1af5cf7181ed836817ecede83f4749e3084d9d7e
3 * XHTML sanitizer for MediaWiki
5 * Copyright (C) 2002-2005 Brion Vibber <brion@pobox.com> et al
6 * http://www.mediawiki.org/
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
21 * http://www.gnu.org/copyleft/gpl.html
28 * Regular expression to match various types of character references in
29 * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
31 define( 'MW_CHAR_REFS_REGEX',
32 '/&([A-Za-z0-9\x80-\xff]+);
39 * Regular expression to match HTML/XML attribute pairs within a tag.
40 * Allows some... latitude.
41 * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
43 $attrib = '[A-Za-z0-9]';
44 $space = '[\x09\x0a\x0d\x20]';
45 define( 'MW_ATTRIBS_REGEX',
46 "/(?:^|$space)($attrib+)
49 # The attribute value: quoted or alone
52 | ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
53 | (\#[0-9a-fA-F]+) # Technically wrong, but lots of
54 # colors are specified like this.
55 # We'll be normalizing it.
57 )?(?=$space|\$)/sx" );
60 * Regular expression to match URIs that could trigger script execution
62 define( 'MW_SCRIPT_URL_PATTERN', '/(^|\s)(javascript|vbscript)[^\w]/i' );
65 * List of all named character entities defined in HTML 4.01
66 * http://www.w3.org/TR/html4/sgml/entities.html
69 global $wgHtmlEntities;
70 $wgHtmlEntities = array(
325 * Character entity aliases accepted by MediaWiki
327 global $wgHtmlEntityAliases;
328 $wgHtmlEntityAliases = array(
335 * XHTML sanitizer for MediaWiki
340 * Cleans up HTML, removes dangerous tags and attributes, and
341 * removes HTML comments
343 * @param $text String
344 * @param $processCallback Callback to do any variable or parameter replacements in HTML attribute values
345 * @param $args Array for the processing callback
346 * @param $extratags Array for any extra tags to include
347 * @param $removetags Array for any tags (default or extra) to exclude
350 static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array(), $removetags = array() ) {
353 static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
354 $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
356 wfProfileIn( __METHOD__
);
358 if ( !$staticInitialised ) {
360 $htmlpairsStatic = array( # Tags that must be closed
361 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
362 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
363 'strike', 'strong', 'tt', 'var', 'div', 'center',
364 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
365 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u', 'abbr'
368 'br', 'hr', 'li', 'dt', 'dd'
370 $htmlsingleonly = array( # Elements that cannot have close tags
373 $htmlnest = array( # Tags that can be nested--??
374 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
375 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
377 $tabletags = array( # Can only appear inside table, we will close them
380 $htmllist = array( # Tags used by list
383 $listtags = array( # Tags that can appear in a list
387 $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
388 $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
390 # Convert them all to hashtables for faster lookup
391 $vars = array( 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
392 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' );
393 foreach ( $vars as $var ) {
394 $
$var = array_flip( $
$var );
396 $staticInitialised = true;
398 # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
399 $extratags = array_flip( $extratags );
400 $removetags = array_flip( $removetags );
401 $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
402 $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ) , $removetags );
404 # Remove HTML comments
405 $text = Sanitizer
::removeHTMLcomments( $text );
406 $bits = explode( '<', $text );
407 $text = str_replace( '>', '>', array_shift( $bits ) );
409 $tagstack = $tablestack = array();
410 foreach ( $bits as $x ) {
412 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
413 list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
415 $slash = $t = $params = $brace = $rest = null;
419 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
423 if( isset( $htmlsingleonly[$t] ) ) {
425 } elseif ( ( $ot = @array_pop
( $tagstack ) ) != $t ) {
426 if ( isset( $htmlsingleallowed[$ot] ) ) {
427 # Pop all elements with an optional close tag
428 # and see if we find a match below them
