includes/Sanitizer.php

   1 <?php
   2 /**
   3  * XHTML sanitizer for MediaWiki
   4  *
   5  * Copyright (C) 2002-2005 Brion Vibber <brion@pobox.com> et al
   6  * http://www.mediawiki.org/
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along
  19  * with this program; if not, write to the Free Software Foundation, Inc.,
  20  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  21  * http://www.gnu.org/copyleft/gpl.html
  22  *
  23  * @package MediaWiki
  24  * @subpackage Parser
  25  */
  26
  27 /**
  28  * Regular expression to match various types of character references in
  29  * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
  30  */
  31 define( 'MW_CHAR_REFS_REGEX',
  32         '/&([A-Za-z0-9]+);
  33          |&\#([0-9]+);
  34          |&\#x([0-9A-Za-z]+);
  35          |&\#X([0-9A-Za-z]+);
  36          |(&)/x' );
  37
  38 /**
  39  * Regular expression to match HTML/XML attribute pairs within a tag.
  40  * Allows some... latitude.
  41  * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
  42  */
  43 $attrib = '[A-Za-z0-9]';
  44 $space = '[\x09\x0a\x0d\x20]';
  45 define( 'MW_ATTRIBS_REGEX',
  46         "/(?:^|$space)($attrib+)
  47           ($space*=$space*
  48                 (?:
  49                  # The attribute value: quoted or alone
  50                   \"([^<\"]*)\"
  51                  | '([^<']*)'
  52                  |  ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
  53                  |  (\#[0-9a-fA-F]+) # Technically wrong, but lots of
  54                                                          # colors are specified like this.
  55                                                          # We'll be normalizing it.
  56                 )
  57            )?(?=$space|\$)/sx" );
  58
  59 /**
  60  * List of all named character entities defined in HTML 4.01
  61  * http://www.w3.org/TR/html4/sgml/entities.html
  62  * @private
  63  */
  64 global $wgHtmlEntities;
  65 $wgHtmlEntities = array(
  66         'Aacute'   => 193,
  67         'aacute'   => 225,
  68         'Acirc'    => 194,
  69         'acirc'    => 226,
  70         'acute'    => 180,
  71         'AElig'    => 198,
  72         'aelig'    => 230,
  73         'Agrave'   => 192,
  74         'agrave'   => 224,
  75         'alefsym'  => 8501,
  76         'Alpha'    => 913,
  77         'alpha'    => 945,
  78         'amp'      => 38,
  79         'and'      => 8743,
  80         'ang'      => 8736,
  81         'Aring'    => 197,
  82         'aring'    => 229,
  83         'asymp'    => 8776,
  84         'Atilde'   => 195,
  85         'atilde'   => 227,
  86         'Auml'     => 196,
  87         'auml'     => 228,
  88         'bdquo'    => 8222,
  89         'Beta'     => 914,
  90         'beta'     => 946,
  91         'brvbar'   => 166,
  92         'bull'     => 8226,
  93         'cap'      => 8745,
  94         'Ccedil'   => 199,
  95         'ccedil'   => 231,
  96         'cedil'    => 184,
  97         'cent'     => 162,
  98         'Chi'      => 935,
  99         'chi'      => 967,
 100         'circ'     => 710,
 101         'clubs'    => 9827,
 102         'cong'     => 8773,
 103         'copy'     => 169,
 104         'crarr'    => 8629,
 105         'cup'      => 8746,
 106         'curren'   => 164,
 107         'dagger'   => 8224,
 108         'Dagger'   => 8225,
 109         'darr'     => 8595,
 110         'dArr'     => 8659,
 111         'deg'      => 176,
 112         'Delta'    => 916,
 113         'delta'    => 948,
 114         'diams'    => 9830,
 115         'divide'   => 247,
 116         'Eacute'   => 201,
 117         'eacute'   => 233,
 118         'Ecirc'    => 202,
 119         'ecirc'    => 234,
 120         'Egrave'   => 200,
 121         'egrave'   => 232,
 122         'empty'    => 8709,
 123         'emsp'     => 8195,
 124         'ensp'     => 8194,
 125         'Epsilon'  => 917,
 126         'epsilon'  => 949,
 127         'equiv'    => 8801,
 128         'Eta'      => 919,
 129         'eta'      => 951,
