includes/Sanitizer.php

   1 <?php
   2 /**
   3  * XHTML sanitizer for MediaWiki
   4  *
   5  * Copyright (C) 2002-2005 Brion Vibber <brion@pobox.com> et al
   6  * http://www.mediawiki.org/
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along
  19  * with this program; if not, write to the Free Software Foundation, Inc.,
  20  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  21  * http://www.gnu.org/copyleft/gpl.html
  22  *
  23  * @package MediaWiki
  24  * @subpackage Parser
  25  */
  26
  27 /**
  28  * Regular expression to match various types of character references in
  29  * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
  30  */
  31 define( 'MW_CHAR_REFS_REGEX',
  32         '/&([A-Za-z0-9]+);
  33          |&\#([0-9]+);
  34          |&\#x([0-9A-Za-z]+);
  35          |&\#X([0-9A-Za-z]+);
  36          |(&)/x' );
  37
  38 /**
  39  * Regular expression to match HTML/XML attribute pairs within a tag.
  40  * Allows some... latitude.
  41  * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
  42  */
  43 $attrib = '[A-Za-z0-9]';
  44 $space = '[\x09\x0a\x0d\x20]';
  45 define( 'MW_ATTRIBS_REGEX',
  46         "/(?:^|$space)($attrib+)
  47           ($space*=$space*
  48                 (?:
  49                  # The attribute value: quoted or alone
  50                   \"([^<\"]*)\"
  51                  | '([^<']*)'
  52                  |  ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
  53                  |  (\#[0-9a-fA-F]+) # Technically wrong, but lots of
  54                                                          # colors are specified like this.
  55                                                          # We'll be normalizing it.
  56                 )
  57            )?(?=$space|\$)/sx" );
  58
  59 /**
  60  * List of all named character entities defined in HTML 4.01
  61  * http://www.w3.org/TR/html4/sgml/entities.html
  62  * @private
  63  */
  64 global $wgHtmlEntities;
  65 $wgHtmlEntities = array(
  66         'Aacute'   => 193,
  67         'aacute'   => 225,
  68         'Acirc'    => 194,
  69         'acirc'    => 226,
  70         'acute'    => 180,
  71         'AElig'    => 198,
  72         'aelig'    => 230,
  73         'Agrave'   => 192,
  74         'agrave'   => 224,
  75         'alefsym'  => 8501,
  76         'Alpha'    => 913,
  77         'alpha'    => 945,
  78         'amp'      => 38,
  79         'and'      => 8743,
  80         'ang'      => 8736,
  81         'Aring'    => 197,
  82         'aring'    => 229,
  83         'asymp'    => 8776,
  84         'Atilde'   => 195,
  85         'atilde'   => 227,
  86         'Auml'     => 196,
  87         'auml'     => 228,
  88         'bdquo'    => 8222,
  89         'Beta'     => 914,
  90         'beta'     => 946,
  91         'brvbar'   => 166,
  92         'bull'     => 8226,
  93         'cap'      => 8745,
  94         'Ccedil'   => 199,
  95         'ccedil'   => 231,
  96         'cedil'    => 184,
  97         'cent'     => 162,
  98         'Chi'      => 935,
  99         'chi'      => 967,
 100         'circ'     => 710,
 101         'clubs'    => 9827,
 102         'cong'     => 8773,
 103         'copy'     => 169,
 104         'crarr'    => 8629,
 105         'cup'      => 8746,
 106         'curren'   => 164,
 107         'dagger'   => 8224,
 108         'Dagger'   => 8225,
 109         'darr'     => 8595,
 110         'dArr'     => 8659,
 111         'deg'      => 176,
 112         'Delta'    => 916,
 113         'delta'    => 948,
 114         'diams'    => 9830,
 115         'divide'   => 247,
 116         'Eacute'   => 201,
 117         'eacute'   => 233,
 118         'Ecirc'    => 202,
 119         'ecirc'    => 234,
 120         'Egrave'   => 200,
 121         'egrave'   => 232,
 122         'empty'    => 8709,
 123         'emsp'     => 8195,
 124         'ensp'     => 8194,
 125         'Epsilon'  => 917,
 126         'epsilon'  => 949,
 127         'equiv'    => 8801,
 128         'Eta'      => 919,
 129         'eta'      => 951,
 130         'ETH'      => 208,
 131         'eth'      => 240,
 132         'Euml'     => 203,
 133         'euml'     => 235,
 134         'euro'     => 8364,
 135         'exist'    => 8707,
 136         'fnof'     => 402,
 137         'forall'   => 8704,
 138         'frac12'   => 189,
 139         'frac14'   => 188,
 140         'frac34'   => 190,
 141         'frasl'    => 8260,
 142         'Gamma'    => 915,
 143         'gamma'    => 947,
 144         'ge'       => 8805,
 145         'gt'       => 62,
 146         'harr'     => 8596,
 147         'hArr'     => 8660,
 148         'hearts'   => 9829,
 149         'hellip'   => 8230,
