3 * XHTML sanitizer for MediaWiki
5 * Copyright (C) 2002-2005 Brion Vibber <brion@pobox.com> et al
6 * http://www.mediawiki.org/
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
21 * http://www.gnu.org/copyleft/gpl.html
28 * Regular expression to match various types of character references in
29 * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
31 define( 'MW_CHAR_REFS_REGEX',
32 '/&([A-Za-z0-9\x80-\xff]+);
39 * Regular expression to match HTML/XML attribute pairs within a tag.
40 * Allows some... latitude.
41 * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
43 $attrib = '[A-Za-z0-9]';
44 $space = '[\x09\x0a\x0d\x20]';
45 define( 'MW_ATTRIBS_REGEX',
46 "/(?:^|$space)($attrib+)
49 # The attribute value: quoted or alone
52 | ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
53 | (\#[0-9a-fA-F]+) # Technically wrong, but lots of
54 # colors are specified like this.
55 # We'll be normalizing it.
57 )?(?=$space|\$)/sx" );
60 * List of all named character entities defined in HTML 4.01
61 * http://www.w3.org/TR/html4/sgml/entities.html
64 global $wgHtmlEntities;
65 $wgHtmlEntities = array(
320 * Character entity aliases accepted by MediaWiki
322 global $wgHtmlEntityAliases;
323 $wgHtmlEntityAliases = array(
330 * XHTML sanitizer for MediaWiki
335 * Cleans up HTML, removes dangerous tags and attributes, and
336 * removes HTML comments
338 * @param $text String
339 * @param $processCallback Callback to do any variable or parameter replacements in HTML attribute values
340 * @param $args Array for the processing callback
341 * @param $extratags Array for any extra tags to include
342 * @param $removetags Array for any tags (default or extra) to exclude
345 static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array(), $removetags = array() ) {
348 static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
349 $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
351 wfProfileIn( __METHOD__
);
353 if ( !$staticInitialised ) {
355 $htmlpairsStatic = array( # Tags that must be closed
356 'a', 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
357 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
358 'strike', 'strong', 'tt', 'var', 'div', 'center',
359 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
360 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u', 'abbr'
363 'br', 'hr', 'li', 'dt', 'dd'
365 $htmlsingleonly = array( # Elements that cannot have close tags
368 $htmlnest = array( # Tags that can be nested--??
369 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
370 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
372 $tabletags = array( # Can only appear inside table, we will close them
375 $htmllist = array( # Tags used by list
378 $listtags = array( # Tags that can appear in a list
382 $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
383 $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
385 # Convert them all to hashtables for faster lookup
386 $vars = array( 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
387 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' );
388 foreach ( $vars as $var ) {
389 $
$var = array_flip( $
$var );
391 $staticInitialised = true;
393 # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
394 $extratags = array_flip( $extratags );
395 $removetags = array_flip( $removetags );
396 $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
397 $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ) , $removetags );
399 # Remove HTML comments
400 $text = Sanitizer
::removeHTMLcomments( $text );
401 $bits = explode( '<', $text );
402 $text = str_replace( '>', '>', array_shift( $bits ) );
404 $tagstack = $tablestack = array();
405 foreach ( $bits as $x ) {
407 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
408 list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
410 $slash = $t = $params = $brace = $rest = null;
414 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
418 if( isset( $htmlsingleonly[$t] ) ) {
420 } elseif ( ( $ot = @array_pop
( $tagstack ) ) != $t ) {
421 if ( isset( $htmlsingleallowed[$ot] ) ) {
422 # Pop all elements with an optional close tag
423 # and see if we find a match below them
425 array_push ($optstack, $ot);
426 while ( ( ( $ot = @array_pop
( $tagstack ) ) != $t ) &&
