e89633f22fe21619797176e676a423ecb2f33019
3 * XHTML sanitizer for MediaWiki
5 * Copyright (C) 2002-2005 Brion Vibber <brion@pobox.com> et al
6 * http://www.mediawiki.org/
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
21 * http://www.gnu.org/copyleft/gpl.html
28 * Regular expression to match various types of character references in
29 * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
31 define( 'MW_CHAR_REFS_REGEX',
32 '/&([A-Za-z0-9\x80-\xff]+);
39 * Regular expression to match HTML/XML attribute pairs within a tag.
40 * Allows some... latitude.
41 * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
43 $attrib = '[A-Za-z0-9]';
44 $space = '[\x09\x0a\x0d\x20]';
45 define( 'MW_ATTRIBS_REGEX',
46 "/(?:^|$space)($attrib+)
49 # The attribute value: quoted or alone
52 | ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
53 | (\#[0-9a-fA-F]+) # Technically wrong, but lots of
54 # colors are specified like this.
55 # We'll be normalizing it.
57 )?(?=$space|\$)/sx" );
60 * List of all named character entities defined in HTML 4.01
61 * http://www.w3.org/TR/html4/sgml/entities.html
62 * This list does *not* include ', which is part of XHTML
63 * 1.0 but not HTML 4.01. It is handled as a special case in
67 global $wgHtmlEntities;
68 $wgHtmlEntities = array(
323 * Character entity aliases accepted by MediaWiki
324 * XXX: decodeEntity() assumes that all values in this array are valid keys to $wgHtmlEntities
326 global $wgHtmlEntityAliases;
327 $wgHtmlEntityAliases = array(
334 * XHTML sanitizer for MediaWiki
339 * Cleans up HTML, removes dangerous tags and attributes, and
340 * removes HTML comments
342 * @param string $text
343 * @param callback $processCallback to do any variable or parameter replacements in HTML attribute values
344 * @param array $args for the processing callback
347 static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array() ) {
350 static $htmlpairs, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
351 $htmllist, $listtags, $htmlsingleallowed, $htmlelements, $staticInitialised;
353 wfProfileIn( __METHOD__
);
355 if ( !$staticInitialised ) {
357 $htmlpairs = array_merge( $extratags, array( # Tags that must be closed
358 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
359 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
360 'strike', 'strong', 'tt', 'var', 'div', 'center',
361 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
362 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u'
365 'br', 'hr', 'li', 'dt', 'dd'
367 $htmlsingleonly = array( # Elements that cannot have close tags
370 $htmlnest = array( # Tags that can be nested--??
371 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
372 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
374 $tabletags = array( # Can only appear inside table, we will close them
377 $htmllist = array( # Tags used by list
380 $listtags = array( # Tags that can appear in a list
384 $htmlsingleallowed = array_merge( $htmlsingle, $tabletags );
385 $htmlelements = array_merge( $htmlsingle, $htmlpairs, $htmlnest );
387 # Convert them all to hashtables for faster lookup
388 $vars = array( 'htmlpairs', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
389 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelements' );
390 foreach ( $vars as $var ) {
391 $
$var = array_flip( $
$var );
393 $staticInitialised = true;
396 # Remove HTML comments
397 $text = Sanitizer
::removeHTMLcomments( $text );
398 $bits = explode( '<', $text );
399 $text = str_replace( '>', '>', array_shift( $bits ) );
401 $tagstack = $tablestack = array();
402 foreach ( $bits as $x ) {
404 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
405 list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
407 $slash = $t = $params = $brace = $rest = null;
411 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
415 if( isset( $htmlsingleonly[$t] ) ) {
417 } elseif ( ( $ot = @array_pop
( $tagstack ) ) != $t ) {
418 if ( isset( $htmlsingleallowed[$ot] ) ) {
419 # Pop all elements with an optional close tag
420 # and see if we find a match below them