 150         'Iacute'   => 205,
 151         'iacute'   => 237,
 152         'Icirc'    => 206,
 153         'icirc'    => 238,
 154         'iexcl'    => 161,
 155         'Igrave'   => 204,
 156         'igrave'   => 236,
 157         'image'    => 8465,
 158         'infin'    => 8734,
 159         'int'      => 8747,
 160         'Iota'     => 921,
 161         'iota'     => 953,
 162         'iquest'   => 191,
 163         'isin'     => 8712,
 164         'Iuml'     => 207,
 165         'iuml'     => 239,
 166         'Kappa'    => 922,
 167         'kappa'    => 954,
 168         'Lambda'   => 923,
 169         'lambda'   => 955,
 170         'lang'     => 9001,
 171         'laquo'    => 171,
 172         'larr'     => 8592,
 173         'lArr'     => 8656,
 174         'lceil'    => 8968,
 175         'ldquo'    => 8220,
 176         'le'       => 8804,
 177         'lfloor'   => 8970,
 178         'lowast'   => 8727,
 179         'loz'      => 9674,
 180         'lrm'      => 8206,
 181         'lsaquo'   => 8249,
 182         'lsquo'    => 8216,
 183         'lt'       => 60,
 184         'macr'     => 175,
 185         'mdash'    => 8212,
 186         'micro'    => 181,
 187         'middot'   => 183,
 188         'minus'    => 8722,
 189         'Mu'       => 924,
 190         'mu'       => 956,
 191         'nabla'    => 8711,
 192         'nbsp'     => 160,
 193         'ndash'    => 8211,
 194         'ne'       => 8800,
 195         'ni'       => 8715,
 196         'not'      => 172,
 197         'notin'    => 8713,
 198         'nsub'     => 8836,
 199         'Ntilde'   => 209,
 200         'ntilde'   => 241,
 201         'Nu'       => 925,
 202         'nu'       => 957,
 203         'Oacute'   => 211,
 204         'oacute'   => 243,
 205         'Ocirc'    => 212,
 206         'ocirc'    => 244,
 207         'OElig'    => 338,
 208         'oelig'    => 339,
 209         'Ograve'   => 210,
 210         'ograve'   => 242,
 211         'oline'    => 8254,
 212         'Omega'    => 937,
 213         'omega'    => 969,
 214         'Omicron'  => 927,
 215         'omicron'  => 959,
 216         'oplus'    => 8853,
 217         'or'       => 8744,
 218         'ordf'     => 170,
 219         'ordm'     => 186,
 220         'Oslash'   => 216,
 221         'oslash'   => 248,
 222         'Otilde'   => 213,
 223         'otilde'   => 245,
 224         'otimes'   => 8855,
 225         'Ouml'     => 214,
 226         'ouml'     => 246,
 227         'para'     => 182,
 228         'part'     => 8706,
 229         'permil'   => 8240,
 230         'perp'     => 8869,
 231         'Phi'      => 934,
 232         'phi'      => 966,
 233         'Pi'       => 928,
 234         'pi'       => 960,
 235         'piv'      => 982,
 236         'plusmn'   => 177,
 237         'pound'    => 163,
 238         'prime'    => 8242,
 239         'Prime'    => 8243,
 240         'prod'     => 8719,
 241         'prop'     => 8733,
 242         'Psi'      => 936,
 243         'psi'      => 968,
 244         'quot'     => 34,
 245         'radic'    => 8730,
 246         'rang'     => 9002,
 247         'raquo'    => 187,
 248         'rarr'     => 8594,
 249         'rArr'     => 8658,
 250         'rceil'    => 8969,
 251         'rdquo'    => 8221,
 252         'real'     => 8476,
 253         'reg'      => 174,
 254         'rfloor'   => 8971,
 255         'Rho'      => 929,
 256         'rho'      => 961,
 257         'rlm'      => 8207,
 258         'rsaquo'   => 8250,
 259         'rsquo'    => 8217,
 260         'sbquo'    => 8218,
 261         'Scaron'   => 352,
 262         'scaron'   => 353,
 263         'sdot'     => 8901,
 264         'sect'     => 167,
 265         'shy'      => 173,
 266         'Sigma'    => 931,
 267         'sigma'    => 963,
 268         'sigmaf'   => 962,
 269         'sim'      => 8764,
 270         'spades'   => 9824,
 271         'sub'      => 8834,
 272         'sube'     => 8838,
 273         'sum'      => 8721,
 274         'sup'      => 8835,
 275         'sup1'     => 185,
 276         'sup2'     => 178,
 277         'sup3'     => 179,
 278         'supe'     => 8839,
 279         'szlig'    => 223,
 280         'Tau'      => 932,
 281         'tau'      => 964,
 282         'there4'   => 8756,
 283         'Theta'    => 920,
 284         'theta'    => 952,
 285         'thetasym' => 977,
 286         'thinsp'   => 8201,
 287         'THORN'    => 222,
 288         'thorn'    => 254,
 289         'tilde'    => 732,
 290         'times'    => 215,
 291         'trade'    => 8482,
 292         'Uacute'   => 218,
 293         'uacute'   => 250,
 294         'uarr'     => 8593,