430 array_push ($optstack, $ot);
431 while ( ( ( $ot = @array_pop
( $tagstack ) ) != $t ) &&
432 isset( $htmlsingleallowed[$ot] ) )
434 array_push ($optstack, $ot);
437 # No match. Push the optinal elements back again
439 while ( $ot = @array_pop
( $optstack ) ) {
440 array_push( $tagstack, $ot );
444 @array_push
( $tagstack, $ot );
445 # <li> can be nested in <ul> or <ol>, skip those cases:
446 if(!(isset( $htmllist[$ot] ) && isset( $listtags[$t] ) )) {
451 if ( $t == 'table' ) {
452 $tagstack = array_pop( $tablestack );
457 # Keep track for later
458 if ( isset( $tabletags[$t] ) &&
459 ! in_array( 'table', $tagstack ) ) {
461 } else if ( in_array( $t, $tagstack ) &&
462 ! isset( $htmlnest [$t ] ) ) {
464 #Â Is it a self closed htmlpair ? (bug 5487)
465 } else if( $brace == '/>' &&
466 isset( $htmlpairs[$t] ) ) {
468 } elseif( isset( $htmlsingleonly[$t] ) ) {
469 # Hack to force empty tag for uncloseable elements
471 } else if( isset( $htmlsingle[$t] ) ) {
472 # Hack to not close $htmlsingle tags
474 } else if( isset( $tabletags[$t] )
475 && in_array($t ,$tagstack) ) {
476 // New table tag but forgot to close the previous one
479 if ( $t == 'table' ) {
480 array_push( $tablestack, $tagstack );
483 array_push( $tagstack, $t );
486 # Replace any variables or template parameters with
488 if( is_callable( $processCallback ) ) {
489 call_user_func_array( $processCallback, array( &$params, $args ) );
492 # Strip non-approved attributes from the tag
493 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
496 $rest = str_replace( '>', '>', $rest );
497 $close = ( $brace == '/>' && !$slash ) ?
' /' : '';
498 $text .= "<$slash$t$newparams$close>$rest";
502 $text .= '<' . str_replace( '>', '>', $x);
504 # Close off any remaining tags
505 while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
507 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
510 # this might be possible using tidy itself
511 foreach ( $bits as $x ) {
512 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
514 @list
( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
515 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
516 if( is_callable( $processCallback ) ) {
517 call_user_func_array( $processCallback, array( &$params, $args ) );
519 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
520 $rest = str_replace( '>', '>', $rest );
521 $text .= "<$slash$t$newparams$brace$rest";
523 $text .= '<' . str_replace( '>', '>', $x);
527 wfProfileOut( __METHOD__
);
532 * Remove '<!--', '-->', and everything between.
533 * To avoid leaving blank lines, when a comment is both preceded
534 * and followed by a newline (ignoring spaces), trim leading and
535 * trailing spaces and one of the newlines.
538 * @param $text String
541 static function removeHTMLcomments( $text ) {
542 wfProfileIn( __METHOD__
);
543 while (($start = strpos($text, '<!--')) !== false) {
544 $end = strpos($text, '-->', $start +
4);
545 if ($end === false) {
546 # Unterminated comment; bail out
552 # Trim space and newline if the comment is both
553 # preceded and followed by a newline
554 $spaceStart = max($start - 1, 0);
555 $spaceLen = $end - $spaceStart;
556 while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
560 while (substr($text, $spaceStart +
$spaceLen, 1) === ' ')
562 if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart +
$spaceLen, 1) === "\n") {
563 # Remove the comment, leading and trailing
564 # spaces, and leave only one newline.
565 $text = substr_replace($text, "\n", $spaceStart, $spaceLen +
1);
568 # Remove just the comment.
569 $text = substr_replace($text, '', $start, $end - $start);
572 wfProfileOut( __METHOD__
);
577 * Take an array of attribute names and values and normalize or discard
578 * illegal values for the given element type.
580 * - Discards attributes not on a whitelist for the given element
581 * - Unsafe style attributes are discarded
582 * - Invalid id attributes are reencoded
584 * @param $attribs Array
585 * @param $element String
588 * @todo Check for legal values where the DTD limits things.
589 * @todo Check for unique id attribute :P
591 static function validateTagAttributes( $attribs, $element ) {
592 return Sanitizer
::validateAttributes( $attribs,
593 Sanitizer
::attributeWhitelist( $element ) );
597 * Take an array of attribute names and values and normalize or discard
598 * illegal values for the given whitelist.