 130         'ETH'      => 208,
 131         'eth'      => 240,
 132         'Euml'     => 203,
 133         'euml'     => 235,
 134         'euro'     => 8364,
 135         'exist'    => 8707,
 136         'fnof'     => 402,
 137         'forall'   => 8704,
 138         'frac12'   => 189,
 139         'frac14'   => 188,
 140         'frac34'   => 190,
 141         'frasl'    => 8260,
 142         'Gamma'    => 915,
 143         'gamma'    => 947,
 144         'ge'       => 8805,
 145         'gt'       => 62,
 146         'harr'     => 8596,
 147         'hArr'     => 8660,
 148         'hearts'   => 9829,
 149         'hellip'   => 8230,
 150         'Iacute'   => 205,
 151         'iacute'   => 237,
 152         'Icirc'    => 206,
 153         'icirc'    => 238,
 154         'iexcl'    => 161,
 155         'Igrave'   => 204,
 156         'igrave'   => 236,
 157         'image'    => 8465,
 158         'infin'    => 8734,
 159         'int'      => 8747,
 160         'Iota'     => 921,
 161         'iota'     => 953,
 162         'iquest'   => 191,
 163         'isin'     => 8712,
 164         'Iuml'     => 207,
 165         'iuml'     => 239,
 166         'Kappa'    => 922,
 167         'kappa'    => 954,
 168         'Lambda'   => 923,
 169         'lambda'   => 955,
 170         'lang'     => 9001,
 171         'laquo'    => 171,
 172         'larr'     => 8592,
 173         'lArr'     => 8656,
 174         'lceil'    => 8968,
 175         'ldquo'    => 8220,
 176         'le'       => 8804,
 177         'lfloor'   => 8970,
 178         'lowast'   => 8727,
 179         'loz'      => 9674,
 180         'lrm'      => 8206,
 181         'lsaquo'   => 8249,
 182         'lsquo'    => 8216,
 183         'lt'       => 60,
 184         'macr'     => 175,
 185         'mdash'    => 8212,
 186         'micro'    => 181,
 187         'middot'   => 183,
 188         'minus'    => 8722,
 189         'Mu'       => 924,
 190         'mu'       => 956,
 191         'nabla'    => 8711,
 192         'nbsp'     => 160,
 193         'ndash'    => 8211,
 194         'ne'       => 8800,
 195         'ni'       => 8715,
 196         'not'      => 172,
 197         'notin'    => 8713,
 198         'nsub'     => 8836,
 199         'Ntilde'   => 209,
 200         'ntilde'   => 241,
 201         'Nu'       => 925,
 202         'nu'       => 957,
 203         'Oacute'   => 211,
 204         'oacute'   => 243,
 205         'Ocirc'    => 212,
 206         'ocirc'    => 244,
 207         'OElig'    => 338,
 208         'oelig'    => 339,
 209         'Ograve'   => 210,
 210         'ograve'   => 242,
 211         'oline'    => 8254,
 212         'Omega'    => 937,
 213         'omega'    => 969,
 214         'Omicron'  => 927,
 215         'omicron'  => 959,
 216         'oplus'    => 8853,
 217         'or'       => 8744,
 218         'ordf'     => 170,
 219         'ordm'     => 186,
 220         'Oslash'   => 216,
 221         'oslash'   => 248,
 222         'Otilde'   => 213,
 223         'otilde'   => 245,
 224         'otimes'   => 8855,
 225         'Ouml'     => 214,
 226         'ouml'     => 246,
 227         'para'     => 182,
 228         'part'     => 8706,
 229         'permil'   => 8240,
 230         'perp'     => 8869,
 231         'Phi'      => 934,
 232         'phi'      => 966,
 233         'Pi'       => 928,
 234         'pi'       => 960,
 235         'piv'      => 982,
 236         'plusmn'   => 177,
 237         'pound'    => 163,
 238         'prime'    => 8242,
 239         'Prime'    => 8243,
 240         'prod'     => 8719,
 241         'prop'     => 8733,
 242         'Psi'      => 936,
 243         'psi'      => 968,
 244         'quot'     => 34,
 245         'radic'    => 8730,
 246         'rang'     => 9002,
 247         'raquo'    => 187,
 248         'rarr'     => 8594,
 249         'rArr'     => 8658,
 250         'rceil'    => 8969,
 251         'rdquo'    => 8221,
 252         'real'     => 8476,
 253         'reg'      => 174,
 254         'rfloor'   => 8971,
 255         'Rho'      => 929,