 295         'uArr'     => 8657,
 296         'Ucirc'    => 219,
 297         'ucirc'    => 251,
 298         'Ugrave'   => 217,
 299         'ugrave'   => 249,
 300         'uml'      => 168,
 301         'upsih'    => 978,
 302         'Upsilon'  => 933,
 303         'upsilon'  => 965,
 304         'Uuml'     => 220,
 305         'uuml'     => 252,
 306         'weierp'   => 8472,
 307         'Xi'       => 926,
 308         'xi'       => 958,
 309         'Yacute'   => 221,
 310         'yacute'   => 253,
 311         'yen'      => 165,
 312         'Yuml'     => 376,
 313         'yuml'     => 255,
 314         'Zeta'     => 918,
 315         'zeta'     => 950,
 316         'zwj'      => 8205,
 317         'zwnj'     => 8204 );
 318
 319 /** @package MediaWiki */
 320 class Sanitizer {
 321         /**
 322          * Cleans up HTML, removes dangerous tags and attributes, and
 323          * removes HTML comments
 324          * @private
 325          * @param string $text
 326          * @param callback $processCallback to do any variable or parameter replacements in HTML attribute values
 327          * @param array $args for the processing callback
 328          * @return string
 329          */
 330         function removeHTMLtags( $text, $processCallback = null, $args = array() ) {
 331                 global $wgUseTidy, $wgUserHtml;
 332                 $fname = 'Parser::removeHTMLtags';
 333                 wfProfileIn( $fname );
 334
 335                 if( $wgUserHtml ) {
 336                         $htmlpairs = array( # Tags that must be closed
 337                                 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
 338                                 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
 339                                 'strike', 'strong', 'tt', 'var', 'div', 'center',
 340                                 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
 341                                 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u'
 342                         );
 343                         $htmlsingle = array(
 344                                 'br', 'hr', 'li', 'dt', 'dd'
 345                         );
 346                         $htmlsingleonly = array( # Elements that cannot have close tags
 347                                 'br', 'hr'
 348                         );
 349                         $htmlnest = array( # Tags that can be nested--??
 350                                 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
 351                                 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
 352                         );
 353                         $tabletags = array( # Can only appear inside table
 354                                 'td', 'th', 'tr',
 355                         );
 356                         $htmllist = array( # Tags used by list
 357                                 'ul','ol',
 358                         );
 359                         $listtags = array( # Tags that can appear in a list
 360                                 'li',
 361                         );
 362
 363                 } else {
 364                         $htmlpairs = array();
 365                         $htmlsingle = array();
 366                         $htmlnest = array();
 367                         $tabletags = array();
 368                 }
 369
 370                 $htmlsingleallowed = array_merge( $htmlsingle, $tabletags );
 371                 $htmlelements = array_merge( $htmlsingle, $htmlpairs, $htmlnest );
 372
 373                 # Remove HTML comments
 374                 $text = Sanitizer::removeHTMLcomments( $text );
 375                 $bits = explode( '<', $text );
 376                 $text = array_shift( $bits );
 377                 if(!$wgUseTidy) {
 378                         $tagstack = array(); $tablestack = array();
 379                         foreach ( $bits as $x ) {
 380                                 $prev = error_reporting( E_ALL & ~( E_NOTICE | E_WARNING ) );
 381                                 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
 382                                 $x, $regs );
 383                                 list( $qbar, $slash, $t, $params, $brace, $rest ) = $regs;
 384                                 error_reporting( $prev );
 385
 386                                 $badtag = 0 ;
 387                                 if ( in_array( $t = strtolower( $t ), $htmlelements ) ) {
 388                                         # Check our stack
 389                                         if ( $slash ) {
 390                                                 # Closing a tag...
