3 * XHTML sanitizer for MediaWiki
5 * Copyright © 2002-2005 Brion Vibber <brion@pobox.com> et al
6 * http://www.mediawiki.org/
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
21 * http://www.gnu.org/copyleft/gpl.html
28 * Regular expression to match various types of character references in
29 * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
31 define( 'MW_CHAR_REFS_REGEX',
32 '/&([A-Za-z0-9\x80-\xff]+);
39 * Regular expression to match HTML/XML attribute pairs within a tag.
40 * Allows some... latitude.
41 * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
43 $attrib_first = '[:A-Z_a-z]';
44 $attrib = '[:A-Z_a-z-.0-9]';
45 $space = '[\x09\x0a\x0d\x20]';
46 define( 'MW_ATTRIBS_REGEX',
47 "/(?:^|$space)({$attrib_first}{$attrib}*)
50 # The attribute value: quoted or alone
53 | ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
54 | (\#[0-9a-fA-F]+) # Technically wrong, but lots of
55 # colors are specified like this.
56 # We'll be normalizing it.
58 )?(?=$space|\$)/sx" );
61 * Regular expression to match URIs that could trigger script execution
63 define( 'MW_EVIL_URI_PATTERN', '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i' );
66 * Regular expression to match namespace attributes
68 define( 'MW_XMLNS_ATTRIBUTE_PATTRN', "/^xmlns:$attrib+$/" );
71 * List of all named character entities defined in HTML 4.01
72 * http://www.w3.org/TR/html4/sgml/entities.html
75 global $wgHtmlEntities;
76 $wgHtmlEntities = array(
331 * Character entity aliases accepted by MediaWiki
333 global $wgHtmlEntityAliases;
334 $wgHtmlEntityAliases = array(
341 * XHTML sanitizer for MediaWiki
346 * Cleans up HTML, removes dangerous tags and attributes, and
347 * removes HTML comments
349 * @param $text String
350 * @param $processCallback Callback to do any variable or parameter replacements in HTML attribute values
351 * @param $args Array for the processing callback
352 * @param $extratags Array for any extra tags to include
353 * @param $removetags Array for any tags (default or extra) to exclude
356 static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array(), $removetags = array() ) {
359 static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
360 $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
362 wfProfileIn( __METHOD__
);
364 if ( !$staticInitialised ) {
366 $htmlpairsStatic = array( # Tags that must be closed
367 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
368 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
369 'strike', 'strong', 'tt', 'var', 'div', 'center',
370 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
371 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u', 'abbr', 'dfn'
374 'br', 'hr', 'li', 'dt', 'dd'
376 $htmlsingleonly = array( # Elements that cannot have close tags
379 $htmlnest = array( # Tags that can be nested--??
380 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
381 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
383 $tabletags = array( # Can only appear inside table, we will close them
386 $htmllist = array( # Tags used by list
389 $listtags = array( # Tags that can appear in a list
393 global $wgAllowImageTag;
394 if ( $wgAllowImageTag ) {
395 $htmlsingle[] = 'img';
396 $htmlsingleonly[] = 'img';
399 $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
400 $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
402 # Convert them all to hashtables for faster lookup
403 $vars = array( 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
404 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' );
405 foreach ( $vars as $var ) {
406 $
$var = array_flip( $
$var );
408 $staticInitialised = true;
410 # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
411 $extratags = array_flip( $extratags );
412 $removetags = array_flip( $removetags );
413 $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
414 $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ) , $removetags );
416 # Remove HTML comments
417 $text = Sanitizer
::removeHTMLcomments( $text );
418 $bits = explode( '<', $text );
419 $text = str_replace( '>', '>', array_shift( $bits ) );
421 $tagstack = $tablestack = array();
422 foreach ( $bits as $x ) {
424 # $slash: Does the current element start with a '/'?
425 # $t: Current element name
426 # $params: String between element name and >
427 # $brace: Ending '>' or '/>'
428 # $rest: Everything until the next element of $bits
429 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
430 list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
432 $slash = $t = $params = $brace = $rest = null;
436 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
438 if ( $slash && isset( $htmlsingleonly[$t] ) ) {
440 } elseif ( $slash ) {
441 # Closing a tag... is it the one we just opened?