 256         'rho'      => 961,
 257         'rlm'      => 8207,
 258         'rsaquo'   => 8250,
 259         'rsquo'    => 8217,
 260         'sbquo'    => 8218,
 261         'Scaron'   => 352,
 262         'scaron'   => 353,
 263         'sdot'     => 8901,
 264         'sect'     => 167,
 265         'shy'      => 173,
 266         'Sigma'    => 931,
 267         'sigma'    => 963,
 268         'sigmaf'   => 962,
 269         'sim'      => 8764,
 270         'spades'   => 9824,
 271         'sub'      => 8834,
 272         'sube'     => 8838,
 273         'sum'      => 8721,
 274         'sup'      => 8835,
 275         'sup1'     => 185,
 276         'sup2'     => 178,
 277         'sup3'     => 179,
 278         'supe'     => 8839,
 279         'szlig'    => 223,
 280         'Tau'      => 932,
 281         'tau'      => 964,
 282         'there4'   => 8756,
 283         'Theta'    => 920,
 284         'theta'    => 952,
 285         'thetasym' => 977,
 286         'thinsp'   => 8201,
 287         'THORN'    => 222,
 288         'thorn'    => 254,
 289         'tilde'    => 732,
 290         'times'    => 215,
 291         'trade'    => 8482,
 292         'Uacute'   => 218,
 293         'uacute'   => 250,
 294         'uarr'     => 8593,
 295         'uArr'     => 8657,
 296         'Ucirc'    => 219,
 297         'ucirc'    => 251,
 298         'Ugrave'   => 217,
 299         'ugrave'   => 249,
 300         'uml'      => 168,
 301         'upsih'    => 978,
 302         'Upsilon'  => 933,
 303         'upsilon'  => 965,
 304         'Uuml'     => 220,
 305         'uuml'     => 252,
 306         'weierp'   => 8472,
 307         'Xi'       => 926,
 308         'xi'       => 958,
 309         'Yacute'   => 221,
 310         'yacute'   => 253,
 311         'yen'      => 165,
 312         'Yuml'     => 376,
 313         'yuml'     => 255,
 314         'Zeta'     => 918,
 315         'zeta'     => 950,
 316         'zwj'      => 8205,
 317         'zwnj'     => 8204 );
 318
 319 /** @package MediaWiki */
 320 class Sanitizer {
 321         /**
 322          * Cleans up HTML, removes dangerous tags and attributes, and
 323          * removes HTML comments
 324          * @private
 325          * @param string $text
 326          * @param callback $processCallback to do any variable or parameter replacements in HTML attribute values
 327          * @param array $args for the processing callback
 328          * @return string
 329          */
 330         static function removeHTMLtags( $text, $processCallback = null, $args = array() ) {
 331                 global $wgUseTidy, $wgUserHtml;
 332
 333                 static $htmlpairs, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
 334                         $htmllist, $listtags, $htmlsingleallowed, $htmlelements, $staticInitialised;
 335
 336                 wfProfileIn( __METHOD__ );
 337
 338                 if ( !$staticInitialised ) {
 339                         if( $wgUserHtml ) {
 340                                 $htmlpairs = array( # Tags that must be closed
 341                                         'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
 342                                         'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
 343                                         'strike', 'strong', 'tt', 'var', 'div', 'center',
 344                                         'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
 345                                         'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u'
 346                                 );
 347                                 $htmlsingle = array(
 348                                         'br', 'hr', 'li', 'dt', 'dd'
 349                                 );
 350                                 $htmlsingleonly = array( # Elements that cannot have close tags
 351                                         'br', 'hr'
 352                                 );
 353                                 $htmlnest = array( # Tags that can be nested--??
