GlobalTest: Add test for wfRandomString()

[lhc/web/wiklou.git] / includes / Sanitizer.php

diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index b68889c..2cdbe15 100644 (file)
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -328,6 +328,7 @@ class Sanitizer {
         * Regular expression to match HTML/XML attribute pairs within a tag.
         * Allows some... latitude.
         * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
+        * @return string
         */
        static function getAttribsRegex() {
                if ( self::$attribsRegex === null ) {
@@ -715,7 +716,7 @@ class Sanitizer {
         * - Invalid id attributes are re-encoded
         *
         * @param array $attribs
-        * @param array $whitelist list of allowed attribute names
+        * @param array $whitelist List of allowed attribute names
         * @return array
         *
         * @todo Check for legal values where the DTD limits things.
@@ -849,8 +850,6 @@ class Sanitizer {
         * @return string
         */
        static function checkCss( $value ) {
-               global $wgDisallowedCss;
-
                // Decode character references like {
                $value = Sanitizer::decodeCharReferences( $value );
 
@@ -939,12 +938,18 @@ class Sanitizer {
                // Reject problematic keywords and control characters
                if ( preg_match( '/[\000-\010\013\016-\037\177]/', $value ) ) {
                        return '/* invalid control char */';
-               } else {
-                       if ( $wgDisallowedCss ) {
-                               if ( preg_match( $wgDisallowedCss, $value ) ) {
-                                       return '/* insecure input */';
-                               }
-                       }
+               } elseif ( preg_match(
+                       '! expression
+                               | filter\s*:
+                               | accelerator\s*:
+                               | -o-link\s*:
+                               | -o-link-source\s*:
+                               | -o-replace\s*:
+                               | url\s*\(
+                               | image\s*\(
+                               | image-set\s*\(
+                       !ix', $value ) ) {
+                       return '/* insecure input */';
                }
                return $value;
        }
@@ -1077,7 +1082,7 @@ class Sanitizer {
         * @see http://www.whatwg.org/html/elements.html#the-id-attribute
         *   HTML5 definition of id attribute
         *
-        * @param string $id id to escape
+        * @param string $id Id to escape
         * @param string|array $options String or array of strings (default is array()):
         *   'noninitial': This is a non-initial fragment of an id, not a full id,
         *       so don't pay attention if the first character isn't valid at the
@@ -1224,7 +1229,7 @@ class Sanitizer {
         * attribs regex matches.
         *
         * @param array $set
-        * @throws MWException when tag conditions are not met.
+        * @throws MWException When tag conditions are not met.
         * @return string
         */
        private static function getTagAttributeCallback( $set ) {