442 $ot = @array_pop
( $tagstack );
444 if ( isset( $htmlsingleallowed[$ot] ) ) {
445 # Pop all elements with an optional close tag
446 # and see if we find a match below them
448 array_push( $optstack, $ot );
449 $ot = @array_pop
( $tagstack );
450 while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
451 array_push( $optstack, $ot );
452 $ot = @array_pop
( $tagstack );
455 # No match. Push the optional elements back again
457 while ( $ot = @array_pop
( $optstack ) ) {
458 array_push( $tagstack, $ot );
462 @array_push
( $tagstack, $ot );
463 # <li> can be nested in <ul> or <ol>, skip those cases:
464 if ( !isset( $htmllist[$ot] ) ||
!isset( $listtags[$t] ) ) {
469 if ( $t == 'table' ) {
470 $tagstack = array_pop( $tablestack );
475 # Keep track for later
476 if ( isset( $tabletags[$t] ) &&
477 !in_array( 'table', $tagstack ) ) {
479 } elseif ( in_array( $t, $tagstack ) &&
480 !isset( $htmlnest [$t ] ) ) {
482 # Is it a self closed htmlpair ? (bug 5487)
483 } elseif ( $brace == '/>' &&
484 isset( $htmlpairs[$t] ) ) {
486 } elseif ( isset( $htmlsingleonly[$t] ) ) {
487 # Hack to force empty tag for uncloseable elements
489 } elseif ( isset( $htmlsingle[$t] ) ) {
490 # Hack to not close $htmlsingle tags
492 } elseif ( isset( $tabletags[$t] )
493 && in_array( $t, $tagstack ) ) {
494 // New table tag but forgot to close the previous one
497 if ( $t == 'table' ) {
498 array_push( $tablestack, $tagstack );
501 array_push( $tagstack, $t );
504 # Replace any variables or template parameters with
506 if( is_callable( $processCallback ) ) {
507 call_user_func_array( $processCallback, array( &$params, $args ) );
510 # Strip non-approved attributes from the tag
511 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
514 $rest = str_replace( '>', '>', $rest );
515 $close = ( $brace == '/>' && !$slash ) ?
' /' : '';
516 $text .= "<$slash$t$newparams$close>$rest";
520 $text .= '<' . str_replace( '>', '>', $x);
522 # Close off any remaining tags
523 while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
525 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
528 # this might be possible using tidy itself
529 foreach ( $bits as $x ) {
530 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
532 @list
( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
533 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
534 if( is_callable( $processCallback ) ) {
535 call_user_func_array( $processCallback, array( &$params, $args ) );
537 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
538 $rest = str_replace( '>', '>', $rest );
539 $text .= "<$slash$t$newparams$brace$rest";
541 $text .= '<' . str_replace( '>', '>', $x);
545 wfProfileOut( __METHOD__
);
550 * Remove '<!--', '-->', and everything between.
551 * To avoid leaving blank lines, when a comment is both preceded
552 * and followed by a newline (ignoring spaces), trim leading and
553 * trailing spaces and one of the newlines.
556 * @param $text String
559 static function removeHTMLcomments( $text ) {
560 wfProfileIn( __METHOD__
);
561 while (($start = strpos($text, '<!--')) !== false) {
562 $end = strpos($text, '-->', $start +
4);
563 if ($end === false) {
564 # Unterminated comment; bail out
570 # Trim space and newline if the comment is both
571 # preceded and followed by a newline
572 $spaceStart = max($start - 1, 0);
573 $spaceLen = $end - $spaceStart;
574 while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
578 while (substr($text, $spaceStart +
$spaceLen, 1) === ' ')
580 if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart +
$spaceLen, 1) === "\n") {
581 # Remove the comment, leading and trailing
582 # spaces, and leave only one newline.
583 $text = substr_replace($text, "\n", $spaceStart, $spaceLen +
1);
586 # Remove just the comment.
587 $text = substr_replace($text, '', $start, $end - $start);
590 wfProfileOut( __METHOD__
);
595 * Take an array of attribute names and values and normalize or discard
596 * illegal values for the given element type.
598 * - Discards attributes not on a whitelist for the given element
599 * - Unsafe style attributes are discarded
600 * - Invalid id attributes are reencoded
602 * @param $attribs Array
603 * @param $element String
606 * @todo Check for legal values where the DTD limits things.
607 * @todo Check for unique id attribute :P
609 static function validateTagAttributes( $attribs, $element ) {
610 return Sanitizer
::validateAttributes( $attribs,
611 Sanitizer
::attributeWhitelist( $element ) );
615 * Take an array of attribute names and values and normalize or discard
616 * illegal values for the given whitelist.
618 * - Discards attributes not the given whitelist
619 * - Unsafe style attributes are discarded
620 * - Invalid id attributes are reencoded
622 * @param $attribs Array
623 * @param $whitelist Array: list of allowed attribute names
626 * @todo Check for legal values where the DTD limits things.
