From b739dc6de24382ce738f4288da916169e2db6e4e Mon Sep 17 00:00:00 2001
From: Tim Starling <tstarling@users.mediawiki.org>
Date: Fri, 23 Jun 2006 09:20:44 +0000
Subject: [PATCH] Fixed issues with careless use of
 Sanitizer::decodeCharReferences(), added a parser test case for one of them.

---
 includes/Parser.php         |  7 +++++++
 maintenance/parserTests.txt | 10 ++++++++++
 2 files changed, 17 insertions(+)

diff --git a/includes/Parser.php b/includes/Parser.php
index 37832a9f0b..45ef8a14aa 100644
--- a/includes/Parser.php
+++ b/includes/Parser.php
@@ -1145,6 +1145,9 @@ class Parser
 			# Normalize any HTML entities in input. They will be
 			# re-escaped by makeExternalLink().
 			$url = Sanitizer::decodeCharReferences( $url );
+			
+			# Escape any control characters introduced by the above step
+			$url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F]/e', "urlencode('\\0')", $url );
 
 			# Process the trail (i.e. everything after this link up until start of the next link),
 			# replacing any non-bracketed links
@@ -1228,6 +1231,9 @@ class Parser
 				# Normalize any HTML entities in input. They will be
 				# re-escaped by makeExternalLink() or maybeMakeExternalImage()
 				$url = Sanitizer::decodeCharReferences( $url );
+				
+				# Escape any control characters introduced by the above step
+				$url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F]/e', "urlencode('\\0')", $url );
 
 				# Is this an external image?
 				$text = $this->maybeMakeExternalImage( $url );
@@ -1536,6 +1542,7 @@ class Parser
 						$sortkey = $text;
 					}
 					$sortkey = Sanitizer::decodeCharReferences( $sortkey );
+					$sortkey = str_replace( "\n", '', $sortkey );
 					$sortkey = $wgContLang->convertCategoryKey( $sortkey );
 					$this->mOutput->addCategory( $nt->getDBkey(), $sortkey );
 
diff --git a/maintenance/parserTests.txt b/maintenance/parserTests.txt
index cdf188c809..920f478863 100644
--- a/maintenance/parserTests.txt
+++ b/maintenance/parserTests.txt
@@ -5444,6 +5444,16 @@ section=1
                    a
 !! end
 
+!! test
+Handling of &#x0A; in URLs
+!! input
+**irc://&#x0A;a
+!! result
+<ul><li><ul><li><a href="irc://%0Aa" class="external free" title="irc://%0Aa" rel="nofollow">irc://%0Aa</a>
+</li></ul>
+</li></ul>
+
+!!end
 #
 #
 #
-- 
2.20.1