, or false if it was just too evil.
707 * Currently URL references, 'expression', 'tps' are forbidden.
709 * @param $value String
712 static function checkCss( $value ) {
713 $stripped = Sanitizer
::decodeCharReferences( $value );
715 // Remove any comments; IE gets token splitting wrong
716 $stripped = StringUtils
::delimiterReplace( '/*', '*/', ' ', $stripped );
720 // ... and continue checks
721 $stripped = preg_replace( '!\\\\([0-9A-Fa-f]{1,6})[ \\n\\r\\t\\f]?!e',
722 'codepointToUtf8(hexdec("$1"))', $stripped );
723 $stripped = str_replace( '\\', '', $stripped );
724 if( preg_match( '/(?:expression|tps*:\/\/|url\\s*\().*/is',
734 * Take a tag soup fragment listing an HTML element's attributes
735 * and normalize it to well-formed XML, discarding unwanted attributes.
736 * Output is safe for further wikitext processing, with escaping of
737 * values that could trigger problems.
739 * - Normalizes attribute names to lowercase
740 * - Discards attributes not on a whitelist for the given element
741 * - Turns broken or invalid entities into plaintext
742 * - Double-quotes all attribute values
743 * - Attributes without values are given the name as attribute
744 * - Double attributes are discarded
745 * - Unsafe style attributes are discarded
746 * - Prepends space if there are attributes.
748 * @param $text String
749 * @param $element String
752 static function fixTagAttributes( $text, $element ) {
753 if( trim( $text ) == '' ) {
757 $stripped = Sanitizer
::validateTagAttributes(
758 Sanitizer
::decodeTagAttributes( $text ), $element );
761 foreach( $stripped as $attribute => $value ) {
762 $encAttribute = htmlspecialchars( $attribute );
763 $encValue = Sanitizer
::safeEncodeAttribute( $value );
765 $attribs[] = "$encAttribute=\"$encValue\"";
767 return count( $attribs ) ?
' ' . implode( ' ', $attribs ) : '';
771 * Encode an attribute value for HTML output.
772 * @param $text String
773 * @return HTML-encoded text fragment
775 static function encodeAttribute( $text ) {
776 $encValue = htmlspecialchars( $text, ENT_QUOTES
);
778 // Whitespace is normalized during attribute decoding,
779 // so if we've been passed non-spaces we must encode them
780 // ahead of time or they won't be preserved.
781 $encValue = strtr( $encValue, array(
791 * Encode an attribute value for HTML tags, with extra armoring
792 * against further wiki processing.
793 * @param $text String
794 * @return HTML-encoded text fragment
796 static function safeEncodeAttribute( $text ) {
797 $encValue = Sanitizer
::encodeAttribute( $text );
799 # Templates and links may be expanded in later parsing,
800 # creating invalid or dangerous output. Suppress this.
801 $encValue = strtr( $encValue, array(
802 '<' => '<', // This should never happen,
803 '>' => '>', // we've received invalid input
804 '"' => '"', // which should have been escaped.
807 "''" => '''',
808 'ISBN' => 'ISBN',
810 'PMID' => 'PMID',
816 $encValue = preg_replace_callback(
817 '/(' . wfUrlProtocols() . ')/',
818 array( 'Sanitizer', 'armorLinksCallback' ),
824 * Given a value escape it so that it can be used in an id attribute and
825 * return it, this does not validate the value however (see first link)
827 * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters
830 * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
832 * @param $id String: id to validate
833 * @param $options Mixed: string or array of strings (default is array()):
834 * 'noninitial': This is a non-initial fragment of an id, not a full id,
835 * so don't pay attention if the first character isn't valid at the
836 * beginning of an id.
837 * 'xml': Don't restrict the id to be HTML4-compatible. This option
838 * allows any alphabetic character to be used, per the XML standard.
839 * Therefore, it also completely changes the type of escaping: instead
840 * of weird dot-encoding, runs of invalid characters (mostly
841 * whitespace) are just compressed into a single underscore.
844 static function escapeId( $id, $options = array() ) {
845 $options = (array)$options;
847 if ( !in_array( 'xml', $options ) ) {
848 # HTML4-style escaping
849 static $replace = array(
854 $id = urlencode( Sanitizer
::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
855 $id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
857 if ( !preg_match( '/^[a-zA-Z]/', $id )
858 && !in_array( 'noninitial', $options ) ) {
859 // Initial character must be a letter!