600 * - Discards attributes not the given whitelist
601 * - Unsafe style attributes are discarded
602 * - Invalid id attributes are reencoded
604 * @param $attribs Array
605 * @param $whitelist Array: list of allowed attribute names
608 * @todo Check for legal values where the DTD limits things.
609 * @todo Check for unique id attribute :P
611 static function validateAttributes( $attribs, $whitelist ) {
612 $whitelist = array_flip( $whitelist );
613 $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
616 foreach( $attribs as $attribute => $value ) {
617 if( !isset( $whitelist[$attribute] ) ) {
620 # Strip javascript "expression" from stylesheets.
621 # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
622 if( $attribute == 'style' ) {
623 $value = Sanitizer
::checkCss( $value );
624 if( $value === false ) {
630 if ( $attribute === 'id' ) {
631 global $wgEnforceHtmlIds;
632 $value = Sanitizer
::escapeId( $value,
633 $wgEnforceHtmlIds ?
'noninitial' : 'xml' );
636 //RDFa properties allow URIs. check them
637 if ( $attribute === 'rel' ||
$attribute === 'rev' ||
638 $attribute === 'about' ||
$attribute === 'property' ||
$attribute === 'resource' ||
639 $attribute === 'datatype' ||
$attribute === 'typeof' ) {
640 //Paranoia. Allow "simple" values but suppress javascript
641 if ( preg_match( MW_SCRIPT_URL_PATTERN
, $value ) ) {
646 # NOTE: even though elements using href/src are not allowed directly, supply
647 # validation code that can be used by tag hook handlers, etc
648 if ( $attribute === 'href' ||
$attribute === 'src' ) {
649 if ( !preg_match( $hrefExp, $value ) ) {
650 continue; //drop any href or src attributes not using an allowed protocol.
651 //NOTE: this also drops all relative URLs
655 // If this attribute was previously set, override it.
656 // Output should only have one attribute of each name.
657 $out[$attribute] = $value;
663 * Merge two sets of HTML attributes. Conflicting items in the second set
664 * will override those in the first, except for 'class' attributes which
665 * will be combined (if they're both strings).
667 * @todo implement merging for other attributes such as style
672 static function mergeAttributes( $a, $b ) {
673 $out = array_merge( $a, $b );
674 if( isset( $a['class'] ) && isset( $b['class'] )
675 && is_string( $a['class'] ) && is_string( $b['class'] )
676 && $a['class'] !== $b['class'] ) {
677 $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
678 -1, PREG_SPLIT_NO_EMPTY
);
679 $out['class'] = implode( ' ', array_unique( $classes ) );
685 * Pick apart some CSS and check it for forbidden or unsafe structures.
686 * Returns a sanitized string, or false if it was just too evil.
688 * Currently URL references, 'expression', 'tps' are forbidden.
690 * @param $value String
693 static function checkCss( $value ) {
694 $stripped = Sanitizer
::decodeCharReferences( $value );
696 // Remove any comments; IE gets token splitting wrong
697 $stripped = StringUtils
::delimiterReplace( '/*', '*/', ' ', $stripped );
701 // ... and continue checks
702 $stripped = preg_replace( '!\\\\([0-9A-Fa-f]{1,6})[ \\n\\r\\t\\f]?!e',
703 'codepointToUtf8(hexdec("$1"))', $stripped );
704 $stripped = str_replace( '\\', '', $stripped );
705 if( preg_match( '/(?:expression|tps*:\/\/|url\\s*\().*/is',
715 * Take a tag soup fragment listing an HTML element's attributes
716 * and normalize it to well-formed XML, discarding unwanted attributes.
717 * Output is safe for further wikitext processing, with escaping of
718 * values that could trigger problems.
720 * - Normalizes attribute names to lowercase
721 * - Discards attributes not on a whitelist for the given element
722 * - Turns broken or invalid entities into plaintext
723 * - Double-quotes all attribute values
724 * - Attributes without values are given the name as attribute
725 * - Double attributes are discarded
726 * - Unsafe style attributes are discarded
727 * - Prepends space if there are attributes.