 391                                                 if( in_array( $t, $htmlsingleonly ) ) {
 392                                                         $badtag = 1;
 393                                                 } elseif ( ( $ot = @array_pop( $tagstack ) ) != $t ) {
 394                                                         if ( in_array($ot, $htmlsingleallowed) ) {
 395                                                                 # Pop all elements with an optional close tag
 396                                                                 # and see if we find a match below them
 397                                                                 $optstack = array();
 398                                                                 array_push ($optstack, $ot);
 399                                                                 while ( ( ( $ot = @array_pop( $tagstack ) ) != $t ) &&
 400                                                                                                 in_array($ot, $htmlsingleallowed) ) {
 401                                                                         array_push ($optstack, $ot);
 402                                                                 }
 403                                                                 if ( $t != $ot ) {
 404                                                                         # No match. Push the optinal elements back again
 405                                                                         $badtag = 1;
 406                                                                         while ( $ot = @array_pop( $optstack ) ) {
 407                                                                                 array_push( $tagstack, $ot );
 408                                                                         }
 409                                                                 }
 410                                                         } else {
 411                                                                 @array_push( $tagstack, $ot );
 412                                                                 # <li> can be nested in <ul> or <ol>, skip those cases:
 413                                                                 if(!(in_array($ot, $htmllist) && in_array($t, $listtags) )) {
 414                                                                         $badtag = 1;
 415                                                                 }
 416                                                         }
 417                                                 } else {
 418                                                         if ( $t == 'table' ) {
 419                                                                 $tagstack = array_pop( $tablestack );
 420                                                         }
 421                                                 }
 422                                                 $newparams = '';
 423                                         } else {
 424                                                 # Keep track for later
 425                                                 if ( in_array( $t, $tabletags ) &&
 426                                                 ! in_array( 'table', $tagstack ) ) {
 427                                                         $badtag = 1;
 428                                                 } else if ( in_array( $t, $tagstack ) &&
 429                                                 ! in_array ( $t , $htmlnest ) ) {
 430                                                         $badtag = 1 ;
 431                                                 # Is it a self closed htmlpair ? (bug 5487)
 432                                                 } else if( $brace == '/>' &&
 433                                                 in_array($t, $htmlpairs) ) {
 434                                                         $badtag = 1;
 435                                                 } elseif( in_array( $t, $htmlsingleonly ) ) {
 436                                                         # Hack to force empty tag for uncloseable elements
 437                                                         $brace = '/>';
 438                                                 } else if( in_array( $t, $htmlsingle ) ) {
 439                                                         # Hack to not close $htmlsingle tags
 440                                                         $brace = NULL;
 441                                                 } else {
 442                                                         if ( $t == 'table' ) {
 443                                                                 array_push( $tablestack, $tagstack );
 444                                                                 $tagstack = array();
 445                                                         }
 446                                                         array_push( $tagstack, $t );
 447                                                 }
 448
 449                                                 # Replace any variables or template parameters with
 450                                                 # plaintext results.
 451                                                 if( is_callable( $processCallback ) ) {
 452                                                         call_user_func_array( $processCallback, array( &$params, $args ) );
 453                                                 }
 454
 455                                                 # Strip non-approved attributes from the tag
 456                                                 $newparams = Sanitizer::fixTagAttributes( $params, $t );
 457                                         }
 458                                         if ( ! $badtag ) {
 459                                                 $rest = str_replace( '>', '&gt;', $rest );
 460                                                 $close = ( $brace == '/>' ) ? ' /' : '';
 461                                                 $text .= "<$slash$t$newparams$close>$rest";
 462                                                 continue;
 463                                         }
 464                                 }
 465                                 $text .= '&lt;' . str_replace( '>', '&gt;', $x);
 466                         }
 467                         # Close off any remaining tags
 468                         while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
 469                                 $text .= "</$t>\n";
 470                                 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
 471                         }
 472                 } else {
 473                         # this might be possible using tidy itself
 474                         foreach ( $bits as $x ) {
 475                                 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
 476                                 $x, $regs );
 477                                 @list( $qbar, $slash, $t, $params, $brace, $rest ) = $regs;
 478                                 if ( in_array( $t = strtolower( $t ), $htmlelements ) ) {
 479                                         if( is_callable( $processCallback ) ) {
 480                                                 call_user_func_array( $processCallback, array( &$params, $args ) );
 481                                         }
 482                                         $newparams = Sanitizer::fixTagAttributes( $params, $t );
 483                                         $rest = str_replace( '>', '&gt;', $rest );
 484                                         $text .= "<$slash$t$newparams$brace$rest";
 485                                 } else {
 486                                         $text .= '&lt;' . str_replace( '>', '&gt;', $x);
 487                                 }
 488                         }
 489                 }
 490                 wfProfileOut( $fname );
 491                 return $text;
 492         }
 493
 494         /**
 495          * Remove '<!--', '-->', and everything between.
 496          * To avoid leaving blank lines, when a comment is both preceded
 497          * and followed by a newline (ignoring spaces), trim leading and
 498          * trailing spaces and one of the newlines.
 499          *
 500          * @private
 501          * @param string $text
 502          * @return string
 503          */
 504         function removeHTMLcomments( $text ) {
 505                 $fname='Parser::removeHTMLcomments';
 506                 wfProfileIn( $fname );
 507                 while (($start = strpos($text, '<!--')) !== false) {
 508                         $end = strpos($text, '-->', $start + 4);
 509                         if ($end === false) {
 510                                 # Unterminated comment; bail out
 511                                 break;
 512                         }
 513
 514                         $end += 3;
 515
 516                         # Trim space and newline if the comment is both
 517                         # preceded and followed by a newline
 518                         $spaceStart = max($start - 1, 0);
 519                         $spaceLen = $end - $spaceStart;
 520                         while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
 521                                 $spaceStart--;
 522                                 $spaceLen++;
 523                         }
 524                         while (substr($text, $spaceStart + $spaceLen, 1) === ' ')
 525                                 $spaceLen++;
 526                         if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart + $spaceLen, 1) === "\n") {
 527                                 # Remove the comment, leading and trailing
 528                                 # spaces, and leave only one newline.
 529                                 $text = substr_replace($text, "\n", $spaceStart, $spaceLen + 1);
 530                         }
 531                         else {
 532                                 # Remove just the comment.
