From d469f538474b5c860e3984a9c4b672faaa305b1f Mon Sep 17 00:00:00 2001
From: Brad Jorsch <bjorsch@wikimedia.org>
Date: Mon, 2 Jul 2018 11:17:06 -0400
Subject: [PATCH] Parser: Remove style and script tags' content from TOC

We don't want to display the stylesheet as part of the TOC entry if
someone uses TemplateStyles in a heading.

Bug: T198618
Change-Id: I2f7316daaba0cce662b6a4702ab87322e6783655
---
 includes/parser/Parser.php   |  7 +++++++
 tests/parser/parserTests.txt | 21 +++++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/includes/parser/Parser.php b/includes/parser/Parser.php
index fd5ccb848b..12d899bc34 100644
--- a/includes/parser/Parser.php
+++ b/includes/parser/Parser.php
@@ -4216,6 +4216,13 @@ class Parser {
 			# Avoid insertion of weird stuff like <math> by expanding the relevant sections
 			$safeHeadline = $this->mStripState->unstripBoth( $safeHeadline );
 
+			# Remove any <style> or <script> tags (T198618)
+			$safeHeadline = preg_replace(
+				'#<(style|script)(?: [^>]*[^>/])?>.*?</\1>#is',
+				'',
+				$safeHeadline
+			);
+
 			# Strip out HTML (first regex removes any tag not allowed)
 			# Allowed tags are:
 			# * <sup> and <sub> (T10393)
diff --git a/tests/parser/parserTests.txt b/tests/parser/parserTests.txt
index e2da66282e..b1510029a1 100644
--- a/tests/parser/parserTests.txt
+++ b/tests/parser/parserTests.txt
@@ -24710,6 +24710,27 @@ __TOC__
 <h2 id="test_test_test" data-parsoid='{}'><s>test</s> test <strike>test</strike></h2>
 !! end
 
+!! test
+T198618: style element in ToC
+!! options
+styletag=1
+!! wikitext
+__TOC__
+==<style>.foo {}</style>Style<style>.bar {}</style>==
+!! html/php
+<div id="toc" class="toc"><input type="checkbox" role="button" id="toctogglecheckbox" class="toctogglecheckbox" style="display:none"/><div class="toctitle" lang="en" dir="ltr"><h2>Contents</h2><span class="toctogglespan"><label class="toctogglelabel" for="toctogglecheckbox"></label></span></div>
+<ul>
+<li class="toclevel-1 tocsection-1"><a href="#Style"><span class="tocnumber">1</span> <span class="toctext">Style</span></a></li>
+</ul>
+</div>
+
+<h2><span class="mw-headline" id="Style"><style>.foo {}</style>Style<style>.bar {}</style></span><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/index.php?title=Parser_test&amp;action=edit&amp;section=1" title="Edit section: Style">edit</a><span class="mw-editsection-bracket">]</span></span></h2>
+
+!! html/parsoid
+<meta property="mw:PageProp/toc" data-parsoid='{}'/>
+<h2 id="Style" data-parsoid='{}'><style>.foo {}</style>Style<style>.bar {}</style></h2>
+!! end
+
 !! test
 Empty <p> tag in TOC, removed by Sanitizer (T92892)
 !! wikitext
-- 
2.20.1