729 * @param $text String
730 * @param $element String
733 static function fixTagAttributes( $text, $element ) {
734 if( trim( $text ) == '' ) {
738 $stripped = Sanitizer
::validateTagAttributes(
739 Sanitizer
::decodeTagAttributes( $text ), $element );
742 foreach( $stripped as $attribute => $value ) {
743 $encAttribute = htmlspecialchars( $attribute );
744 $encValue = Sanitizer
::safeEncodeAttribute( $value );
746 $attribs[] = "$encAttribute=\"$encValue\"";
748 return count( $attribs ) ?
' ' . implode( ' ', $attribs ) : '';
752 * Encode an attribute value for HTML output.
753 * @param $text String
754 * @return HTML-encoded text fragment
756 static function encodeAttribute( $text ) {
757 $encValue = htmlspecialchars( $text, ENT_QUOTES
);
759 // Whitespace is normalized during attribute decoding,
760 // so if we've been passed non-spaces we must encode them
761 // ahead of time or they won't be preserved.
762 $encValue = strtr( $encValue, array(
772 * Encode an attribute value for HTML tags, with extra armoring
773 * against further wiki processing.
774 * @param $text String
775 * @return HTML-encoded text fragment
777 static function safeEncodeAttribute( $text ) {
778 $encValue = Sanitizer
::encodeAttribute( $text );
780 # Templates and links may be expanded in later parsing,
781 # creating invalid or dangerous output. Suppress this.
782 $encValue = strtr( $encValue, array(
783 '<' => '<', // This should never happen,
784 '>' => '>', // we've received invalid input
785 '"' => '"', // which should have been escaped.
788 "''" => '''',
789 'ISBN' => 'ISBN',
791 'PMID' => 'PMID',
797 $encValue = preg_replace_callback(
798 '/(' . wfUrlProtocols() . ')/',
799 array( 'Sanitizer', 'armorLinksCallback' ),
805 * Given a value escape it so that it can be used in an id attribute and
806 * return it, this does not validate the value however (see first link)
808 * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters
811 * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
813 * @param $id String: id to validate
814 * @param $options Mixed: string or array of strings (default is array()):
815 * 'noninitial': This is a non-initial fragment of an id, not a full id,
816 * so don't pay attention if the first character isn't valid at the
817 * beginning of an id.
818 * 'xml': Don't restrict the id to be HTML4-compatible. This option
819 * allows any alphabetic character to be used, per the XML standard.
820 * Therefore, it also completely changes the type of escaping: instead
821 * of weird dot-encoding, runs of invalid characters (mostly
822 * whitespace) are just compressed into a single underscore.
825 static function escapeId( $id, $options = array() ) {
826 $options = (array)$options;
828 if ( !in_array( 'xml', $options ) ) {
829 # HTML4-style escaping
830 static $replace = array(
835 $id = urlencode( Sanitizer
::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
836 $id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
838 if ( !preg_match( '/^[a-zA-Z]/', $id )
839 && !in_array( 'noninitial', $options ) ) {
840 // Initial character must be a letter!
846 # XML-style escaping. For the patterns used, see the XML 1.0 standard,
847 # 5th edition, NameStartChar and NameChar: <http://www.w3.org/TR/REC-xml/>
848 $nameStartChar = ':a-zA-Z_\xC0-\xD6\xD8-\xF6\xF8-\x{2FF}\x{370}-\x{37D}'
849 . '\x{37F}-\x{1FFF}\x{200C}-\x{200D}\x{2070}-\x{218F}\x{2C00}-\x{2FEF}'
850 . '\x{3001}-\x{D7FF}\x{F900}-\x{FDCF}\x{FDF0}-\x{FFFD}\x{10000}-\x{EFFFF}';
851 $nameChar = $nameStartChar . '.\-0-9\xB7\x{0300}-\x{036F}'
852 . '\x{203F}-\x{2040}';
853 # Replace _ as well so we don't get multiple consecutive underscores
854 $id = preg_replace( "/([^$nameChar]|_)+/u", '_', $id );
855 $id = trim( $id, '_' );
857 if ( !preg_match( "/^[$nameStartChar]/u", $id )
858 && !in_array( 'noninitial', $options ) ) {
866 * Given a value, escape it so that it can be used as a CSS class and
869 * @todo For extra validity, input should be validated UTF-8.