627 * @todo Check for unique id attribute :P
629 static function validateAttributes( $attribs, $whitelist ) {
630 global $wgAllowRdfaAttributes, $wgAllowMicrodataAttributes;
632 $whitelist = array_flip( $whitelist );
633 $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
636 foreach( $attribs as $attribute => $value ) {
637 #allow XML namespace declaration if RDFa is enabled
638 if ( $wgAllowRdfaAttributes && preg_match( MW_XMLNS_ATTRIBUTE_PATTRN
, $attribute ) ) {
639 if ( !preg_match( MW_EVIL_URI_PATTERN
, $value ) ) {
640 $out[$attribute] = $value;
646 if( !isset( $whitelist[$attribute] ) ) {
650 # Strip javascript "expression" from stylesheets.
651 # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
652 if( $attribute == 'style' ) {
653 $value = Sanitizer
::checkCss( $value );
656 if ( $attribute === 'id' ) {
657 $value = Sanitizer
::escapeId( $value, 'noninitial' );
660 //RDFa and microdata properties allow URLs, URIs and/or CURIs. check them for sanity
661 if ( $attribute === 'rel' ||
$attribute === 'rev' ||
662 $attribute === 'about' ||
$attribute === 'property' ||
$attribute === 'resource' ||
#RDFa
663 $attribute === 'datatype' ||
$attribute === 'typeof' ||
#RDFa
664 $attribute === 'itemid' ||
$attribute === 'itemprop' ||
$attribute === 'itemref' ||
#HTML5 microdata
665 $attribute === 'itemscope' ||
$attribute === 'itemtype' ) { #HTML5 microdata
667 //Paranoia. Allow "simple" values but suppress javascript
668 if ( preg_match( MW_EVIL_URI_PATTERN
, $value ) ) {
673 # NOTE: even though elements using href/src are not allowed directly, supply
674 # validation code that can be used by tag hook handlers, etc
675 if ( $attribute === 'href' ||
$attribute === 'src' ) {
676 if ( !preg_match( $hrefExp, $value ) ) {
677 continue; //drop any href or src attributes not using an allowed protocol.
678 //NOTE: this also drops all relative URLs
682 // If this attribute was previously set, override it.
683 // Output should only have one attribute of each name.
684 $out[$attribute] = $value;
687 if ( $wgAllowMicrodataAttributes ) {
688 # There are some complicated validity constraints we need to
689 # enforce here. First of all, we don't want to allow non-standard
691 $allowedTypes = array(
692 'http://microformats.org/profile/hcard',
693 'http://microformats.org/profile/hcalendar#vevent',
694 'http://n.whatwg.org/work',
696 if ( isset( $out['itemtype'] ) && !in_array( $out['itemtype'],
699 unset( $out['itemscope'] );
701 # itemtype, itemid, itemref don't make sense without itemscope
702 if ( !array_key_exists( 'itemscope', $out ) ) {
703 unset( $out['itemtype'] );
704 unset( $out['itemid'] );
705 unset( $out['itemref'] );
707 # TODO: Strip itemprop if we aren't descendants of an itemscope.
713 * Merge two sets of HTML attributes. Conflicting items in the second set
714 * will override those in the first, except for 'class' attributes which
715 * will be combined (if they're both strings).
717 * @todo implement merging for other attributes such as style
722 static function mergeAttributes( $a, $b ) {
723 $out = array_merge( $a, $b );
724 if( isset( $a['class'] ) && isset( $b['class'] )
725 && is_string( $a['class'] ) && is_string( $b['class'] )
726 && $a['class'] !== $b['class'] ) {
727 $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
728 -1, PREG_SPLIT_NO_EMPTY
);
729 $out['class'] = implode( ' ', array_unique( $classes ) );
735 * Pick apart some CSS and check it for forbidden or unsafe structures.
736 * Returns a sanitized string, or false if it was just too evil.
738 * Currently URL references, 'expression', 'tps' are forbidden.
740 * @param $value String
743 static function checkCss( $value ) {
744 $value = Sanitizer
::decodeCharReferences( $value );
746 // Remove any comments; IE gets token splitting wrong
747 $value = StringUtils
::delimiterReplace( '/*', '*/', ' ', $value );
749 // Decode escape sequences and line continuation
750 // See the grammar in the CSS 2 spec, appendix D.