 533                                 $text = substr_replace($text, '', $start, $end - $start);
 534                         }
 535                 }
 536                 wfProfileOut( $fname );
 537                 return $text;
 538         }
 539
 540         /**
 541          * Take a tag soup fragment listing an HTML element's attributes
 542          * and normalize it to well-formed XML, discarding unwanted attributes.
 543          *
 544          * - Normalizes attribute names to lowercase
 545          * - Discards attributes not on a whitelist for the given element
 546          * - Turns broken or invalid entities into plaintext
 547          * - Double-quotes all attribute values
 548          * - Attributes without values are given the name as attribute
 549          * - Double attributes are discarded
 550          * - Unsafe style attributes are discarded
 551          * - Prepends space if there are attributes.
 552          *
 553          * @param string $text
 554          * @param string $element
 555          * @return string
 556          *
 557          * @todo Check for legal values where the DTD limits things.
 558          * @todo Check for unique id attribute :P
 559          */
 560         function fixTagAttributes( $text, $element ) {
 561                 if( trim( $text ) == '' ) {
 562                         return '';
 563                 }
 564
 565                 # Unquoted attribute
 566                 # Since we quote this later, this can be anything distinguishable
 567                 # from the end of the attribute
 568                 $pairs = array();
 569                 if( !preg_match_all(
 570                         MW_ATTRIBS_REGEX,
 571                         $text,
 572                         $pairs,
 573                         PREG_SET_ORDER ) ) {
 574                         return '';
 575                 }
 576
 577                 $whitelist = array_flip( Sanitizer::attributeWhitelist( $element ) );
 578                 $attribs = array();
 579                 foreach( $pairs as $set ) {
 580                         $attribute = strtolower( $set[1] );
 581                         if( !isset( $whitelist[$attribute] ) ) {
 582                                 continue;
 583                         }
 584
 585                         $raw   = Sanitizer::getTagAttributeCallback( $set );
 586                         $value = Sanitizer::normalizeAttributeValue( $raw );
 587
 588                         # Strip javascript "expression" from stylesheets.
 589                         # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
 590                         if( $attribute == 'style' ) {
 591                                 $stripped = Sanitizer::decodeCharReferences( $value );
 592
 593                                 // Remove any comments; IE gets token splitting wrong
 594                                 $stripped = preg_replace( '!/\\*.*?\\*/!S', ' ', $stripped );
 595                                 $value = htmlspecialchars( $stripped );
 596
 597                                 // ... and continue checks
 598                                 $stripped = preg_replace( '!\\\\([0-9A-Fa-f]{1,6})[ \\n\\r\\t\\f]?!e',
 599                                         'codepointToUtf8(hexdec("$1"))', $stripped );
 600                                 $stripped = str_replace( '\\', '', $stripped );
 601                                 if( preg_match( '/(expression|tps*:\/\/|url\\s*\().*/is',
 602                                                 $stripped ) ) {
 603                                         # haxx0r
 604                                         continue;
 605                                 }
 606                         }
 607
 608                         if ( $attribute === 'id' )
 609                                 $value = Sanitizer::escapeId( $value );
 610
 611                         # Templates and links may be expanded in later parsing,
 612                         # creating invalid or dangerous output. Suppress this.
 613                         $value = strtr( $value, array(
 614                                 '<'    => '&lt;',   // This should never happen,
 615                                 '>'    => '&gt;',   // we've received invalid input
 616                                 '"'    => '&quot;', // which should have been escaped.
 617                                 '{'    => '&#123;',
 618                                 '['    => '&#91;',
 619                                 "''"   => '&#39;&#39;',
 620                                 'ISBN' => '&#73;SBN',
 621                                 'RFC'  => '&#82;FC',
 622                                 'PMID' => '&#80;MID',
 623                                 '|'    => '&#124;',
 624                                 '__'   => '&#95;_',
 625                         ) );
 626
 627                         # Stupid hack
 628                         $value = preg_replace_callback(
 629                                 '/(' . wfUrlProtocols() . ')/',
 630                                 array( 'Sanitizer', 'armorLinksCallback' ),
 631                                 $value );
 632
 633                         // If this attribute was previously set, override it.
 634                         // Output should only have one attribute of each name.
 635                         $attribs[$attribute] = "$attribute=\"$value\"";
 636                 }
 637
 638                 return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : '';
 639         }
 640
 641         /**
 642          * Given a value escape it so that it can be used in an id attribute and
 643          * return it, this does not validate the value however (see first link)
 644          *
 645          * @link http://www.w3.org/TR/html401/types.html#type-name Valid characters
 646          *                                                          in the id and
 647          *                                                          name attributes
 648          * @link http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
 649          *
 650          * @bug 4461
 651          *
 652          * @static
 653          *
 654          * @param string $id
 655          * @return string
 656          */
 657         function escapeId( $id ) {
 658                 static $replace = array(
 659                         '%3A' => ':',
 660                         '%' => '.'
 661                 );
 662
 663                 $id = urlencode( Sanitizer::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
 664
 665                 return str_replace( array_keys( $replace ), array_values( $replace ), $id );
 666         }
 667
 668         /**
 669          * Regex replace callback for armoring links against further processing.