 354                                         'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
 355                                         'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
 356                                 );
 357                                 $tabletags = array( # Can only appear inside table, we will close them
 358                                         'td', 'th', 'tr',
 359                                 );
 360                                 $htmllist = array( # Tags used by list
 361                                         'ul','ol',
 362                                 );
 363                                 $listtags = array( # Tags that can appear in a list
 364                                         'li',
 365                                 );
 366
 367                         } else {
 368                                 $htmlpairs = array();
 369                                 $htmlsingle = array();
 370                                 $htmlnest = array();
 371                                 $tabletags = array();
 372                         }
 373
 374                         $htmlsingleallowed = array_merge( $htmlsingle, $tabletags );
 375                         $htmlelements = array_merge( $htmlsingle, $htmlpairs, $htmlnest );
 376
 377                         # Convert them all to hashtables for faster lookup
 378                         $vars = array( 'htmlpairs', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
 379                                 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelements' );
 380                         foreach ( $vars as $var ) {
 381                                 $$var = array_flip( $$var );
 382                         }
 383                         $staticInitialised = true;
 384                 }
 385
 386                 # Remove HTML comments
 387                 $text = Sanitizer::removeHTMLcomments( $text );
 388                 $bits = explode( '<', $text );
 389                 $text = str_replace( '>', '&gt;', array_shift( $bits ) );
 390                 if(!$wgUseTidy) {
 391                         $tagstack = $tablestack = array();
 392                         foreach ( $bits as $x ) {
 393                                 $regs = array();
 394                                 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
 395                                         list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
 396                                 } else {
 397                                         $slash = $t = $params = $brace = $rest = null;
 398                                 }
 399
 400                                 $badtag = 0 ;
 401                                 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
 402                                         # Check our stack
 403                                         if ( $slash ) {
 404                                                 # Closing a tag...
 405                                                 if( isset( $htmlsingleonly[$t] ) ) {
 406                                                         $badtag = 1;
 407                                                 } elseif ( ( $ot = @array_pop( $tagstack ) ) != $t ) {
 408                                                         if ( isset( $htmlsingleallowed[$ot] ) ) {
 409                                                                 # Pop all elements with an optional close tag
 410                                                                 # and see if we find a match below them
 411                                                                 $optstack = array();
 412                                                                 array_push ($optstack, $ot);
 413                                                                 while ( ( ( $ot = @array_pop( $tagstack ) ) != $t ) &&
 414                                                                                 isset( $htmlsingleallowed[$ot] ) )
 415                                                                 {
 416                                                                         array_push ($optstack, $ot);
 417                                                                 }
 418                                                                 if ( $t != $ot ) {
 419                                                                         # No match. Push the optinal elements back again
 420                                                                         $badtag = 1;
 421                                                                         while ( $ot = @array_pop( $optstack ) ) {
 422                                                                                 array_push( $tagstack, $ot );
 423                                                                         }
 424                                                                 }
 425                                                         } else {
 426                                                                 @array_push( $tagstack, $ot );
 427                                                                 # <li> can be nested in <ul> or <ol>, skip those cases:
 428                                                                 if(!(isset( $htmllist[$ot] ) && isset( $listtags[$t] ) )) {
 429                                                                         $badtag = 1;
 430                                                                 }
 431                                                         }
 432                                                 } else {
 433                                                         if ( $t == 'table' ) {
 434                                                                 $tagstack = array_pop( $tablestack );
 435                                                         }
 436                                                 }
 437                                                 $newparams = '';
 438                                         } else {
 439                                                 # Keep track for later
 440                                                 if ( isset( $tabletags[$t] ) &&
 441                                                 ! in_array( 'table', $tagstack ) ) {