751 static $decodeRegex, $reencodeTable;
752 if ( !$decodeRegex ) {
753 $space = '[\\x20\\t\\r\\n\\f]';
754 $nl = '(?:\\n|\\r\\n|\\r|\\f)';
756 $decodeRegex = "/ $backslash
758 ($nl) | # 1. Line continuation
759 ([0-9A-Fa-f]{1,6})$space? | # 2. character number
760 (.) | # 3. backslash cancelling special meaning
761 () | # 4. backslash at end of string
764 $value = preg_replace_callback( $decodeRegex,
765 array( __CLASS__
, 'cssDecodeCallback' ), $value );
767 // Reject problematic keywords and control characters
768 if ( preg_match( '/[\000-\010\016-\037\177]/', $value ) ) {
769 return '/* invalid control char */';
770 } elseif ( preg_match( '! expression | filter\s*: | accelerator\s*: | url\s*\( !ix', $value ) ) {
771 return '/* insecure input */';
776 static function cssDecodeCallback( $matches ) {
777 if ( $matches[1] !== '' ) {
780 } elseif ( $matches[2] !== '' ) {
781 $char = codepointToUtf8( hexdec( $matches[2] ) );
782 } elseif ( $matches[3] !== '' ) {
787 if ( $char == "\n" ||
$char == '"' ||
$char == "'" ||
$char == '\\' ) {
788 // These characters need to be escaped in strings
789 // Clean up the escape sequence to avoid parsing errors by clients
790 return '\\' . dechex( ord( $char ) ) . ' ';
792 // Decode unnecessary escape
798 * Take an associative array of attribute name/value pairs
799 * and generate a css style representing all the style-related
800 * attributes. If there already a style attribute in the array,
801 * it is also included in the value returned.
803 static function styleFromAttributes( $attributes ) {
806 foreach ( $attributes as $attribute => $value ) {
807 if ( $attribute == 'bgcolor' ) {
808 $styles[] = "background-color: $value";
809 } else if ( $attribute == 'border' ) {
810 $styles[] = "border-width: $value";
811 } else if ( $attribute == 'align' ) {
812 $styles[] = "text-align: $value";
813 } else if ( $attribute == 'valign' ) {
814 $styles[] = "vertical-align: $value";
815 } else if ( $attribute == 'width' ) {
816 if ( preg_match( '/\d+/', $value ) === false ) {
820 $styles[] = "width: $value";
821 } else if ( $attribute == 'height' ) {
822 if ( preg_match( '/\d+/', $value ) === false ) {
826 $styles[] = "height: $value";
827 } else if ( $attribute == 'nowrap' ) {
829 $styles[] = "white-space: nowrap";
834 if ( isset( $attributes[ 'style' ] ) ) {
835 $styles[] = $attributes[ 'style' ];
838 if ( !$styles ) return '';
839 else return implode( '; ', $styles );
843 * Take a tag soup fragment listing an HTML element's attributes
844 * and normalize it to well-formed XML, discarding unwanted attributes.
845 * Output is safe for further wikitext processing, with escaping of
846 * values that could trigger problems.
848 * - Normalizes attribute names to lowercase
849 * - Discards attributes not on a whitelist for the given element
850 * - Turns broken or invalid entities into plaintext
851 * - Double-quotes all attribute values
852 * - Attributes without values are given the name as attribute
853 * - Double attributes are discarded
854 * - Unsafe style attributes are discarded
855 * - Prepends space if there are attributes.
857 * @param $text String
858 * @param $element String
859 * @param $defaults Array (optional) associative array of default attributes to splice in.
860 * class and style attributes are combined. Otherwise, values from
861 * $attributes take precedence over values from $defaults.
864 static function fixTagAttributes( $text, $element, $defaults = null ) {
865 if( trim( $text ) == '' ) {
869 $decoded = Sanitizer
::decodeTagAttributes( $text );
870 $stripped = Sanitizer
::validateTagAttributes( $decoded, $element );
871 $attribs = Sanitizer
::collapseTagAttributes( $stripped, $defaults );
877 * Take an associative array or attribute name/value pairs
878 * and collapses it to well-formed XML.
879 * Does not filter attributes.
880 * Output is safe for further wikitext processing, with escaping of
881 * values that could trigger problems.
883 * - Double-quotes all attribute values
884 * - Prepends space if there are attributes.
886 * @param $attributes Array is an associative array of attribute name/value pairs.
887 * Assumed to be sanitized already.
888 * @param $defaults Array (optional) associative array of default attributes to splice in.
889 * class and style attributes are combined. Otherwise, values from
890 * $attributes take precedence over values from $defaults.