 670          * @param array $matches
 671          * @return string
 672          * @private
 673          */
 674         function armorLinksCallback( $matches ) {
 675                 return str_replace( ':', '&#58;', $matches[1] );
 676         }
 677
 678         /**
 679          * Return an associative array of attribute names and values from
 680          * a partial tag string. Attribute names are forces to lowercase,
 681          * character references are decoded to UTF-8 text.
 682          *
 683          * @param string
 684          * @return array
 685          */
 686         function decodeTagAttributes( $text ) {
 687                 $attribs = array();
 688
 689                 if( trim( $text ) == '' ) {
 690                         return $attribs;
 691                 }
 692
 693                 $pairs = array();
 694                 if( !preg_match_all(
 695                         MW_ATTRIBS_REGEX,
 696                         $text,
 697                         $pairs,
 698                         PREG_SET_ORDER ) ) {
 699                         return $attribs;
 700                 }
 701
 702                 foreach( $pairs as $set ) {
 703                         $attribute = strtolower( $set[1] );
 704                         $value = Sanitizer::getTagAttributeCallback( $set );
 705                         $attribs[$attribute] = Sanitizer::decodeCharReferences( $value );
 706                 }
 707                 return $attribs;
 708         }
 709
 710         /**
 711          * Pick the appropriate attribute value from a match set from the
 712          * MW_ATTRIBS_REGEX matches.
 713          *
 714          * @param array $set
 715          * @return string
 716          * @private
 717          */
 718         function getTagAttributeCallback( $set ) {
 719                 if( isset( $set[6] ) ) {
 720                         # Illegal #XXXXXX color with no quotes.
 721                         return $set[6];
 722                 } elseif( isset( $set[5] ) ) {
 723                         # No quotes.
 724                         return $set[5];
 725                 } elseif( isset( $set[4] ) ) {
 726                         # Single-quoted
 727                         return $set[4];
 728                 } elseif( isset( $set[3] ) ) {
 729                         # Double-quoted
 730                         return $set[3];
 731                 } elseif( !isset( $set[2] ) ) {
 732                         # In XHTML, attributes must have a value.
 733                         # For 'reduced' form, return explicitly the attribute name here.
 734                         return $set[1];
 735                 } else {
 736                         wfDebugDieBacktrace( "Tag conditions not met. This should never happen and is a bug." );
 737                 }
 738         }
 739
 740         /**
 741          * Normalize whitespace and character references in an XML source-
 742          * encoded text for an attribute value.
 743          *
 744          * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
 745          * but note that we're not returning the value, but are returning
 746          * XML source fragments that will be slapped into output.
 747          *
 748          * @param string $text
 749          * @return string
 750          * @private
 751          */
 752         function normalizeAttributeValue( $text ) {
 753                 return str_replace( '"', '&quot;',
 754                         preg_replace(
 755                                 '/\r\n|[\x20\x0d\x0a\x09]/',
 756                                 ' ',
 757                                 Sanitizer::normalizeCharReferences( $text ) ) );
 758         }
 759
 760         /**
 761          * Ensure that any entities and character references are legal
 762          * for XML and XHTML specifically. Any stray bits will be
 763          * &amp;-escaped to result in a valid text fragment.
 764          *
 765          * a. any named char refs must be known in XHTML
 766          * b. any numeric char refs must be legal chars, not invalid or forbidden
 767          * c. use &#x, not &#X
 768          * d. fix or reject non-valid attributes
 769          *
 770          * @param string $text
 771          * @return string
 772          * @private
 773          */
 774         function normalizeCharReferences( $text ) {
 775                 return preg_replace_callback(
 776                         MW_CHAR_REFS_REGEX,
 777                         array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
 778                         $text );
 779         }
 780         /**
 781          * @param string $matches
 782          * @return string
 783          */
 784         function normalizeCharReferencesCallback( $matches ) {
 785                 $ret = null;
 786                 if( $matches[1] != '' ) {
 787                         $ret = Sanitizer::normalizeEntity( $matches[1] );
 788                 } elseif( $matches[2] != '' ) {
 789                         $ret = Sanitizer::decCharReference( $matches[2] );
 790                 } elseif( $matches[3] != ''  ) {
 791                         $ret = Sanitizer::hexCharReference( $matches[3] );
 792                 } elseif( $matches[4] != '' ) {
 793                         $ret = Sanitizer::hexCharReference( $matches[4] );
 794                 }
 795                 if( is_null( $ret ) ) {
 796                         return htmlspecialchars( $matches[0] );
 797                 } else {
 798                         return $ret;
 799                 }
 800         }
 801
 802         /**
 803          * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
 804          * return the named entity reference as is. Otherwise, returns
 805          * HTML-escaped text of pseudo-entity source (eg &amp;foo;)
 806          *
 807          * @param string $name
 808          * @return string
 809          */
 810         function normalizeEntity( $name ) {
 811                 global $wgHtmlEntities;
 812                 if( isset( $wgHtmlEntities[$name] ) ) {
 813                         return "&$name;";
 814                 } else {
 815                         return "&amp;$name;";
 816                 }
 817         }
 818
 819         function decCharReference( $codepoint ) {
 820                 $point = intval( $codepoint );
 821                 if( Sanitizer::validateCodepoint( $point ) ) {
 822                         return sprintf( '&#%d;', $point );
 823                 } else {
 824                         return null;
 825                 }
 826         }
 827
 828         function hexCharReference( $codepoint ) {
 829                 $point = hexdec( $codepoint );
 830                 if( Sanitizer::validateCodepoint( $point ) ) {
 831                         return sprintf( '&#x%x;', $point );
 832                 } else {
 833                         return null;
 834                 }
 835         }
 836
 837         /**
 838          * Returns true if a given Unicode codepoint is a valid character in XML.