427 isset( $htmlsingleallowed[$ot] ) )
429 array_push ($optstack, $ot);
432 # No match. Push the optinal elements back again
434 while ( $ot = @array_pop
( $optstack ) ) {
435 array_push( $tagstack, $ot );
439 @array_push
( $tagstack, $ot );
440 # <li> can be nested in <ul> or <ol>, skip those cases:
441 if(!(isset( $htmllist[$ot] ) && isset( $listtags[$t] ) )) {
446 if ( $t == 'table' ) {
447 $tagstack = array_pop( $tablestack );
452 # Keep track for later
453 if ( isset( $tabletags[$t] ) &&
454 ! in_array( 'table', $tagstack ) ) {
456 } else if ( in_array( $t, $tagstack ) &&
457 ! isset( $htmlnest [$t ] ) ) {
459 #Â Is it a self closed htmlpair ? (bug 5487)
460 } else if( $brace == '/>' &&
461 isset( $htmlpairs[$t] ) ) {
463 } elseif( isset( $htmlsingleonly[$t] ) ) {
464 # Hack to force empty tag for uncloseable elements
466 } else if( isset( $htmlsingle[$t] ) ) {
467 # Hack to not close $htmlsingle tags
469 } else if( isset( $tabletags[$t] )
470 && in_array($t ,$tagstack) ) {
471 // New table tag but forgot to close the previous one
474 if ( $t == 'table' ) {
475 array_push( $tablestack, $tagstack );
478 array_push( $tagstack, $t );
481 # Replace any variables or template parameters with
483 if( is_callable( $processCallback ) ) {
484 call_user_func_array( $processCallback, array( &$params, $args ) );
487 # Strip non-approved attributes from the tag
488 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
491 $rest = str_replace( '>', '>', $rest );
492 $close = ( $brace == '/>' && !$slash ) ?
' /' : '';
493 $text .= "<$slash$t$newparams$close>$rest";
497 $text .= '<' . str_replace( '>', '>', $x);
499 # Close off any remaining tags
500 while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
502 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
505 # this might be possible using tidy itself
506 foreach ( $bits as $x ) {
507 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
509 @list
( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
510 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
511 if( is_callable( $processCallback ) ) {
512 call_user_func_array( $processCallback, array( &$params, $args ) );
514 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
515 $rest = str_replace( '>', '>', $rest );
516 $text .= "<$slash$t$newparams$brace$rest";
518 $text .= '<' . str_replace( '>', '>', $x);
522 wfProfileOut( __METHOD__
);
527 * Remove '<!--', '-->', and everything between.
528 * To avoid leaving blank lines, when a comment is both preceded
529 * and followed by a newline (ignoring spaces), trim leading and
530 * trailing spaces and one of the newlines.
533 * @param $text String
536 static function removeHTMLcomments( $text ) {
537 wfProfileIn( __METHOD__
);
538 while (($start = strpos($text, '<!--')) !== false) {
539 $end = strpos($text, '-->', $start +
4);
540 if ($end === false) {
541 # Unterminated comment; bail out
547 # Trim space and newline if the comment is both
548 # preceded and followed by a newline
549 $spaceStart = max($start - 1, 0);
550 $spaceLen = $end - $spaceStart;
551 while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
555 while (substr($text, $spaceStart +
$spaceLen, 1) === ' ')
557 if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart +
$spaceLen, 1) === "\n") {
558 # Remove the comment, leading and trailing
559 # spaces, and leave only one newline.
560 $text = substr_replace($text, "\n", $spaceStart, $spaceLen +
1);
563 # Remove just the comment.
564 $text = substr_replace($text, '', $start, $end - $start);
567 wfProfileOut( __METHOD__
);
572 * Take an array of attribute names and values and normalize or discard
573 * illegal values for the given element type.
575 * - Discards attributes not on a whitelist for the given element
576 * - Unsafe style attributes are discarded
577 * - Invalid id attributes are reencoded
579 * @param $attribs Array
580 * @param $element String
583 * @todo Check for legal values where the DTD limits things.
584 * @todo Check for unique id attribute :P
586 static function validateTagAttributes( $attribs, $element ) {
587 return Sanitizer
::validateAttributes( $attribs,
588 Sanitizer
::attributeWhitelist( $element ) );
592 * Take an array of attribute names and values and normalize or discard
593 * illegal values for the given whitelist.