422 array_push ($optstack, $ot);
423 while ( ( ( $ot = @array_pop
( $tagstack ) ) != $t ) &&
424 isset( $htmlsingleallowed[$ot] ) )
426 array_push ($optstack, $ot);
429 # No match. Push the optinal elements back again
431 while ( $ot = @array_pop
( $optstack ) ) {
432 array_push( $tagstack, $ot );
436 @array_push
( $tagstack, $ot );
437 # <li> can be nested in <ul> or <ol>, skip those cases:
438 if(!(isset( $htmllist[$ot] ) && isset( $listtags[$t] ) )) {
443 if ( $t == 'table' ) {
444 $tagstack = array_pop( $tablestack );
449 # Keep track for later
450 if ( isset( $tabletags[$t] ) &&
451 ! in_array( 'table', $tagstack ) ) {
453 } else if ( in_array( $t, $tagstack ) &&
454 ! isset( $htmlnest [$t ] ) ) {
456 #Â Is it a self closed htmlpair ? (bug 5487)
457 } else if( $brace == '/>' &&
458 isset( $htmlpairs[$t] ) ) {
460 } elseif( isset( $htmlsingleonly[$t] ) ) {
461 # Hack to force empty tag for uncloseable elements
463 } else if( isset( $htmlsingle[$t] ) ) {
464 # Hack to not close $htmlsingle tags
466 } else if( isset( $tabletags[$t] )
467 && in_array($t ,$tagstack) ) {
468 // New table tag but forgot to close the previous one
471 if ( $t == 'table' ) {
472 array_push( $tablestack, $tagstack );
475 array_push( $tagstack, $t );
478 # Replace any variables or template parameters with
480 if( is_callable( $processCallback ) ) {
481 call_user_func_array( $processCallback, array( &$params, $args ) );
484 # Strip non-approved attributes from the tag
485 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
488 $rest = str_replace( '>', '>', $rest );
489 $close = ( $brace == '/>' && !$slash ) ?
' /' : '';
490 $text .= "<$slash$t$newparams$close>$rest";
494 $text .= '<' . str_replace( '>', '>', $x);
496 # Close off any remaining tags
497 while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
499 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
502 # this might be possible using tidy itself
503 foreach ( $bits as $x ) {
504 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
506 @list
( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
507 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
508 if( is_callable( $processCallback ) ) {
509 call_user_func_array( $processCallback, array( &$params, $args ) );
511 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
512 $rest = str_replace( '>', '>', $rest );
513 $text .= "<$slash$t$newparams$brace$rest";
515 $text .= '<' . str_replace( '>', '>', $x);
519 wfProfileOut( __METHOD__
);
524 * Remove '<!--', '-->', and everything between.
525 * To avoid leaving blank lines, when a comment is both preceded
526 * and followed by a newline (ignoring spaces), trim leading and
527 * trailing spaces and one of the newlines.
530 * @param string $text
533 static function removeHTMLcomments( $text ) {
534 wfProfileIn( __METHOD__
);
535 while (($start = strpos($text, '<!--')) !== false) {
536 $end = strpos($text, '-->', $start +
4);
537 if ($end === false) {
538 # Unterminated comment; bail out
544 # Trim space and newline if the comment is both
545 # preceded and followed by a newline
546 $spaceStart = max($start - 1, 0);
547 $spaceLen = $end - $spaceStart;
548 while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
552 while (substr($text, $spaceStart +
$spaceLen, 1) === ' ')
554 if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart +
$spaceLen, 1) === "\n") {
555 # Remove the comment, leading and trailing
556 # spaces, and leave only one newline.
557 $text = substr_replace($text, "\n", $spaceStart, $spaceLen +
1);
560 # Remove just the comment.
561 $text = substr_replace($text, '', $start, $end - $start);
564 wfProfileOut( __METHOD__
);
569 * Take an array of attribute names and values and normalize or discard
570 * illegal values for the given element type.
572 * - Discards attributes not on a whitelist for the given element
573 * - Unsafe style attributes are discarded
574 * - Invalid id attributes are reencoded
576 * @param array $attribs
577 * @param string $element
580 * @todo Check for legal values where the DTD limits things.