893 static function collapseTagAttributes( $attributes, $defaults = null ) {
895 foreach( $defaults as $attribute => $value ) {
896 if ( isset( $attributes[ $attribute ] ) ) {
897 if ( $attribute == 'class' ) {
898 $value .= ' '. $attributes[ $attribute ];
899 } else if ( $attribute == 'style' ) {
900 $value .= '; ' . $attributes[ $attribute ];
906 $attributes[ $attribute ] = $value;
912 foreach( $attributes as $attribute => $value ) {
913 $encAttribute = htmlspecialchars( $attribute );
914 $encValue = Sanitizer
::safeEncodeAttribute( $value );
916 $chunks[] = "$encAttribute=\"$encValue\"";
918 return count( $chunks ) ?
' ' . implode( ' ', $chunks ) : '';
922 * Encode an attribute value for HTML output.
923 * @param $text String
924 * @return HTML-encoded text fragment
926 static function encodeAttribute( $text ) {
927 $encValue = htmlspecialchars( $text, ENT_QUOTES
);
929 // Whitespace is normalized during attribute decoding,
930 // so if we've been passed non-spaces we must encode them
931 // ahead of time or they won't be preserved.
932 $encValue = strtr( $encValue, array(
942 * Encode an attribute value for HTML tags, with extra armoring
943 * against further wiki processing.
944 * @param $text String
945 * @return HTML-encoded text fragment
947 static function safeEncodeAttribute( $text ) {
948 $encValue = Sanitizer
::encodeAttribute( $text );
950 # Templates and links may be expanded in later parsing,
951 # creating invalid or dangerous output. Suppress this.
952 $encValue = strtr( $encValue, array(
953 '<' => '<', // This should never happen,
954 '>' => '>', // we've received invalid input
955 '"' => '"', // which should have been escaped.
958 "''" => '''',
959 'ISBN' => 'ISBN',
961 'PMID' => 'PMID',
967 $encValue = preg_replace_callback(
968 '/(' . wfUrlProtocols() . ')/',
969 array( 'Sanitizer', 'armorLinksCallback' ),
975 * Given a value, escape it so that it can be used in an id attribute and
976 * return it. This will use HTML5 validation if $wgExperimentalHtmlIds is
977 * true, allowing anything but ASCII whitespace. Otherwise it will use
978 * HTML 4 rules, which means a narrow subset of ASCII, with bad characters
979 * escaped with lots of dots.
981 * To ensure we don't have to bother escaping anything, we also strip ', ",
982 * & even if $wgExperimentalIds is true. TODO: Is this the best tactic?
983 * We also strip # because it upsets IE6.
985 * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters
988 * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
989 * @see http://www.whatwg.org/specs/web-apps/current-work/multipage/elements.html#the-id-attribute
990 * HTML5 definition of id attribute
992 * @param $id String: id to escape
993 * @param $options Mixed: string or array of strings (default is array()):
994 * 'noninitial': This is a non-initial fragment of an id, not a full id,
995 * so don't pay attention if the first character isn't valid at the
996 * beginning of an id. Only matters if $wgExperimentalHtmlIds is
998 * 'legacy': Behave the way the old HTML 4-based ID escaping worked even
999 * if $wgExperimentalHtmlIds is used, so we can generate extra
1000 * anchors and links won't break.
1003 static function escapeId( $id, $options = array() ) {
1004 global $wgHtml5, $wgExperimentalHtmlIds;
1005 $options = (array)$options;
1007 if ( $wgHtml5 && $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) {
1008 $id = Sanitizer
::decodeCharReferences( $id );
1009 $id = preg_replace( '/[ \t\n\r\f_\'"&#]+/', '_', $id );
1010 $id = trim( $id, '_' );
1012 # Must have been all whitespace to start with.
1019 # HTML4-style escaping
1020 static $replace = array(
1025 $id = urlencode( Sanitizer
::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
1026 $id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
1028 if ( !preg_match( '/^[a-zA-Z]/', $id )
1029 && !in_array( 'noninitial', $options ) ) {
1030 // Initial character must be a letter!
1037 * Given a value, escape it so that it can be used as a CSS class and
1040 * @todo For extra validity, input should be validated UTF-8.
1042 * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
1044 * @param $class String
1047 static function escapeClass( $class ) {
1048 // Convert ugly stuff to underscores and kill underscores in ugly places
1049 return rtrim(preg_replace(
1050 array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
1056 * Given HTML input, escape with htmlspecialchars but un-escape entites.
1057 * This allows (generally harmless) entities like   to survive.