595 * - Discards attributes not the given whitelist
596 * - Unsafe style attributes are discarded
597 * - Invalid id attributes are reencoded
599 * @param $attribs Array
600 * @param $whitelist Array: list of allowed attribute names
603 * @todo Check for legal values where the DTD limits things.
604 * @todo Check for unique id attribute :P
606 static function validateAttributes( $attribs, $whitelist ) {
607 $whitelist = array_flip( $whitelist );
608 $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
611 foreach( $attribs as $attribute => $value ) {
612 if( !isset( $whitelist[$attribute] ) ) {
615 # Strip javascript "expression" from stylesheets.
616 # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
617 if( $attribute == 'style' ) {
618 $value = Sanitizer
::checkCss( $value );
619 if( $value === false ) {
625 if ( $attribute === 'id' ) {
626 global $wgEnforceHtmlIds;
627 $value = Sanitizer
::escapeId( $value,
628 $wgEnforceHtmlIds ?
'noninitial' : 'xml' );
631 if ( $attribute === 'href' ||
$attribute === 'src' ) {
632 if ( !preg_match( $hrefExp, $value ) ) {
633 continue; //drop any href or src attributes not using an allowed protocol.
634 //NOTE: this also drops all relative URLs
638 //RDFa properties allow URIs. check them
639 if ( $attribute === 'rel' ||
$attribute === 'rev' ||
640 $attribute === 'about' ||
$attribute === 'property' ||
$attribute === 'resource' ||
641 $attribute === 'datatype' ||
$attribute === 'typeof' ) {
642 //Paranoia. Allow "simple" values but suppress javascript
643 if ( preg_match( '/(^|\s)javascript\s*:/i', $value ) ) {
648 // If this attribute was previously set, override it.
649 // Output should only have one attribute of each name.
650 $out[$attribute] = $value;
656 * Merge two sets of HTML attributes. Conflicting items in the second set
657 * will override those in the first, except for 'class' attributes which
658 * will be combined (if they're both strings).
660 * @todo implement merging for other attributes such as style
665 static function mergeAttributes( $a, $b ) {
666 $out = array_merge( $a, $b );
667 if( isset( $a['class'] ) && isset( $b['class'] )
668 && is_string( $a['class'] ) && is_string( $b['class'] )
669 && $a['class'] !== $b['class'] ) {
670 $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
671 -1, PREG_SPLIT_NO_EMPTY
);
672 $out['class'] = implode( ' ', array_unique( $classes ) );
678 * Pick apart some CSS and check it for forbidden or unsafe structures.
679 * Returns a sanitized string, or false if it was just too evil.
681 * Currently URL references, 'expression', 'tps' are forbidden.
683 * @param $value String
686 static function checkCss( $value ) {
687 $stripped = Sanitizer
::decodeCharReferences( $value );
689 // Remove any comments; IE gets token splitting wrong
690 $stripped = StringUtils
::delimiterReplace( '/*', '*/', ' ', $stripped );
694 // ... and continue checks
695 $stripped = preg_replace( '!\\\\([0-9A-Fa-f]{1,6})[ \\n\\r\\t\\f]?!e',
696 'codepointToUtf8(hexdec("$1"))', $stripped );
697 $stripped = str_replace( '\\', '', $stripped );
698 if( preg_match( '/(?:expression|tps*:\/\/|url\\s*\().*/is',
708 * Take a tag soup fragment listing an HTML element's attributes
709 * and normalize it to well-formed XML, discarding unwanted attributes.
710 * Output is safe for further wikitext processing, with escaping of
711 * values that could trigger problems.
713 * - Normalizes attribute names to lowercase
714 * - Discards attributes not on a whitelist for the given element
715 * - Turns broken or invalid entities into plaintext
716 * - Double-quotes all attribute values
717 * - Attributes without values are given the name as attribute
718 * - Double attributes are discarded
719 * - Unsafe style attributes are discarded
720 * - Prepends space if there are attributes.