871 * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
873 * @param $class String
876 static function escapeClass( $class ) {
877 // Convert ugly stuff to underscores and kill underscores in ugly places
878 return rtrim(preg_replace(
879 array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
885 * Given HTML input, escape with htmlspecialchars but un-escape entites.
886 * This allows (generally harmless) entities like to survive.
888 * @param $html String to escape
889 * @return String: escaped input
891 static function escapeHtmlAllowEntities( $html ) {
892 # It seems wise to escape ' as well as ", as a matter of course. Can't
894 $html = htmlspecialchars( $html, ENT_QUOTES
);
895 $html = str_replace( '&', '&', $html );
896 $html = Sanitizer
::normalizeCharReferences( $html );
901 * Regex replace callback for armoring links against further processing.
902 * @param $matches Array
905 private static function armorLinksCallback( $matches ) {
906 return str_replace( ':', ':', $matches[1] );
910 * Return an associative array of attribute names and values from
911 * a partial tag string. Attribute names are forces to lowercase,
912 * character references are decoded to UTF-8 text.
914 * @param $text String
917 public static function decodeTagAttributes( $text ) {
920 if( trim( $text ) == '' ) {
933 foreach( $pairs as $set ) {
934 $attribute = strtolower( $set[1] );
935 $value = Sanitizer
::getTagAttributeCallback( $set );
937 // Normalize whitespace
938 $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
939 $value = trim( $value );
941 // Decode character references
942 $attribs[$attribute] = Sanitizer
::decodeCharReferences( $value );
948 * Pick the appropriate attribute value from a match set from the
949 * MW_ATTRIBS_REGEX matches.
954 private static function getTagAttributeCallback( $set ) {
955 if( isset( $set[6] ) ) {
956 # Illegal #XXXXXX color with no quotes.
958 } elseif( isset( $set[5] ) ) {
961 } elseif( isset( $set[4] ) ) {
964 } elseif( isset( $set[3] ) ) {
967 } elseif( !isset( $set[2] ) ) {
968 # In XHTML, attributes must have a value.
969 # For 'reduced' form, return explicitly the attribute name here.
972 throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
977 * Normalize whitespace and character references in an XML source-
978 * encoded text for an attribute value.
980 * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
981 * but note that we're not returning the value, but are returning
982 * XML source fragments that will be slapped into output.
984 * @param $text String
987 private static function normalizeAttributeValue( $text ) {
988 return str_replace( '"', '"',
989 self
::normalizeWhitespace(
990 Sanitizer
::normalizeCharReferences( $text ) ) );
993 private static function normalizeWhitespace( $text ) {
995 '/\r\n|[\x20\x0d\x0a\x09]/',
1001 * Ensure that any entities and character references are legal
1002 * for XML and XHTML specifically. Any stray bits will be
1003 * &-escaped to result in a valid text fragment.
1005 * a. any named char refs must be known in XHTML
1006 * b. any numeric char refs must be legal chars, not invalid or forbidden
1007 * c. use &#x, not &#X
1008 * d. fix or reject non-valid attributes
1010 * @param $text String
1014 static function normalizeCharReferences( $text ) {
1015 return preg_replace_callback(
1017 array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
1021 * @param $matches String
1024 static function normalizeCharReferencesCallback( $matches ) {
1026 if( $matches[1] != '' ) {
1027 $ret = Sanitizer
::normalizeEntity( $matches[1] );
1028 } elseif( $matches[2] != '' ) {
1029 $ret = Sanitizer
::decCharReference( $matches[2] );
1030 } elseif( $matches[3] != '' ) {
1031 $ret = Sanitizer
::hexCharReference( $matches[3] );
1032 } elseif( $matches[4] != '' ) {
1033 $ret = Sanitizer
::hexCharReference( $matches[4] );
1035 if( is_null( $ret ) ) {
1036 return htmlspecialchars( $matches[0] );
1043 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1044 * return the named entity reference as is. If the entity is a
1045 * MediaWiki-specific alias, returns the HTML equivalent. Otherwise,
1046 * returns HTML-escaped text of pseudo-entity source (eg &foo;)
1048 * @param $name String
1051 static function normalizeEntity( $name ) {
1052 global $wgHtmlEntities, $wgHtmlEntityAliases;
1053 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1054 return "&{$wgHtmlEntityAliases[$name]};";
1055 } elseif( isset( $wgHtmlEntities[$name] ) ) {
1058 return "&$name;";
1062 static function decCharReference( $codepoint ) {
1063 $point = intval( $codepoint );
1064 if( Sanitizer
::validateCodepoint( $point ) ) {
1065 return sprintf( '&#%d;', $point );
1071 static function hexCharReference( $codepoint ) {
1072 $point = hexdec( $codepoint );
1073 if( Sanitizer
::validateCodepoint( $point ) ) {
1074 return sprintf( '&#x%x;', $point );
1081 * Returns true if a given Unicode codepoint is a valid character in XML.