865 # XML-style escaping. For the patterns used, see the XML 1.0 standard,
866 # 5th edition, NameStartChar and NameChar: <http://www.w3.org/TR/REC-xml/>
867 $nameStartChar = ':a-zA-Z_\xC0-\xD6\xD8-\xF6\xF8-\x{2FF}\x{370}-\x{37D}'
868 . '\x{37F}-\x{1FFF}\x{200C}-\x{200D}\x{2070}-\x{218F}\x{2C00}-\x{2FEF}'
869 . '\x{3001}-\x{D7FF}\x{F900}-\x{FDCF}\x{FDF0}-\x{FFFD}\x{10000}-\x{EFFFF}';
870 $nameChar = $nameStartChar . '.\-0-9\xB7\x{0300}-\x{036F}'
871 . '\x{203F}-\x{2040}';
872 # Replace _ as well so we don't get multiple consecutive underscores
873 $id = preg_replace( "/([^$nameChar]|_)+/u", '_', $id );
874 $id = trim( $id, '_' );
876 if ( !preg_match( "/^[$nameStartChar]/u", $id )
877 && !in_array( 'noninitial', $options ) ) {
885 * Given a value, escape it so that it can be used as a CSS class and
888 * @todo For extra validity, input should be validated UTF-8.
890 * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
892 * @param $class String
895 static function escapeClass( $class ) {
896 // Convert ugly stuff to underscores and kill underscores in ugly places
897 return rtrim(preg_replace(
898 array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
904 * Given HTML input, escape with htmlspecialchars but un-escape entites.
905 * This allows (generally harmless) entities like to survive.
907 * @param $html String to escape
908 * @return String: escaped input
910 static function escapeHtmlAllowEntities( $html ) {
911 # It seems wise to escape ' as well as ", as a matter of course. Can't
913 $html = htmlspecialchars( $html, ENT_QUOTES
);
914 $html = str_replace( '&', '&', $html );
915 $html = Sanitizer
::normalizeCharReferences( $html );
920 * Regex replace callback for armoring links against further processing.
921 * @param $matches Array
924 private static function armorLinksCallback( $matches ) {
925 return str_replace( ':', ':', $matches[1] );
929 * Return an associative array of attribute names and values from
930 * a partial tag string. Attribute names are forces to lowercase,
931 * character references are decoded to UTF-8 text.
933 * @param $text String
936 public static function decodeTagAttributes( $text ) {
939 if( trim( $text ) == '' ) {
952 foreach( $pairs as $set ) {
953 $attribute = strtolower( $set[1] );
954 $value = Sanitizer
::getTagAttributeCallback( $set );
956 // Normalize whitespace
957 $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
958 $value = trim( $value );
960 // Decode character references
961 $attribs[$attribute] = Sanitizer
::decodeCharReferences( $value );
967 * Pick the appropriate attribute value from a match set from the
968 * MW_ATTRIBS_REGEX matches.
973 private static function getTagAttributeCallback( $set ) {
974 if( isset( $set[6] ) ) {
975 # Illegal #XXXXXX color with no quotes.
977 } elseif( isset( $set[5] ) ) {
980 } elseif( isset( $set[4] ) ) {
983 } elseif( isset( $set[3] ) ) {
986 } elseif( !isset( $set[2] ) ) {
987 # In XHTML, attributes must have a value.
988 # For 'reduced' form, return explicitly the attribute name here.
991 throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
996 * Normalize whitespace and character references in an XML source-
997 * encoded text for an attribute value.
999 * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
1000 * but note that we're not returning the value, but are returning
1001 * XML source fragments that will be slapped into output.
1003 * @param $text String
1006 private static function normalizeAttributeValue( $text ) {
1007 return str_replace( '"', '"',
1008 self
::normalizeWhitespace(
1009 Sanitizer
::normalizeCharReferences( $text ) ) );
1012 private static function normalizeWhitespace( $text ) {
1013 return preg_replace(
1014 '/\r\n|[\x20\x0d\x0a\x09]/',
1020 * Ensure that any entities and character references are legal
1021 * for XML and XHTML specifically. Any stray bits will be
1022 * &-escaped to result in a valid text fragment.