581 * @todo Check for unique id attribute :P
583 static function validateTagAttributes( $attribs, $element ) {
584 return Sanitizer
::validateAttributes( $attribs,
585 Sanitizer
::attributeWhitelist( $element ) );
589 * Take an array of attribute names and values and normalize or discard
590 * illegal values for the given whitelist.
592 * - Discards attributes not the given whitelist
593 * - Unsafe style attributes are discarded
594 * - Invalid id attributes are reencoded
596 * @param array $attribs
597 * @param array $whitelist list of allowed attribute names
600 * @todo Check for legal values where the DTD limits things.
601 * @todo Check for unique id attribute :P
603 static function validateAttributes( $attribs, $whitelist ) {
604 $whitelist = array_flip( $whitelist );
606 foreach( $attribs as $attribute => $value ) {
607 if( !isset( $whitelist[$attribute] ) ) {
610 # Strip javascript "expression" from stylesheets.
611 # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
612 if( $attribute == 'style' ) {
613 $value = Sanitizer
::checkCss( $value );
614 if( $value === false ) {
620 if ( $attribute === 'id' ) {
621 global $wgEnforceHtmlIds;
622 $value = Sanitizer
::escapeId( $value,
623 $wgEnforceHtmlIds ?
array() : 'xml' );
626 // If this attribute was previously set, override it.
627 // Output should only have one attribute of each name.
628 $out[$attribute] = $value;
634 * Merge two sets of HTML attributes. Conflicting items in the second set
635 * will override those in the first, except for 'class' attributes which
636 * will be combined (if they're both strings).
638 * @todo implement merging for other attributes such as style
643 static function mergeAttributes( $a, $b ) {
644 $out = array_merge( $a, $b );
645 if( isset( $a['class'] ) && isset( $b['class'] )
646 && is_string( $a['class'] ) && is_string( $b['class'] )
647 && $a['class'] !== $b['class'] ) {
648 $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
649 -1, PREG_SPLIT_NO_EMPTY
);
650 $out['class'] = implode( ' ', array_unique( $classes ) );
656 * Pick apart some CSS and check it for forbidden or unsafe structures.
657 * Returns a sanitized string, or false if it was just too evil.
659 * Currently URL references, 'expression', 'tps' are forbidden.
661 * @param string $value
664 static function checkCss( $value ) {
665 $stripped = Sanitizer
::decodeCharReferences( $value );
667 // Remove any comments; IE gets token splitting wrong
668 $stripped = StringUtils
::delimiterReplace( '/*', '*/', ' ', $stripped );
672 // ... and continue checks
673 $stripped = preg_replace( '!\\\\([0-9A-Fa-f]{1,6})[ \\n\\r\\t\\f]?!e',
674 'codepointToUtf8(hexdec("$1"))', $stripped );
675 $stripped = str_replace( '\\', '', $stripped );
676 if( preg_match( '/(?:expression|tps*:\/\/|url\\s*\().*/is',
686 * Take a tag soup fragment listing an HTML element's attributes
687 * and normalize it to well-formed XML, discarding unwanted attributes.
688 * Output is safe for further wikitext processing, with escaping of
689 * values that could trigger problems.
691 * - Normalizes attribute names to lowercase
692 * - Discards attributes not on a whitelist for the given element
693 * - Turns broken or invalid entities into plaintext
694 * - Double-quotes all attribute values
695 * - Attributes without values are given the name as attribute
696 * - Double attributes are discarded
697 * - Unsafe style attributes are discarded
698 * - Prepends space if there are attributes.
700 * @param string $text
701 * @param string $element
704 static function fixTagAttributes( $text, $element ) {
705 if( trim( $text ) == '' ) {
709 $stripped = Sanitizer
::validateTagAttributes(
710 Sanitizer
::decodeTagAttributes( $text ), $element );
713 foreach( $stripped as $attribute => $value ) {
714 $encAttribute = htmlspecialchars( $attribute );
715 $encValue = Sanitizer
::safeEncodeAttribute( $value );
717 $attribs[] = "$encAttribute=\"$encValue\"";
719 return count( $attribs ) ?