1082 * @param $codepoint Integer
1085 private static function validateCodepoint( $codepoint ) {
1086 return ($codepoint == 0x09)
1087 ||
($codepoint == 0x0a)
1088 ||
($codepoint == 0x0d)
1089 ||
($codepoint >= 0x20 && $codepoint <= 0xd7ff)
1090 ||
($codepoint >= 0xe000 && $codepoint <= 0xfffd)
1091 ||
($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
1095 * Decode any character references, numeric or named entities,
1096 * in the text and return a UTF-8 string.
1098 * @param $text String
1101 public static function decodeCharReferences( $text ) {
1102 return preg_replace_callback(
1104 array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1109 * @param $matches String
1112 static function decodeCharReferencesCallback( $matches ) {
1113 if( $matches[1] != '' ) {
1114 return Sanitizer
::decodeEntity( $matches[1] );
1115 } elseif( $matches[2] != '' ) {
1116 return Sanitizer
::decodeChar( intval( $matches[2] ) );
1117 } elseif( $matches[3] != '' ) {
1118 return Sanitizer
::decodeChar( hexdec( $matches[3] ) );
1119 } elseif( $matches[4] != '' ) {
1120 return Sanitizer
::decodeChar( hexdec( $matches[4] ) );
1122 # Last case should be an ampersand by itself
1127 * Return UTF-8 string for a codepoint if that is a valid
1128 * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
1129 * @param $codepoint Integer
1133 static function decodeChar( $codepoint ) {
1134 if( Sanitizer
::validateCodepoint( $codepoint ) ) {
1135 return codepointToUtf8( $codepoint );
1137 return UTF8_REPLACEMENT
;
1142 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1143 * return the UTF-8 encoding of that character. Otherwise, returns
1144 * pseudo-entity source (eg &foo;)
1146 * @param $name Strings
1149 static function decodeEntity( $name ) {
1150 global $wgHtmlEntities, $wgHtmlEntityAliases;
1151 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1152 $name = $wgHtmlEntityAliases[$name];
1154 if( isset( $wgHtmlEntities[$name] ) ) {
1155 return codepointToUtf8( $wgHtmlEntities[$name] );
1162 * Fetch the whitelist of acceptable attributes for a given element name.
1164 * @param $element String
1167 static function attributeWhitelist( $element ) {
1169 if( !isset( $list ) ) {
1170 $list = Sanitizer
::setupAttributeWhitelist();
1172 return isset( $list[$element] )
1178 * Foreach array key (an allowed HTML element), return an array
1179 * of allowed attributes
1182 static function setupAttributeWhitelist() {
1183 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style',
1184 #RDFa attributes as specified in section 9 of http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1185 'about', 'property', 'resource', 'datatype', 'typeof',
1188 $block = array_merge( $common, array( 'align' ) );
1189 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1190 $tablecell = array( 'abbr',
1196 'nowrap', # deprecated
1197 'width', # deprecated
1198 'height', # deprecated
1199 'bgcolor' # deprecated
1202 # Numbers refer to sections in HTML 4.01 standard describing the element.
1203 # See: http://www.w3.org/TR/html4/
1204 $whitelist = array (
1207 'center' => $common, # deprecated
1208 'span' => $block, # ??