722 * @param $text String
723 * @param $element String
726 static function fixTagAttributes( $text, $element ) {
727 if( trim( $text ) == '' ) {
731 $stripped = Sanitizer
::validateTagAttributes(
732 Sanitizer
::decodeTagAttributes( $text ), $element );
735 foreach( $stripped as $attribute => $value ) {
736 $encAttribute = htmlspecialchars( $attribute );
737 $encValue = Sanitizer
::safeEncodeAttribute( $value );
739 $attribs[] = "$encAttribute=\"$encValue\"";
741 return count( $attribs ) ?
' ' . implode( ' ', $attribs ) : '';
745 * Encode an attribute value for HTML output.
746 * @param $text String
747 * @return HTML-encoded text fragment
749 static function encodeAttribute( $text ) {
750 $encValue = htmlspecialchars( $text, ENT_QUOTES
);
752 // Whitespace is normalized during attribute decoding,
753 // so if we've been passed non-spaces we must encode them
754 // ahead of time or they won't be preserved.
755 $encValue = strtr( $encValue, array(
765 * Encode an attribute value for HTML tags, with extra armoring
766 * against further wiki processing.
767 * @param $text String
768 * @return HTML-encoded text fragment
770 static function safeEncodeAttribute( $text ) {
771 $encValue = Sanitizer
::encodeAttribute( $text );
773 # Templates and links may be expanded in later parsing,
774 # creating invalid or dangerous output. Suppress this.
775 $encValue = strtr( $encValue, array(
776 '<' => '<', // This should never happen,
777 '>' => '>', // we've received invalid input
778 '"' => '"', // which should have been escaped.
781 "''" => '''',
782 'ISBN' => 'ISBN',
784 'PMID' => 'PMID',
790 $encValue = preg_replace_callback(
791 '/(' . wfUrlProtocols() . ')/',
792 array( 'Sanitizer', 'armorLinksCallback' ),
798 * Given a value escape it so that it can be used in an id attribute and
799 * return it, this does not validate the value however (see first link)
801 * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters
804 * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
806 * @param $id String: id to validate
807 * @param $options Mixed: string or array of strings (default is array()):
808 * 'noninitial': This is a non-initial fragment of an id, not a full id,
809 * so don't pay attention if the first character isn't valid at the
810 * beginning of an id.
811 * 'xml': Don't restrict the id to be HTML4-compatible. This option
812 * allows any alphabetic character to be used, per the XML standard.
813 * Therefore, it also completely changes the type of escaping: instead
814 * of weird dot-encoding, runs of invalid characters (mostly
815 * whitespace) are just compressed into a single underscore.
818 static function escapeId( $id, $options = array() ) {
819 $options = (array)$options;
821 if ( !in_array( 'xml', $options ) ) {
822 # HTML4-style escaping
823 static $replace = array(
828 $id = urlencode( Sanitizer
::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
829 $id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
831 if ( !preg_match( '/^[a-zA-Z]/', $id )
832 && !in_array( 'noninitial', $options ) ) {
833 // Initial character must be a letter!
839 # XML-style escaping. For the patterns used, see the XML 1.0 standard,
840 # 5th edition, NameStartChar and NameChar: <http://www.w3.org/TR/REC-xml/>
841 $nameStartChar = ':a-zA-Z_\xC0-\xD6\xD8-\xF6\xF8-\x{2FF}\x{370}-\x{37D}'
842 . '\x{37F}-\x{1FFF}\x{200C}-\x{200D}\x{2070}-\x{218F}\x{2C00}-\x{2FEF}'
843 . '\x{3001}-\x{D7FF}\x{F900}-\x{FDCF}\x{FDF0}-\x{FFFD}\x{10000}-\x{EFFFF}';
844 $nameChar = $nameStartChar . '.\-0-9\xB7\x{0300}-\x{036F}'
845 . '\x{203F}-\x{2040}';
846 # Replace _ as well so we don't get multiple consecutive underscores
847 $id = preg_replace( "/([^$nameChar]|_)+/u", '_', $id );
848 $id = trim( $id, '_' );
850 if ( !preg_match( "/^[$nameStartChar]/u", $id )
851 && !in_array( 'noninitial', $options ) ) {
859 * Given a value, escape it so that it can be used as a CSS class and
862 * @todo For extra validity, input should be validated UTF-8.