' ' . implode( ' ', $attribs ) : '';
723 * Encode an attribute value for HTML output.
725 * @return HTML-encoded text fragment
727 static function encodeAttribute( $text ) {
728 $encValue = htmlspecialchars( $text, ENT_QUOTES
);
730 // Whitespace is normalized during attribute decoding,
731 // so if we've been passed non-spaces we must encode them
732 // ahead of time or they won't be preserved.
733 $encValue = strtr( $encValue, array(
743 * Encode an attribute value for HTML tags, with extra armoring
744 * against further wiki processing.
746 * @return HTML-encoded text fragment
748 static function safeEncodeAttribute( $text ) {
749 $encValue = Sanitizer
::encodeAttribute( $text );
751 # Templates and links may be expanded in later parsing,
752 # creating invalid or dangerous output. Suppress this.
753 $encValue = strtr( $encValue, array(
754 '<' => '<', // This should never happen,
755 '>' => '>', // we've received invalid input
756 '"' => '"', // which should have been escaped.
759 "''" => '''',
760 'ISBN' => 'ISBN',
762 'PMID' => 'PMID',
768 $encValue = preg_replace_callback(
769 '/(' . wfUrlProtocols() . ')/',
770 array( 'Sanitizer', 'armorLinksCallback' ),
776 * Given a value escape it so that it can be used in an id attribute and
777 * return it, this does not validate the value however (see first link)
779 * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters
782 * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
784 * @param string $id Id to validate
785 * @param mixed $options String or array of strings (default is array()):
786 * 'noninitial': This is a non-initial fragment of an id, not a full id,
787 * so don't pay attention if the first character isn't valid at the
788 * beginning of an id.
789 * 'xml': Don't restrict the id to be HTML4-compatible. This option
790 * allows any alphabetic character to be used, per the XML standard.
791 * Therefore, it also completely changes the type of escaping: instead
792 * of weird dot-encoding, runs of invalid characters (mostly
793 * whitespace) are just compressed into a single underscore.
796 static function escapeId( $id, $options = array() ) {
797 $options = (array)$options;
799 if ( !in_array( 'xml', $options ) ) {
800 # HTML4-style escaping
801 static $replace = array(
806 $id = urlencode( Sanitizer
::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
807 $id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
810 // Let's not go changing our links just yet, since we plan to
811 // rip this out anyway and switch to the prettier Unicode-friendly
812 // links as XHTML and HTML 5 allow and browsers seem to think is
815 if ( !preg_match( '/^[a-zA-Z]/', $id )
816 && !in_array( 'noninitial', $options ) ) {
817 // Initial character must be a letter!
824 # XML-style escaping. For the patterns used, see the XML 1.0 standard,
825 # 5th edition, NameStartChar and NameChar: <http://www.w3.org/TR/REC-xml/>
826 $nameStartChar = ':a-zA-Z_\xC0-\xD6\xD8-\xF6\xF8-\x{2FF}\x{370}-\x{37D}'
827 . '\x{37F}-\x{1FFF}\x{200C}-\x{200D}\x{2070}-\x{218F}\x{2C00}-\x{2FEF}'
828 . '\x{3001}-\x{D7FF}\x{F900}-\x{FDCF}\x{FDF0}-\x{FFFD}\x{10000}-\x{EFFFF}';
829 $nameChar = $nameStartChar . '.\-0-9\xB7\x{0300}-\x{036F}'
830 . '\x{203F}-\x{2040}';
831 # Replace _ as well so we don't get multiple consecutive underscores
832 $id = preg_replace( "/([^$nameChar]|_)+/u", '_', $id );
833 $id = trim( $id, '_' );
835 if ( !preg_match( "/^[$nameStartChar]/u", $id )
836 && !in_array( 'noninitial', $options ) ) {
844 * Given a value, escape it so that it can be used as a CSS class and
847 * @todo For extra validity, input should be validated UTF-8.
