Merge "Avoid SearchEnginePrefixTest postgres failures"

[lhc/web/wiklou.git] / includes / Sanitizer.php

diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index 4c245a5..c4883ba 100644 (file)
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -344,12 +344,12 @@ class Sanitizer {
                        $space = '[\x09\x0a\x0c\x0d\x20]';
                        self::$attribsRegex =
                                "/(?:^|$space)({$attribFirst}{$attrib}*)
-                                 ($space*=$space*
+                                       ($space*=$space*
                                        (?:
-                                        # The attribute value: quoted or alone
-                                         \"([^\"]*)(?:\"|\$)
-                                        | '([^']*)(?:'|\$)
-                                        |  (((?!$space|>).)*)
+                                               # The attribute value: quoted or alone
+                                               \"([^\"]*)(?:\"|\$)
+                                               | '([^']*)(?:'|\$)
+                                               | (((?!$space|>).)*)
                                        )
                                )?(?=$space|\$)/sx";
                }
@@ -835,7 +835,7 @@ class Sanitizer {
 
                        # NOTE: even though elements using href/src are not allowed directly, supply
                        #       validation code that can be used by tag hook handlers, etc
-                       if ( $attribute === 'href' || $attribute === 'src' ) {
+                       if ( $attribute === 'href' || $attribute === 'src' || $attribute === 'poster' ) {
                                if ( !preg_match( $hrefExp, $value ) ) {
                                        continue; // drop any href or src attributes not using an allowed protocol.
                                        // NOTE: this also drops all relative URLs
@@ -1760,6 +1760,10 @@ class Sanitizer {
                        # true
                        'img'        => array_merge( $common, [ 'alt', 'src', 'width', 'height' ] ),
 
+                       'video'      => array_merge( $common, [ 'poster', 'controls', 'preload', 'width', 'height' ] ),
+                       'source'     => array_merge( $common, [ 'type', 'src' ] ),
+                       'track'      => array_merge( $common, [ 'type', 'src', 'srclang', 'kind', 'label' ] ),
+
                        # 15.2.1
                        'tt'         => $common,
                        'b'          => $common,
@@ -1784,7 +1788,7 @@ class Sanitizer {
                        'rb'         => $common,
                        'rp'         => $common,
                        'rt'         => $common, # array_merge( $common, array( 'rbspan' ) ),
-                       'rtc'         => $common,
+                       'rtc'        => $common,
 
                        # MathML root element, where used for extensions
                        # 'title' may not be 100% valid here; it's XHTML