864 * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
866 * @param $class String
869 static function escapeClass( $class ) {
870 // Convert ugly stuff to underscores and kill underscores in ugly places
871 return rtrim(preg_replace(
872 array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
878 * Given HTML input, escape with htmlspecialchars but un-escape entites.
879 * This allows (generally harmless) entities like to survive.
881 * @param $html String to escape
882 * @return String: escaped input
884 static function escapeHtmlAllowEntities( $html ) {
885 # It seems wise to escape ' as well as ", as a matter of course. Can't
887 $html = htmlspecialchars( $html, ENT_QUOTES
);
888 $html = str_replace( '&', '&', $html );
889 $html = Sanitizer
::normalizeCharReferences( $html );
894 * Regex replace callback for armoring links against further processing.
895 * @param $matches Array
898 private static function armorLinksCallback( $matches ) {
899 return str_replace( ':', ':', $matches[1] );
903 * Return an associative array of attribute names and values from
904 * a partial tag string. Attribute names are forces to lowercase,
905 * character references are decoded to UTF-8 text.
907 * @param $text String
910 public static function decodeTagAttributes( $text ) {
913 if( trim( $text ) == '' ) {
926 foreach( $pairs as $set ) {
927 $attribute = strtolower( $set[1] );
928 $value = Sanitizer
::getTagAttributeCallback( $set );
930 // Normalize whitespace
931 $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
932 $value = trim( $value );
934 // Decode character references
935 $attribs[$attribute] = Sanitizer
::decodeCharReferences( $value );
941 * Pick the appropriate attribute value from a match set from the
942 * MW_ATTRIBS_REGEX matches.
947 private static function getTagAttributeCallback( $set ) {
948 if( isset( $set[6] ) ) {
949 # Illegal #XXXXXX color with no quotes.
951 } elseif( isset( $set[5] ) ) {
954 } elseif( isset( $set[4] ) ) {
957 } elseif( isset( $set[3] ) ) {
960 } elseif( !isset( $set[2] ) ) {
961 # In XHTML, attributes must have a value.
962 # For 'reduced' form, return explicitly the attribute name here.
965 throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
970 * Normalize whitespace and character references in an XML source-
971 * encoded text for an attribute value.
973 * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
974 * but note that we're not returning the value, but are returning
975 * XML source fragments that will be slapped into output.
977 * @param $text String
980 private static function normalizeAttributeValue( $text ) {
981 return str_replace( '"', '"',
982 self
::normalizeWhitespace(
983 Sanitizer
::normalizeCharReferences( $text ) ) );
986 private static function normalizeWhitespace( $text ) {
988 '/\r\n|[\x20\x0d\x0a\x09]/',
994 * Ensure that any entities and character references are legal
995 * for XML and XHTML specifically. Any stray bits will be
996 * &-escaped to result in a valid text fragment.
998 * a. any named char refs must be known in XHTML
999 * b. any numeric char refs must be legal chars, not invalid or forbidden
1000 * c. use &#x, not &#X
1001 * d. fix or reject non-valid attributes
1003 * @param $text String
1007 static function normalizeCharReferences( $text ) {
1008 return preg_replace_callback(
1010 array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
1014 * @param $matches String
1017 static function normalizeCharReferencesCallback( $matches ) {
1019 if( $matches[1] != '' ) {
1020 $ret = Sanitizer
::normalizeEntity( $matches[1] );
1021 } elseif( $matches[2] != '' ) {
1022 $ret = Sanitizer
::decCharReference( $matches[2] );
1023 } elseif( $matches[3] != '' ) {
1024 $ret = Sanitizer
::hexCharReference( $matches[3] );
1025 } elseif( $matches[4] != '' ) {
1026 $ret = Sanitizer
::hexCharReference( $matches[4] );
1028 if( is_null( $ret ) ) {
1029 return htmlspecialchars( $matches[0] );
1036 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1037 * return the named entity reference as is. If the entity is a
1038 * MediaWiki-specific alias, returns the HTML equivalent. Otherwise,
1039 * returns HTML-escaped text of pseudo-entity source (eg &foo;)
1041 * @param $name String
1044 static function normalizeEntity( $name ) {
1045 global $wgHtmlEntities, $wgHtmlEntityAliases;
1046 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1047 return "&{$wgHtmlEntityAliases[$name]};";
1048 } elseif( isset( $wgHtmlEntities[$name] ) ) {
1051 return "&$name;";
1055 static function decCharReference( $codepoint ) {
1056 $point = intval( $codepoint );
1057 if( Sanitizer
::validateCodepoint( $point ) ) {
1058 return sprintf( '&#%d;', $point );
1064 static function hexCharReference( $codepoint ) {
1065 $point = hexdec( $codepoint );
1066 if( Sanitizer
::validateCodepoint( $point ) ) {
1067 return sprintf( '&#x%x;', $point );
1074 * Returns true if a given Unicode codepoint is a valid character in XML.