1226 'strong' => $common,
1237 'blockquote' => array_merge( $common, array( 'cite' ) ),
1248 'br' => array( 'id', 'class', 'title', 'style', 'clear' ),
1251 'pre' => array_merge( $common, array( 'width' ) ),
1254 'ins' => array_merge( $common, array( 'cite', 'datetime' ) ),
1255 'del' => array_merge( $common, array( 'cite', 'datetime' ) ),
1258 'ul' => array_merge( $common, array( 'type' ) ),
1259 'ol' => array_merge( $common, array( 'type', 'start' ) ),
1260 'li' => array_merge( $common, array( 'type', 'value' ) ),
1268 'table' => array_merge( $common,
1269 array( 'summary', 'width', 'border', 'frame',
1270 'rules', 'cellspacing', 'cellpadding',
1275 'caption' => array_merge( $common, array( 'align' ) ),
1278 'thead' => array_merge( $common, $tablealign ),
1279 'tfoot' => array_merge( $common, $tablealign ),
1280 'tbody' => array_merge( $common, $tablealign ),
1283 'colgroup' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1284 'col' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1287 'tr' => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1290 'td' => array_merge( $common, $tablecell, $tablealign ),
1291 'th' => array_merge( $common, $tablecell, $tablealign ),
1293 # 12.2 # NOTE: <a> is not allowed directly, but the attrib whitelist is used from the Parser object
1294 'a' => array_merge( $common, array( 'href', 'rel', 'rev' ) ), # rel/rev esp. for RDFa
1297 # Not usually allowed, but may be used for extension-style hooks
1298 # such as <math> when it is rasterized
1299 'img' => array_merge( $common, array( 'alt' ) ),
1307 'strike' => $common,
1312 'font' => array_merge( $common, array( 'size', 'color', 'face' ) ),
1316 'hr' => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1318 # XHTML Ruby annotation text module, simple ruby only.
1319 # http://www.w3c.org/TR/ruby/
1324 'rt' => $common, #array_merge( $common, array( 'rbspan' ) ),
1327 # MathML root element, where used for extensions
1328 # 'title' may not be 100% valid here; it's XHTML
1329 # http://www.w3.org/TR/REC-MathML/
1330 'math' => array( 'class', 'style', 'id', 'title' ),
1336 * Take a fragment of (potentially invalid) HTML and return
1337 * a version with any tags removed, encoded as plain text.
1339 * Warning: this return value must be further escaped for literal
1340 * inclusion in HTML output as of 1.10!
1342 * @param $text String: HTML fragment
1345 static function stripAllTags( $text ) {
1347 $text = StringUtils
::delimiterReplace( '<', '>', '', $text );
1349 # Normalize &entities and whitespace
1350 $text = self
::decodeCharReferences( $text );
1351 $text = self
::normalizeWhitespace( $text );
1357 * Hack up a private DOCTYPE with HTML's standard entity declarations.
1358 * PHP 4 seemed to know these if you gave it an HTML doctype, but
1361 * Use for passing XHTML fragments to PHP's XML parsing functions
1365 static function hackDocType() {
1366 global $wgHtmlEntities;
1367 $out = "<!DOCTYPE html [\n";
1368 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1369 $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1375 static function cleanUrl( $url ) {
1376 # Normalize any HTML entities in input. They will be
1377 # re-escaped by makeExternalLink().
1378 $url = Sanitizer
::decodeCharReferences( $url );
1380 # Escape any control characters introduced by the above step
1381 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F]/e', "urlencode('\\0')", $url );
1383 # Validate hostname portion
1385 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1386 list( /* $whole */, $protocol, $host, $rest ) = $matches;
1388 // Characters that will be ignored in IDNs.
1389 // http://tools.ietf.org/html/3454#section-3.1
1390 // Strip them before further processing so blacklists and such work.
1392 \\s| # general whitespace
1393 \xc2\xad| # 00ad SOFT HYPHEN
1394 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1395 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1396 \xe2\x81\xa0| # 2060 WORD JOINER
1397 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1398 \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
1399 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1400 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1401 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1402 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1403 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1404 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1407 $host = preg_replace( $strip, '', $host );
1409 // @fixme: validate hostnames here
1411 return $protocol . $host . $rest;