Sanitizer now correctly escapes lonely '>' occuring before the first wikitag.

Fix parsertest: "Always escape literal '>' in output, not just after '<'"

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 50b9f52..a7a481e 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -115,6 +115,7 @@ lighter making things easier to read.
 * Fix hardcoded background color in parserTests.php
 * parserTests.php : removed the 'light' option for --color argument, replacing
   it with a new global switch : $wgCommandLineDarkBg
+* Sanitizer now correctly escapes lonely '>' occuring before the first wikitag.
 
 == Languages updated ==
 

diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index ad2f777..ebe9d5a 100644 (file)
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -386,7 +386,7 @@ class Sanitizer {
                # Remove HTML comments
                $text = Sanitizer::removeHTMLcomments( $text );
                $bits = explode( '<', $text );
-               $text = array_shift( $bits );
+               $text = str_replace( '>', '&gt;', array_shift( $bits ) );
                if(!$wgUseTidy) {
                        $tagstack = $tablestack = array();
                        foreach ( $bits as $x ) {

diff --git a/maintenance/parserTests.txt b/maintenance/parserTests.txt
index 8c7a2ee..5465bae 100644 (file)
--- a/maintenance/parserTests.txt
+++ b/maintenance/parserTests.txt
@@ -255,7 +255,7 @@ everything starting with < followed by !-- until the first -- and > we see,
 that wouldn't be valid XML however, since in XML -- has to terminate a comment
 -->-->
 !! result
-<p>-->
+<p>--&gt;
 </p>
 !! end
 
@@ -264,7 +264,7 @@ Comment semantics: nesting
 !! input
 <!--<!-- no, we're not going to do anything fancy here -->-->
 !! result
-<p>-->
+<p>--&gt;
 </p>
 !! end
 
@@ -6060,7 +6060,7 @@ RAW magic word
 
 # This isn't needed for XHTML conformance, but would be handy as a fallback security measure
 !! test
-TODO: Always escape literal '>' in output, not just after '<'
+Always escape literal '>' in output, not just after '<'
 !! input
 ><>
 !! result