1075 * @param $codepoint Integer
1078 private static function validateCodepoint( $codepoint ) {
1079 return ($codepoint == 0x09)
1080 ||
($codepoint == 0x0a)
1081 ||
($codepoint == 0x0d)
1082 ||
($codepoint >= 0x20 && $codepoint <= 0xd7ff)
1083 ||
($codepoint >= 0xe000 && $codepoint <= 0xfffd)
1084 ||
($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
1088 * Decode any character references, numeric or named entities,
1089 * in the text and return a UTF-8 string.
1091 * @param $text String
1094 public static function decodeCharReferences( $text ) {
1095 return preg_replace_callback(
1097 array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1102 * @param $matches String
1105 static function decodeCharReferencesCallback( $matches ) {
1106 if( $matches[1] != '' ) {
1107 return Sanitizer
::decodeEntity( $matches[1] );
1108 } elseif( $matches[2] != '' ) {
1109 return Sanitizer
::decodeChar( intval( $matches[2] ) );
1110 } elseif( $matches[3] != '' ) {
1111 return Sanitizer
::decodeChar( hexdec( $matches[3] ) );
1112 } elseif( $matches[4] != '' ) {
1113 return Sanitizer
::decodeChar( hexdec( $matches[4] ) );
1115 # Last case should be an ampersand by itself
1120 * Return UTF-8 string for a codepoint if that is a valid
1121 * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
1122 * @param $codepoint Integer
1126 static function decodeChar( $codepoint ) {
1127 if( Sanitizer
::validateCodepoint( $codepoint ) ) {
1128 return codepointToUtf8( $codepoint );
1130 return UTF8_REPLACEMENT
;
1135 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1136 * return the UTF-8 encoding of that character. Otherwise, returns
1137 * pseudo-entity source (eg &foo;)
1139 * @param $name Strings
1142 static function decodeEntity( $name ) {
1143 global $wgHtmlEntities, $wgHtmlEntityAliases;
1144 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1145 $name = $wgHtmlEntityAliases[$name];
1147 if( isset( $wgHtmlEntities[$name] ) ) {
1148 return codepointToUtf8( $wgHtmlEntities[$name] );
1155 * Fetch the whitelist of acceptable attributes for a given element name.
1157 * @param $element String
1160 static function attributeWhitelist( $element ) {
1162 if( !isset( $list ) ) {
1163 $list = Sanitizer
::setupAttributeWhitelist();
1165 return isset( $list[$element] )
1171 * Foreach array key (an allowed HTML element), return an array
1172 * of allowed attributes
1175 static function setupAttributeWhitelist() {
1176 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style',
1177 #RDFa attributes as specified in section 9 of http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1178 'about', 'property', 'resource', 'datatype', 'typeof',
1181 $block = array_merge( $common, array( 'align' ) );
1182 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1183 $tablecell = array( 'abbr',
1189 'nowrap', # deprecated
1190 'width', # deprecated
1191 'height', # deprecated
1192 'bgcolor' # deprecated
1195 # Numbers refer to sections in HTML 4.01 standard describing the element.
1196 # See: http://www.w3.org/TR/html4/
1197 $whitelist = array (
1200 'center' => $common, # deprecated
1201 'span' => $block, # ??