849 * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
851 * @param string $class
854 static function escapeClass( $class ) {
855 // Convert ugly stuff to underscores and kill underscores in ugly places
856 return rtrim(preg_replace(
857 array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
863 * Given HTML input, escape with htmlspecialchars but un-escape entites.
864 * This allows (generally harmless) entities like to survive.
866 * @param string $html String to escape
867 * @return string Escaped input
869 static function escapeHtmlAllowEntities( $html ) {
870 # It seems wise to escape ' as well as ", as a matter of course. Can't
872 $html = htmlspecialchars( $html, ENT_QUOTES
);
873 $html = str_replace( '&', '&', $html );
874 $html = Sanitizer
::normalizeCharReferences( $html );
879 * Regex replace callback for armoring links against further processing.
880 * @param array $matches
884 private static function armorLinksCallback( $matches ) {
885 return str_replace( ':', ':', $matches[1] );
889 * Return an associative array of attribute names and values from
890 * a partial tag string. Attribute names are forces to lowercase,
891 * character references are decoded to UTF-8 text.
896 public static function decodeTagAttributes( $text ) {
899 if( trim( $text ) == '' ) {
912 foreach( $pairs as $set ) {
913 $attribute = strtolower( $set[1] );
914 $value = Sanitizer
::getTagAttributeCallback( $set );
916 // Normalize whitespace
917 $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
918 $value = trim( $value );
920 // Decode character references
921 $attribs[$attribute] = Sanitizer
::decodeCharReferences( $value );
927 * Pick the appropriate attribute value from a match set from the
928 * MW_ATTRIBS_REGEX matches.
934 private static function getTagAttributeCallback( $set ) {
935 if( isset( $set[6] ) ) {
936 # Illegal #XXXXXX color with no quotes.
938 } elseif( isset( $set[5] ) ) {
941 } elseif( isset( $set[4] ) ) {
944 } elseif( isset( $set[3] ) ) {
947 } elseif( !isset( $set[2] ) ) {
948 # In XHTML, attributes must have a value.
949 # For 'reduced' form, return explicitly the attribute name here.
952 throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
957 * Normalize whitespace and character references in an XML source-
958 * encoded text for an attribute value.
960 * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
961 * but note that we are not returning the value, but are returning
962 * XML source fragments that will be slapped into output.
964 * @param string $text
968 private static function normalizeAttributeValue( $text ) {
969 return str_replace( '"', '"',
970 self
::normalizeWhitespace(
971 Sanitizer
::normalizeCharReferences( $text ) ) );
974 private static function normalizeWhitespace( $text ) {
976 '/\r\n|[\x20\x0d\x0a\x09]/',
982 * Ensure that any entities and character references are legal
983 * for XML and XHTML specifically. Any stray bits will be
984 * &-escaped to result in a valid text fragment.
986 * a. any named char refs must be known in XHTML
987 * b. any numeric char refs must be legal chars, not invalid or forbidden
988 * c. use &#x, not &#X
989 * d. fix or reject non-valid attributes
991 * @param string $text
995 static function normalizeCharReferences( $text ) {
996 return preg_replace_callback(
998 array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
1002 * @param string $matches
1005 static function normalizeCharReferencesCallback( $matches ) {
1007 if( $matches[1] != '' ) {
1008 $ret = Sanitizer
::normalizeEntity( $matches[1] );
1009 } elseif( $matches[2] != '' ) {
1010 $ret = Sanitizer
::decCharReference( $matches[2] );
1011 } elseif( $matches[3] != '' ) {
1012 $ret = Sanitizer
::hexCharReference( $matches[3] );
1013 } elseif( $matches[4] != '' ) {
1014 $ret = Sanitizer
::hexCharReference( $matches[4] );
1016 if( is_null( $ret ) ) {
1017 return htmlspecialchars( $matches[0] );
1024 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1025 * return the named entity reference as is. If the entity is a
1026 * MediaWiki-specific alias, returns the HTML equivalent. Otherwise,
1027 * returns HTML-escaped text of pseudo-entity source (eg &foo;)
1029 * @param string $name
1033 static function normalizeEntity( $name ) {
1034 global $wgHtmlEntities, $wgHtmlEntityAliases;
1035 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1036 return "&{$wgHtmlEntityAliases[$name]};";
1037 } elseif( isset( $wgHtmlEntities[$name] ) ) {
1039 } elseif( $name == 'apos' ) {
1040 return "'"; // "'" is valid in XHTML, but not in HTML4
1042 return "&$name;";
1046 static function decCharReference( $codepoint ) {
1047 $point = intval( $codepoint );
1048 if( Sanitizer
::validateCodepoint( $point ) ) {
1049 return sprintf( '&#%d;', $point );
1055 static function hexCharReference( $codepoint ) {
1056 $point = hexdec( $codepoint );
1057 if( Sanitizer
::validateCodepoint( $point ) ) {
1058 return sprintf( '&#x%x;', $point );
1065 * Returns true if a given Unicode codepoint is a valid character in XML.