1059 * @param $html String to escape
1060 * @return String: escaped input
1062 static function escapeHtmlAllowEntities( $html ) {
1063 $html = Sanitizer
::decodeCharReferences( $html );
1064 # It seems wise to escape ' as well as ", as a matter of course. Can't
1066 $html = htmlspecialchars( $html, ENT_QUOTES
);
1071 * Regex replace callback for armoring links against further processing.
1072 * @param $matches Array
1075 private static function armorLinksCallback( $matches ) {
1076 return str_replace( ':', ':', $matches[1] );
1080 * Return an associative array of attribute names and values from
1081 * a partial tag string. Attribute names are forces to lowercase,
1082 * character references are decoded to UTF-8 text.
1084 * @param $text String
1087 public static function decodeTagAttributes( $text ) {
1088 if( trim( $text ) == '' ) {
1094 if( !preg_match_all(
1098 PREG_SET_ORDER
) ) {
1102 foreach( $pairs as $set ) {
1103 $attribute = strtolower( $set[1] );
1104 $value = Sanitizer
::getTagAttributeCallback( $set );
1106 // Normalize whitespace
1107 $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1108 $value = trim( $value );
1110 // Decode character references
1111 $attribs[$attribute] = Sanitizer
::decodeCharReferences( $value );
1117 * Pick the appropriate attribute value from a match set from the
1118 * MW_ATTRIBS_REGEX matches.
1123 private static function getTagAttributeCallback( $set ) {
1124 if( isset( $set[6] ) ) {
1125 # Illegal #XXXXXX color with no quotes.
1127 } elseif( isset( $set[5] ) ) {
1130 } elseif( isset( $set[4] ) ) {
1133 } elseif( isset( $set[3] ) ) {
1136 } elseif( !isset( $set[2] ) ) {
1137 # In XHTML, attributes must have a value.
1138 # For 'reduced' form, return explicitly the attribute name here.
1141 throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1146 * Normalize whitespace and character references in an XML source-
1147 * encoded text for an attribute value.
1149 * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
1150 * but note that we're not returning the value, but are returning
1151 * XML source fragments that will be slapped into output.
1153 * @param $text String
1156 private static function normalizeAttributeValue( $text ) {
1157 return str_replace( '"', '"',
1158 self
::normalizeWhitespace(
1159 Sanitizer
::normalizeCharReferences( $text ) ) );
1162 private static function normalizeWhitespace( $text ) {
1163 return preg_replace(
1164 '/\r\n|[\x20\x0d\x0a\x09]/',
1170 * Normalizes whitespace in a section name, such as might be returned
1171 * by Parser::stripSectionName(), for use in the id's that are used for
1174 * @param $section String
1177 static function normalizeSectionNameWhitespace( $section ) {
1178 return trim( preg_replace( '/[ _]+/', ' ', $section ) );
1182 * Ensure that any entities and character references are legal
1183 * for XML and XHTML specifically. Any stray bits will be
1184 * &-escaped to result in a valid text fragment.
1186 * a. any named char refs must be known in XHTML
1187 * b. any numeric char refs must be legal chars, not invalid or forbidden
1188 * c. use &#x, not &#X
1189 * d. fix or reject non-valid attributes
1191 * @param $text String
1195 static function normalizeCharReferences( $text ) {
1196 return preg_replace_callback(
1198 array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
1202 * @param $matches String
1205 static function normalizeCharReferencesCallback( $matches ) {
1207 if( $matches[1] != '' ) {
1208 $ret = Sanitizer
::normalizeEntity( $matches[1] );
1209 } elseif( $matches[2] != '' ) {
1210 $ret = Sanitizer
::decCharReference( $matches[2] );
1211 } elseif( $matches[3] != '' ) {
1212 $ret = Sanitizer
::hexCharReference( $matches[3] );
1213 } elseif( $matches[4] != '' ) {
1214 $ret = Sanitizer
::hexCharReference( $matches[4] );
1216 if( is_null( $ret ) ) {
1217 return htmlspecialchars( $matches[0] );
1224 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1225 * return the named entity reference as is. If the entity is a
1226 * MediaWiki-specific alias, returns the HTML equivalent. Otherwise,
1227 * returns HTML-escaped text of pseudo-entity source (eg &foo;)
1229 * @param $name String
1232 static function normalizeEntity( $name ) {
1233 global $wgHtmlEntities, $wgHtmlEntityAliases;
1234 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1235 return "&{$wgHtmlEntityAliases[$name]};";
1236 } elseif( isset( $wgHtmlEntities[$name] ) ) {
1239 return "&$name;";
1243 static function decCharReference( $codepoint ) {
1244 $point = intval( $codepoint );
1245 if( Sanitizer
::validateCodepoint( $point ) ) {
1246 return sprintf( '&#%d;', $point );
1252 static function hexCharReference( $codepoint ) {
1253 $point = hexdec( $codepoint );
1254 if( Sanitizer
::validateCodepoint( $point ) ) {
1255 return sprintf( '&#x%x;', $point );
1262 * Returns true if a given Unicode codepoint is a valid character in XML.