1219 'strong' => $common,
1230 'blockquote' => array_merge( $common, array( 'cite' ) ),
1241 'br' => array( 'id', 'class', 'title', 'style', 'clear' ),
1244 'pre' => array_merge( $common, array( 'width' ) ),
1247 'ins' => array_merge( $common, array( 'cite', 'datetime' ) ),
1248 'del' => array_merge( $common, array( 'cite', 'datetime' ) ),
1251 'ul' => array_merge( $common, array( 'type' ) ),
1252 'ol' => array_merge( $common, array( 'type', 'start' ) ),
1253 'li' => array_merge( $common, array( 'type', 'value' ) ),
1261 'table' => array_merge( $common,
1262 array( 'summary', 'width', 'border', 'frame',
1263 'rules', 'cellspacing', 'cellpadding',
1268 'caption' => array_merge( $common, array( 'align' ) ),
1271 'thead' => array_merge( $common, $tablealign ),
1272 'tfoot' => array_merge( $common, $tablealign ),
1273 'tbody' => array_merge( $common, $tablealign ),
1276 'colgroup' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1277 'col' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1280 'tr' => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1283 'td' => array_merge( $common, $tablecell, $tablealign ),
1284 'th' => array_merge( $common, $tablecell, $tablealign ),
1287 'a' => array_merge( $common, array( 'href', 'rel', 'rev' ) ), # rel/rev esp. for RDFa
1290 # Not usually allowed, but may be used for extension-style hooks
1291 # such as <math> when it is rasterized
1292 'img' => array_merge( $common, array( 'alt' ) ),
1300 'strike' => $common,
1305 'font' => array_merge( $common, array( 'size', 'color', 'face' ) ),
1309 'hr' => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1311 # XHTML Ruby annotation text module, simple ruby only.
1312 # http://www.w3c.org/TR/ruby/
1317 'rt' => $common, #array_merge( $common, array( 'rbspan' ) ),
1320 # MathML root element, where used for extensions
1321 # 'title' may not be 100% valid here; it's XHTML
1322 # http://www.w3.org/TR/REC-MathML/
1323 'math' => array( 'class', 'style', 'id', 'title' ),
1329 * Take a fragment of (potentially invalid) HTML and return
1330 * a version with any tags removed, encoded as plain text.
1332 * Warning: this return value must be further escaped for literal
1333 * inclusion in HTML output as of 1.10!
1335 * @param $text String: HTML fragment
1338 static function stripAllTags( $text ) {
1340 $text = StringUtils
::delimiterReplace( '<', '>', '', $text );
1342 # Normalize &entities and whitespace
1343 $text = self
::decodeCharReferences( $text );
1344 $text = self
::normalizeWhitespace( $text );
1350 * Hack up a private DOCTYPE with HTML's standard entity declarations.
1351 * PHP 4 seemed to know these if you gave it an HTML doctype, but
1354 * Use for passing XHTML fragments to PHP's XML parsing functions
1358 static function hackDocType() {
1359 global $wgHtmlEntities;
1360 $out = "<!DOCTYPE html [\n";
1361 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1362 $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1368 static function cleanUrl( $url ) {
1369 # Normalize any HTML entities in input. They will be
1370 # re-escaped by makeExternalLink().
1371 $url = Sanitizer
::decodeCharReferences( $url );
1373 # Escape any control characters introduced by the above step
1374 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F]/e', "urlencode('\\0')", $url );
1376 # Validate hostname portion
1378 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1379 list( /* $whole */, $protocol, $host, $rest ) = $matches;
1381 // Characters that will be ignored in IDNs.
1382 // http://tools.ietf.org/html/3454#section-3.1
1383 // Strip them before further processing so blacklists and such work.
1385 \\s| # general whitespace
1386 \xc2\xad| # 00ad SOFT HYPHEN
1387 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1388 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1389 \xe2\x81\xa0| # 2060 WORD JOINER
1390 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1391 \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
1392 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1393 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1394 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1395 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1396 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1397 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1400 $host = preg_replace( $strip, '', $host );
1402 // @fixme: validate hostnames here
1404 return $protocol . $host . $rest;