1024 * a. any named char refs must be known in XHTML
1025 * b. any numeric char refs must be legal chars, not invalid or forbidden
1026 * c. use &#x, not &#X
1027 * d. fix or reject non-valid attributes
1029 * @param $text String
1033 static function normalizeCharReferences( $text ) {
1034 return preg_replace_callback(
1036 array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
1040 * @param $matches String
1043 static function normalizeCharReferencesCallback( $matches ) {
1045 if( $matches[1] != '' ) {
1046 $ret = Sanitizer
::normalizeEntity( $matches[1] );
1047 } elseif( $matches[2] != '' ) {
1048 $ret = Sanitizer
::decCharReference( $matches[2] );
1049 } elseif( $matches[3] != '' ) {
1050 $ret = Sanitizer
::hexCharReference( $matches[3] );
1051 } elseif( $matches[4] != '' ) {
1052 $ret = Sanitizer
::hexCharReference( $matches[4] );
1054 if( is_null( $ret ) ) {
1055 return htmlspecialchars( $matches[0] );
1062 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1063 * return the named entity reference as is. If the entity is a
1064 * MediaWiki-specific alias, returns the HTML equivalent. Otherwise,
1065 * returns HTML-escaped text of pseudo-entity source (eg &foo;)
1067 * @param $name String
1070 static function normalizeEntity( $name ) {
1071 global $wgHtmlEntities, $wgHtmlEntityAliases;
1072 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1073 return "&{$wgHtmlEntityAliases[$name]};";
1074 } elseif( isset( $wgHtmlEntities[$name] ) ) {
1077 return "&$name;";
1081 static function decCharReference( $codepoint ) {
1082 $point = intval( $codepoint );
1083 if( Sanitizer
::validateCodepoint( $point ) ) {
1084 return sprintf( '&#%d;', $point );
1090 static function hexCharReference( $codepoint ) {
1091 $point = hexdec( $codepoint );
1092 if( Sanitizer
::validateCodepoint( $point ) ) {
1093 return sprintf( '&#x%x;', $point );
1100 * Returns true if a given Unicode codepoint is a valid character in XML.
1101 * @param $codepoint Integer
1104 private static function validateCodepoint( $codepoint ) {
1105 return ($codepoint == 0x09)
1106 ||
($codepoint == 0x0a)
1107 ||
($codepoint == 0x0d)
1108 ||
($codepoint >= 0x20 && $codepoint <= 0xd7ff)
1109 ||
($codepoint >= 0xe000 && $codepoint <= 0xfffd)
1110 ||
($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
1114 * Decode any character references, numeric or named entities,
1115 * in the text and return a UTF-8 string.
1117 * @param $text String
1120 public static function decodeCharReferences( $text ) {
1121 return preg_replace_callback(
1123 array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1128 * @param $matches String
1131 static function decodeCharReferencesCallback( $matches ) {
1132 if( $matches[1] != '' ) {
1133 return Sanitizer
::decodeEntity( $matches[1] );
1134 } elseif( $matches[2] != '' ) {
1135 return Sanitizer
::decodeChar( intval( $matches[2] ) );
1136 } elseif( $matches[3] != '' ) {
1137 return Sanitizer
::decodeChar( hexdec( $matches[3] ) );
1138 } elseif( $matches[4] != '' ) {
1139 return Sanitizer
::decodeChar( hexdec( $matches[4] ) );
1141 # Last case should be an ampersand by itself
1146 * Return UTF-8 string for a codepoint if that is a valid
1147 * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
1148 * @param $codepoint Integer
1152 static function decodeChar( $codepoint ) {
1153 if( Sanitizer
::validateCodepoint( $codepoint ) ) {
1154 return codepointToUtf8( $codepoint );
1156 return UTF8_REPLACEMENT
;
1161 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1162 * return the UTF-8 encoding of that character. Otherwise, returns
1163 * pseudo-entity source (eg &foo;)
1165 * @param $name Strings
1168 static function decodeEntity( $name ) {
1169 global $wgHtmlEntities, $wgHtmlEntityAliases;
1170 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1171 $name = $wgHtmlEntityAliases[$name];
1173 if( isset( $wgHtmlEntities[$name] ) ) {
1174 return codepointToUtf8( $wgHtmlEntities[$name] );
1181 * Fetch the whitelist of acceptable attributes for a given element name.
1183 * @param $element String
1186 static function attributeWhitelist( $element ) {
1188 if( !isset( $list ) ) {
1189 $list = Sanitizer
::setupAttributeWhitelist();
1191 return isset( $list[$element] )
1197 * Foreach array key (an allowed HTML element), return an array
1198 * of allowed attributes
1201 static function setupAttributeWhitelist() {
1202 global $wgAllowRdfaAttributes, $wgHtml5, $wgAllowItemAttributes;
1204 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style', 'xml:lang' );
1206 if ( $wgAllowRdfaAttributes ) {
1207 #RDFa attributes as specified in section 9 of http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1208 $common = array_merge( $common, array(
1209 'about', 'property', 'resource', 'datatype', 'typeof',
1213 if ( $wgHtml5 && $wgAllowItemAttributes ) {
1214 # add HTML5 microdata tages as pecified by http://www.w3.org/TR/html5/microdata.html
1215 $common = array_merge( $common, array(
1216 'item', 'itemprop', 'subject'
1220 $block = array_merge( $common, array( 'align' ) );
1221 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1222 $tablecell = array( 'abbr',
1228 'nowrap', # deprecated
1229 'width', # deprecated
1230 'height', # deprecated
1231 'bgcolor' # deprecated
1234 # Numbers refer to sections in HTML 4.01 standard describing the element.