1263 * @param $codepoint Integer
1266 private static function validateCodepoint( $codepoint ) {
1267 return ($codepoint == 0x09)
1268 ||
($codepoint == 0x0a)
1269 ||
($codepoint == 0x0d)
1270 ||
($codepoint >= 0x20 && $codepoint <= 0xd7ff)
1271 ||
($codepoint >= 0xe000 && $codepoint <= 0xfffd)
1272 ||
($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
1276 * Decode any character references, numeric or named entities,
1277 * in the text and return a UTF-8 string.
1279 * @param $text String
1282 public static function decodeCharReferences( $text ) {
1283 return preg_replace_callback(
1285 array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1290 * Decode any character references, numeric or named entities,
1291 * in the next and normalize the resulting string. (bug 14952)
1293 * This is useful for page titles, not for text to be displayed,
1294 * MediaWiki allows HTML entities to escape normalization as a feature.
1296 * @param $text String (already normalized, containing entities)
1297 * @return String (still normalized, without entities)
1299 public static function decodeCharReferencesAndNormalize( $text ) {
1301 $text = preg_replace_callback(
1303 array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1304 $text, /* limit */ -1, $count );
1307 return $wgContLang->normalize( $text );
1314 * @param $matches String
1317 static function decodeCharReferencesCallback( $matches ) {
1318 if( $matches[1] != '' ) {
1319 return Sanitizer
::decodeEntity( $matches[1] );
1320 } elseif( $matches[2] != '' ) {
1321 return Sanitizer
::decodeChar( intval( $matches[2] ) );
1322 } elseif( $matches[3] != '' ) {
1323 return Sanitizer
::decodeChar( hexdec( $matches[3] ) );
1324 } elseif( $matches[4] != '' ) {
1325 return Sanitizer
::decodeChar( hexdec( $matches[4] ) );
1327 # Last case should be an ampersand by itself
1332 * Return UTF-8 string for a codepoint if that is a valid
1333 * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
1334 * @param $codepoint Integer
1338 static function decodeChar( $codepoint ) {
1339 if( Sanitizer
::validateCodepoint( $codepoint ) ) {
1340 return codepointToUtf8( $codepoint );
1342 return UTF8_REPLACEMENT
;
1347 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1348 * return the UTF-8 encoding of that character. Otherwise, returns
1349 * pseudo-entity source (eg &foo;)
1351 * @param $name Strings
1354 static function decodeEntity( $name ) {
1355 global $wgHtmlEntities, $wgHtmlEntityAliases;
1356 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1357 $name = $wgHtmlEntityAliases[$name];
1359 if( isset( $wgHtmlEntities[$name] ) ) {
1360 return codepointToUtf8( $wgHtmlEntities[$name] );
1367 * Fetch the whitelist of acceptable attributes for a given element name.
1369 * @param $element String
1372 static function attributeWhitelist( $element ) {
1374 if( !isset( $list ) ) {
1375 $list = Sanitizer
::setupAttributeWhitelist();
1377 return isset( $list[$element] )
1383 * Foreach array key (an allowed HTML element), return an array
1384 * of allowed attributes
1387 static function setupAttributeWhitelist() {
1388 global $wgAllowRdfaAttributes, $wgHtml5, $wgAllowMicrodataAttributes;
1390 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );
1392 if ( $wgAllowRdfaAttributes ) {
1393 #RDFa attributes as specified in section 9 of http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1394 $common = array_merge( $common, array(
1395 'about', 'property', 'resource', 'datatype', 'typeof',
1399 if ( $wgHtml5 && $wgAllowMicrodataAttributes ) {
1400 # add HTML5 microdata tages as pecified by http://www.whatwg.org/specs/web-apps/current-work/multipage/microdata.html#the-microdata-model
1401 $common = array_merge( $common, array(
1402 'itemid', 'itemprop', 'itemref', 'itemscope', 'itemtype'
1406 $block = array_merge( $common, array( 'align' ) );
1407 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1408 $tablecell = array( 'abbr',
1414 'nowrap', # deprecated
1415 'width', # deprecated
1416 'height', # deprecated
1417 'bgcolor' # deprecated
1420 # Numbers refer to sections in HTML 4.01 standard describing the element.