1066 * @param int $codepoint
1069 private static function validateCodepoint( $codepoint ) {
1070 return ($codepoint == 0x09)
1071 ||
($codepoint == 0x0a)
1072 ||
($codepoint == 0x0d)
1073 ||
($codepoint >= 0x20 && $codepoint <= 0xd7ff)
1074 ||
($codepoint >= 0xe000 && $codepoint <= 0xfffd)
1075 ||
($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
1079 * Decode any character references, numeric or named entities,
1080 * in the text and return a UTF-8 string.
1082 * @param string $text
1087 public static function decodeCharReferences( $text ) {
1088 return preg_replace_callback(
1090 array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1095 * @param string $matches
1098 static function decodeCharReferencesCallback( $matches ) {
1099 if( $matches[1] != '' ) {
1100 return Sanitizer
::decodeEntity( $matches[1] );
1101 } elseif( $matches[2] != '' ) {
1102 return Sanitizer
::decodeChar( intval( $matches[2] ) );
1103 } elseif( $matches[3] != '' ) {
1104 return Sanitizer
::decodeChar( hexdec( $matches[3] ) );
1105 } elseif( $matches[4] != '' ) {
1106 return Sanitizer
::decodeChar( hexdec( $matches[4] ) );
1108 # Last case should be an ampersand by itself
1113 * Return UTF-8 string for a codepoint if that is a valid
1114 * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
1115 * @param int $codepoint
1119 static function decodeChar( $codepoint ) {
1120 if( Sanitizer
::validateCodepoint( $codepoint ) ) {
1121 return codepointToUtf8( $codepoint );
1123 return UTF8_REPLACEMENT
;
1128 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1129 * return the UTF-8 encoding of that character. Otherwise, returns
1130 * pseudo-entity source (eg &foo;)
1132 * @param string $name
1135 static function decodeEntity( $name ) {
1136 global $wgHtmlEntities, $wgHtmlEntityAliases;
1137 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1138 $name = $wgHtmlEntityAliases[$name];
1140 if( isset( $wgHtmlEntities[$name] ) ) {
1141 return codepointToUtf8( $wgHtmlEntities[$name] );
1142 } elseif( $name == 'apos' ) {
1143 return "'"; // "'" is not in $wgHtmlEntities, but it's still valid XHTML
1150 * Fetch the whitelist of acceptable attributes for a given
1153 * @param string $element
1156 static function attributeWhitelist( $element ) {
1158 if( !isset( $list ) ) {
1159 $list = Sanitizer
::setupAttributeWhitelist();
1161 return isset( $list[$element] )
1167 * Foreach array key (an allowed HTML element), return an array
1168 * of allowed attributes
1171 static function setupAttributeWhitelist() {
1172 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );
1173 $block = array_merge( $common, array( 'align' ) );
1174 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1175 $tablecell = array( 'abbr',
1181 'nowrap', # deprecated
1182 'width', # deprecated
1183 'height', # deprecated
1184 'bgcolor' # deprecated
1187 # Numbers refer to sections in HTML 4.01 standard describing the element.
1188 # See: http://www.w3.org/TR/html4/
1189 $whitelist = array (
1192 'center' => $common, # deprecated
1193 'span' => $block, # ??