1235 # See: http://www.w3.org/TR/html4/
1236 $whitelist = array (
1239 'center' => $common, # deprecated
1240 'span' => $block, # ??
1258 'strong' => $common,
1269 'blockquote' => array_merge( $common, array( 'cite' ) ),
1280 'br' => array( 'id', 'class', 'title', 'style', 'clear' ),
1283 'pre' => array_merge( $common, array( 'width' ) ),
1286 'ins' => array_merge( $common, array( 'cite', 'datetime' ) ),
1287 'del' => array_merge( $common, array( 'cite', 'datetime' ) ),
1290 'ul' => array_merge( $common, array( 'type' ) ),
1291 'ol' => array_merge( $common, array( 'type', 'start' ) ),
1292 'li' => array_merge( $common, array( 'type', 'value' ) ),
1300 'table' => array_merge( $common,
1301 array( 'summary', 'width', 'border', 'frame',
1302 'rules', 'cellspacing', 'cellpadding',
1307 'caption' => array_merge( $common, array( 'align' ) ),
1310 'thead' => array_merge( $common, $tablealign ),
1311 'tfoot' => array_merge( $common, $tablealign ),
1312 'tbody' => array_merge( $common, $tablealign ),
1315 'colgroup' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1316 'col' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1319 'tr' => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1322 'td' => array_merge( $common, $tablecell, $tablealign ),
1323 'th' => array_merge( $common, $tablecell, $tablealign ),
1325 # 12.2 # NOTE: <a> is not allowed directly, but the attrib whitelist is used from the Parser object
1326 'a' => array_merge( $common, array( 'href', 'rel', 'rev' ) ), # rel/rev esp. for RDFa
1329 # Not usually allowed, but may be used for extension-style hooks
1330 # such as <math> when it is rasterized
1331 'img' => array_merge( $common, array( 'alt' ) ),
1339 'strike' => $common,
1344 'font' => array_merge( $common, array( 'size', 'color', 'face' ) ),
1348 'hr' => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1350 # XHTML Ruby annotation text module, simple ruby only.
1351 # http://www.w3c.org/TR/ruby/
1356 'rt' => $common, #array_merge( $common, array( 'rbspan' ) ),
1359 # MathML root element, where used for extensions
1360 # 'title' may not be 100% valid here; it's XHTML
1361 # http://www.w3.org/TR/REC-MathML/
1362 'math' => array( 'class', 'style', 'id', 'title' ),
1368 * Take a fragment of (potentially invalid) HTML and return
1369 * a version with any tags removed, encoded as plain text.
1371 * Warning: this return value must be further escaped for literal
1372 * inclusion in HTML output as of 1.10!
1374 * @param $text String: HTML fragment
1377 static function stripAllTags( $text ) {
1379 $text = StringUtils
::delimiterReplace( '<', '>', '', $text );
1381 # Normalize &entities and whitespace
1382 $text = self
::decodeCharReferences( $text );
1383 $text = self
::normalizeWhitespace( $text );
1389 * Hack up a private DOCTYPE with HTML's standard entity declarations.
1390 * PHP 4 seemed to know these if you gave it an HTML doctype, but
1393 * Use for passing XHTML fragments to PHP's XML parsing functions
1397 static function hackDocType() {
1398 global $wgHtmlEntities;
1399 $out = "<!DOCTYPE html [\n";
1400 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1401 $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1407 static function cleanUrl( $url ) {
1408 # Normalize any HTML entities in input. They will be
1409 # re-escaped by makeExternalLink().
1410 $url = Sanitizer
::decodeCharReferences( $url );
1412 # Escape any control characters introduced by the above step
1413 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F]/e', "urlencode('\\0')", $url );
1415 # Validate hostname portion
1417 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1418 list( /* $whole */, $protocol, $host, $rest ) = $matches;
1420 // Characters that will be ignored in IDNs.
1421 // http://tools.ietf.org/html/3454#section-3.1
1422 // Strip them before further processing so blacklists and such work.
1424 \\s| # general whitespace
1425 \xc2\xad| # 00ad SOFT HYPHEN
1426 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1427 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1428 \xe2\x81\xa0| # 2060 WORD JOINER
1429 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1430 \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
1431 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1432 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1433 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1434 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1435 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1436 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1439 $host = preg_replace( $strip, '', $host );
1441 // @fixme: validate hostnames here
1443 return $protocol . $host . $rest;