 839          * @param int $codepoint
 840          * @return bool
 841          */
 842         function validateCodepoint( $codepoint ) {
 843                 return ($codepoint ==    0x09)
 844                         || ($codepoint ==    0x0a)
 845                         || ($codepoint ==    0x0d)
 846                         || ($codepoint >=    0x20 && $codepoint <=   0xd7ff)
 847                         || ($codepoint >=  0xe000 && $codepoint <=   0xfffd)
 848                         || ($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
 849         }
 850
 851         /**
 852          * Decode any character references, numeric or named entities,
 853          * in the text and return a UTF-8 string.
 854          *
 855          * @param string $text
 856          * @return string
 857          * @public
 858          */
 859         function decodeCharReferences( $text ) {
 860                 return preg_replace_callback(
 861                         MW_CHAR_REFS_REGEX,
 862                         array( 'Sanitizer', 'decodeCharReferencesCallback' ),
 863                         $text );
 864         }
 865
 866         /**
 867          * @param string $matches
 868          * @return string
 869          */
 870         function decodeCharReferencesCallback( $matches ) {
 871                 if( $matches[1] != '' ) {
 872                         return Sanitizer::decodeEntity( $matches[1] );
 873                 } elseif( $matches[2] != '' ) {
 874                         return  Sanitizer::decodeChar( intval( $matches[2] ) );
 875                 } elseif( $matches[3] != ''  ) {
 876                         return  Sanitizer::decodeChar( hexdec( $matches[3] ) );
 877                 } elseif( $matches[4] != '' ) {
 878                         return  Sanitizer::decodeChar( hexdec( $matches[4] ) );
 879                 }
 880                 # Last case should be an ampersand by itself
 881                 return $matches[0];
 882         }
 883
 884         /**
 885          * Return UTF-8 string for a codepoint if that is a valid
 886          * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
 887          * @param int $codepoint
 888          * @return string
 889          * @private
 890          */
 891         function decodeChar( $codepoint ) {
 892                 if( Sanitizer::validateCodepoint( $codepoint ) ) {
 893                         return codepointToUtf8( $codepoint );
 894                 } else {
 895                         return UTF8_REPLACEMENT;
 896                 }
 897         }
 898
 899         /**
 900          * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
 901          * return the UTF-8 encoding of that character. Otherwise, returns
 902          * pseudo-entity source (eg &foo;)
 903          *
 904          * @param string $name
 905          * @return string
 906          */
 907         function decodeEntity( $name ) {
 908                 global $wgHtmlEntities;
 909                 if( isset( $wgHtmlEntities[$name] ) ) {
 910                         return codepointToUtf8( $wgHtmlEntities[$name] );
 911                 } else {
 912                         return "&$name;";
 913                 }
 914         }
 915
 916         /**
 917          * Fetch the whitelist of acceptable attributes for a given
 918          * element name.
 919          *
 920          * @param string $element
 921          * @return array
 922          */
 923         function attributeWhitelist( $element ) {
 924                 static $list;
 925                 if( !isset( $list ) ) {
 926                         $list = Sanitizer::setupAttributeWhitelist();
 927                 }
 928                 return isset( $list[$element] )
 929                         ? $list[$element]
 930                         : array();
 931         }
 932
 933         /**
 934          * @return array
 935          */
 936         function setupAttributeWhitelist() {
 937                 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );
 938                 $block = array_merge( $common, array( 'align' ) );
 939                 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
 940                 $tablecell = array( 'abbr',
 941                                     'axis',
 942                                     'headers',
 943                                     'scope',
 944                                     'rowspan',
 945                                     'colspan',
 946                                     'nowrap', # deprecated
 947                                     'width',  # deprecated
 948                                     'height', # deprecated
 949                                     'bgcolor' # deprecated
 950                                     );
 951
 952                 # Numbers refer to sections in HTML 4.01 standard describing the element.
 953                 # See: http://www.w3.org/TR/html4/
 954                 $whitelist = array (
 955                         # 7.5.4
 956                         'div'        => $block,
 957                         'center'     => $common, # deprecated
 958                         'span'       => $block, # ??