1421 # See: http://www.w3.org/TR/html4/
1422 $whitelist = array (
1425 'center' => $common, # deprecated
1426 'span' => $block, # ??
1444 'strong' => $common,
1455 'blockquote' => array_merge( $common, array( 'cite' ) ),
1466 'br' => array( 'id', 'class', 'title', 'style', 'clear' ),
1469 'pre' => array_merge( $common, array( 'width' ) ),
1472 'ins' => array_merge( $common, array( 'cite', 'datetime' ) ),
1473 'del' => array_merge( $common, array( 'cite', 'datetime' ) ),
1476 'ul' => array_merge( $common, array( 'type' ) ),
1477 'ol' => array_merge( $common, array( 'type', 'start' ) ),
1478 'li' => array_merge( $common, array( 'type', 'value' ) ),
1486 'table' => array_merge( $common,
1487 array( 'summary', 'width', 'border', 'frame',
1488 'rules', 'cellspacing', 'cellpadding',
1493 'caption' => array_merge( $common, array( 'align' ) ),
1496 'thead' => array_merge( $common, $tablealign ),
1497 'tfoot' => array_merge( $common, $tablealign ),
1498 'tbody' => array_merge( $common, $tablealign ),
1501 'colgroup' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1502 'col' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1505 'tr' => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1508 'td' => array_merge( $common, $tablecell, $tablealign ),
1509 'th' => array_merge( $common, $tablecell, $tablealign ),
1511 # 12.2 # NOTE: <a> is not allowed directly, but the attrib whitelist is used from the Parser object
1512 'a' => array_merge( $common, array( 'href', 'rel', 'rev' ) ), # rel/rev esp. for RDFa
1515 # Not usually allowed, but may be used for extension-style hooks
1516 # such as <math> when it is rasterized, or if $wgAllowImageTag is
1518 'img' => array_merge( $common, array( 'alt', 'src', 'width', 'height' ) ),
1526 'strike' => $common,
1531 'font' => array_merge( $common, array( 'size', 'color', 'face' ) ),
1535 'hr' => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1537 # XHTML Ruby annotation text module, simple ruby only.
1538 # http://www.w3c.org/TR/ruby/
1543 'rt' => $common, #array_merge( $common, array( 'rbspan' ) ),
1546 # MathML root element, where used for extensions
1547 # 'title' may not be 100% valid here; it's XHTML
1548 # http://www.w3.org/TR/REC-MathML/
1549 'math' => array( 'class', 'style', 'id', 'title' ),
1555 * Take a fragment of (potentially invalid) HTML and return
1556 * a version with any tags removed, encoded as plain text.
1558 * Warning: this return value must be further escaped for literal
1559 * inclusion in HTML output as of 1.10!
1561 * @param $text String: HTML fragment
1564 static function stripAllTags( $text ) {
1566 $text = StringUtils
::delimiterReplace( '<', '>', '', $text );
1568 # Normalize &entities and whitespace
1569 $text = self
::decodeCharReferences( $text );
1570 $text = self
::normalizeWhitespace( $text );
1576 * Hack up a private DOCTYPE with HTML's standard entity declarations.
1577 * PHP 4 seemed to know these if you gave it an HTML doctype, but
1580 * Use for passing XHTML fragments to PHP's XML parsing functions
1584 static function hackDocType() {
1585 global $wgHtmlEntities;
1586 $out = "<!DOCTYPE html [\n";
1587 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1588 $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1594 static function cleanUrl( $url ) {
1595 # Normalize any HTML entities in input. They will be
1596 # re-escaped by makeExternalLink().
1597 $url = Sanitizer
::decodeCharReferences( $url );
1599 # Escape any control characters introduced by the above step
1600 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F\|]/e', "urlencode('\\0')", $url );
1602 # Validate hostname portion
1604 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1605 list( /* $whole */, $protocol, $host, $rest ) = $matches;
1607 // Characters that will be ignored in IDNs.
1608 // http://tools.ietf.org/html/3454#section-3.1
1609 // Strip them before further processing so blacklists and such work.
1611 \\s| # general whitespace
1612 \xc2\xad| # 00ad SOFT HYPHEN
1613 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1614 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1615 \xe2\x81\xa0| # 2060 WORD JOINER
1616 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1617 \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
1618 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1619 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1620 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1621 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1622 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1623 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1626 $host = preg_replace( $strip, '', $host );
1628 // @todo Fixme: validate hostnames here
1630 return $protocol . $host . $rest;