1211 'strong' => $common,
1222 'blockquote' => array_merge( $common, array( 'cite' ) ),
1233 'br' => array( 'id', 'class', 'title', 'style', 'clear' ),
1236 'pre' => array_merge( $common, array( 'width' ) ),
1239 'ins' => array_merge( $common, array( 'cite', 'datetime' ) ),
1240 'del' => array_merge( $common, array( 'cite', 'datetime' ) ),
1243 'ul' => array_merge( $common, array( 'type' ) ),
1244 'ol' => array_merge( $common, array( 'type', 'start' ) ),
1245 'li' => array_merge( $common, array( 'type', 'value' ) ),
1253 'table' => array_merge( $common,
1254 array( 'summary', 'width', 'border', 'frame',
1255 'rules', 'cellspacing', 'cellpadding',
1260 'caption' => array_merge( $common, array( 'align' ) ),
1263 'thead' => array_merge( $common, $tablealign ),
1264 'tfoot' => array_merge( $common, $tablealign ),
1265 'tbody' => array_merge( $common, $tablealign ),
1268 'colgroup' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1269 'col' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1272 'tr' => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1275 'td' => array_merge( $common, $tablecell, $tablealign ),
1276 'th' => array_merge( $common, $tablecell, $tablealign ),
1279 # Not usually allowed, but may be used for extension-style hooks
1280 # such as <math> when it is rasterized
1281 'img' => array_merge( $common, array( 'alt' ) ),
1289 'strike' => $common,
1294 'font' => array_merge( $common, array( 'size', 'color', 'face' ) ),
1298 'hr' => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1300 # XHTML Ruby annotation text module, simple ruby only.
1301 # http://www.w3c.org/TR/ruby/
1306 'rt' => $common, #array_merge( $common, array( 'rbspan' ) ),
1309 # MathML root element, where used for extensions
1310 # 'title' may not be 100% valid here; it's XHTML
1311 # http://www.w3.org/TR/REC-MathML/
1312 'math' => array( 'class', 'style', 'id', 'title' ),
1318 * Take a fragment of (potentially invalid) HTML and return
1319 * a version with any tags removed, encoded as plain text.
1321 * Warning: this return value must be further escaped for literal
1322 * inclusion in HTML output as of 1.10!
1324 * @param string $text HTML fragment
1327 static function stripAllTags( $text ) {
1329 $text = StringUtils
::delimiterReplace( '<', '>', '', $text );
1331 # Normalize &entities and whitespace
1332 $text = self
::decodeCharReferences( $text );
1333 $text = self
::normalizeWhitespace( $text );
1339 * Hack up a private DOCTYPE with HTML's standard entity declarations.
1340 * PHP 4 seemed to know these if you gave it an HTML doctype, but
1343 * Use for passing XHTML fragments to PHP's XML parsing functions
1348 static function hackDocType() {
1349 global $wgHtmlEntities;
1350 $out = "<!DOCTYPE html [\n";
1351 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1352 $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1358 static function cleanUrl( $url ) {
1359 # Normalize any HTML entities in input. They will be
1360 # re-escaped by makeExternalLink().
1361 $url = Sanitizer
::decodeCharReferences( $url );
1363 # Escape any control characters introduced by the above step
1364 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F]/e', "urlencode('\\0')", $url );
1366 # Validate hostname portion
1368 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1369 list( /* $whole */, $protocol, $host, $rest ) = $matches;
1371 // Characters that will be ignored in IDNs.
1372 // http://tools.ietf.org/html/3454#section-3.1
1373 // Strip them before further processing so blacklists and such work.
1375 \\s| # general whitespace
1376 \xc2\xad| # 00ad SOFT HYPHEN
1377 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1378 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1379 \xe2\x81\xa0| # 2060 WORD JOINER
1380 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1381 \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
1382 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1383 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1384 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1385 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1386 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1387 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1390 $host = preg_replace( $strip, '', $host );
1392 // @fixme: validate hostnames here
1394 return $protocol . $host . $rest;