 959
 960                         # 7.5.5
 961                         'h1'         => $block,
 962                         'h2'         => $block,
 963                         'h3'         => $block,
 964                         'h4'         => $block,
 965                         'h5'         => $block,
 966                         'h6'         => $block,
 967
 968                         # 7.5.6
 969                         # address
 970
 971                         # 8.2.4
 972                         # bdo
 973
 974                         # 9.2.1
 975                         'em'         => $common,
 976                         'strong'     => $common,
 977                         'cite'       => $common,
 978                         # dfn
 979                         'code'       => $common,
 980                         # samp
 981                         # kbd
 982                         'var'        => $common,
 983                         # abbr
 984                         # acronym
 985
 986                         # 9.2.2
 987                         'blockquote' => array_merge( $common, array( 'cite' ) ),
 988                         # q
 989
 990                         # 9.2.3
 991                         'sub'        => $common,
 992                         'sup'        => $common,
 993
 994                         # 9.3.1
 995                         'p'          => $block,
 996
 997                         # 9.3.2
 998                         'br'         => array( 'id', 'class', 'title', 'style', 'clear' ),
 999
1000                         # 9.3.4
1001                         'pre'        => array_merge( $common, array( 'width' ) ),
1002
1003                         # 9.4
1004                         'ins'        => array_merge( $common, array( 'cite', 'datetime' ) ),
1005                         'del'        => array_merge( $common, array( 'cite', 'datetime' ) ),
1006
1007                         # 10.2
1008                         'ul'         => array_merge( $common, array( 'type' ) ),
1009                         'ol'         => array_merge( $common, array( 'type', 'start' ) ),
1010                         'li'         => array_merge( $common, array( 'type', 'value' ) ),
1011
1012                         # 10.3
1013                         'dl'         => $common,
1014                         'dd'         => $common,
1015                         'dt'         => $common,
1016
1017                         # 11.2.1
1018                         'table'      => array_merge( $common,
1019                                                                 array( 'summary', 'width', 'border', 'frame',
1020                                                                                          'rules', 'cellspacing', 'cellpadding',
1021                                                                                          'align', 'bgcolor', 'frame', 'rules',
1022                                                                                          'border' ) ),
1023
1024                         # 11.2.2
1025                         'caption'    => array_merge( $common, array( 'align' ) ),
1026
1027                         # 11.2.3
1028                         'thead'      => array_merge( $common, $tablealign ),
1029                         'tfoot'      => array_merge( $common, $tablealign ),
1030                         'tbody'      => array_merge( $common, $tablealign ),
1031
1032                         # 11.2.4
1033                         'colgroup'   => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1034                         'col'        => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1035
1036                         # 11.2.5
1037                         'tr'         => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1038
1039                         # 11.2.6
1040                         'td'         => array_merge( $common, $tablecell, $tablealign ),
1041                         'th'         => array_merge( $common, $tablecell, $tablealign ),
1042
1043                         # 15.2.1
1044                         'tt'         => $common,
1045                         'b'          => $common,
1046                         'i'          => $common,
1047                         'big'        => $common,
1048                         'small'      => $common,
1049                         'strike'     => $common,
1050                         's'          => $common,
1051                         'u'          => $common,
1052
1053                         # 15.2.2
1054                         'font'       => array_merge( $common, array( 'size', 'color', 'face' ) ),
1055                         # basefont
1056
1057                         # 15.3
1058                         'hr'         => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1059
1060                         # XHTML Ruby annotation text module, simple ruby only.
1061                         # http://www.w3c.org/TR/ruby/
1062                         'ruby'       => $common,
1063                         # rbc
1064                         # rtc
1065                         'rb'         => $common,
1066                         'rt'         => $common, #array_merge( $common, array( 'rbspan' ) ),
1067                         'rp'         => $common,
1068                         );
1069                 return $whitelist;
1070         }
1071
1072         /**
1073          * Take a fragment of (potentially invalid) HTML and return
1074          * a version with any tags removed, encoded suitably for literal
1075          * inclusion in an attribute value.
1076          *
1077          * @param string $text HTML fragment
1078          * @return string
1079          */
1080         function stripAllTags( $text ) {
1081                 # Actual <tags>
1082                 $text = preg_replace( '/ < .*? > /x', '', $text );
1083
1084                 # Normalize &entities and whitespace
1085                 $text = Sanitizer::normalizeAttributeValue( $text );
1086
1087                 # Will be placed into "double-quoted" attributes,
1088                 # make sure remaining bits are safe.
1089                 $text = str_replace(
1090                         array('<', '>', '"'),
1091                         array('&lt;', '&gt;', '&quot;'),
1092                         $text );
1093
1094                 return $text;
1095         }
1096
1097         /**
1098          * Hack up a private DOCTYPE with HTML's standard entity declarations.
1099          * PHP 4 seemed to know these if you gave it an HTML doctype, but
1100          * PHP 5.1 doesn't.
1101          *
1102          * Use for passing XHTML fragments to PHP's XML parsing functions
1103          *
1104          * @return string
1105          * @static
1106          */
1107         function hackDocType() {
1108                 global $wgHtmlEntities;
1109                 $out = "<!DOCTYPE html [\n";
1110                 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1111                         $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1112                 }
1113                 $out .= "]>\n";
1114                 return $out;
1115         }
1116
1117 }
1118
1119 ?>