 442                                                         $badtag = 1;
 443                                                 } else if ( in_array( $t, $tagstack ) &&
 444                                                 ! isset( $htmlnest [$t ] ) ) {
 445                                                         $badtag = 1 ;
 446                                                 # Is it a self closed htmlpair ? (bug 5487)
 447                                                 } else if( $brace == '/>' &&
 448                                                 isset( $htmlpairs[$t] ) ) {
 449                                                         $badtag = 1;
 450                                                 } elseif( isset( $htmlsingleonly[$t] ) ) {
 451                                                         # Hack to force empty tag for uncloseable elements
 452                                                         $brace = '/>';
 453                                                 } else if( isset( $htmlsingle[$t] ) ) {
 454                                                         # Hack to not close $htmlsingle tags
 455                                                         $brace = NULL;
 456                                                 } else if( isset( $tabletags[$t] )
 457                                                 &&  in_array($t ,$tagstack) ) {
 458                                                         // New table tag but forgot to close the previous one
 459                                                         $text .= "</$t>";
 460                                                 } else {
 461                                                         if ( $t == 'table' ) {
 462                                                                 array_push( $tablestack, $tagstack );
 463                                                                 $tagstack = array();
 464                                                         }
 465                                                         array_push( $tagstack, $t );
 466                                                 }
 467
 468                                                 # Replace any variables or template parameters with
 469                                                 # plaintext results.
 470                                                 if( is_callable( $processCallback ) ) {
 471                                                         call_user_func_array( $processCallback, array( &$params, $args ) );
 472                                                 }
 473
 474                                                 # Strip non-approved attributes from the tag
 475                                                 $newparams = Sanitizer::fixTagAttributes( $params, $t );
 476                                         }
 477                                         if ( ! $badtag ) {
 478                                                 $rest = str_replace( '>', '&gt;', $rest );
 479                                                 $close = ( $brace == '/>' && !$slash ) ? ' /' : '';
 480                                                 $text .= "<$slash$t$newparams$close>$rest";
 481                                                 continue;
 482                                         }
 483                                 }
 484                                 $text .= '&lt;' . str_replace( '>', '&gt;', $x);
 485                         }
 486                         # Close off any remaining tags
 487                         while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
 488                                 $text .= "</$t>\n";
 489                                 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
 490                         }
 491                 } else {
 492                         # this might be possible using tidy itself
 493                         foreach ( $bits as $x ) {
 494                                 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
 495                                 $x, $regs );
 496                                 @list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
 497                                 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
 498                                         if( is_callable( $processCallback ) ) {
 499                                                 call_user_func_array( $processCallback, array( &$params, $args ) );
 500                                         }
 501                                         $newparams = Sanitizer::fixTagAttributes( $params, $t );
 502                                         $rest = str_replace( '>', '&gt;', $rest );
 503                                         $text .= "<$slash$t$newparams$brace$rest";
 504                                 } else {
 505                                         $text .= '&lt;' . str_replace( '>', '&gt;', $x);
 506                                 }
 507                         }
 508                 }
 509                 wfProfileOut( __METHOD__ );
 510                 return $text;
 511         }
 512
 513         /**
 514          * Remove '<!--', '-->', and everything between.
 515          * To avoid leaving blank lines, when a comment is both preceded
 516          * and followed by a newline (ignoring spaces), trim leading and
 517          * trailing spaces and one of the newlines.
 518          *
 519          * @private
 520          * @param string $text
 521          * @return string
 522          */
 523         static function removeHTMLcomments( $text ) {
 524                 wfProfileIn( __METHOD__ );
 525                 while (($start = strpos($text, '<!--')) !== false) {
 526                         $end = strpos($text, '-->', $start + 4);
 527                         if ($end === false) {
 528                                 # Unterminated comment; bail out
 529                                 break;
 530                         }
 531
 532                         $end += 3;
 533
 534                         # Trim space and newline if the comment is both
 535                         # preceded and followed by a newline
 536                         $spaceStart = max($start - 1, 0);
 537                         $spaceLen = $end - $spaceStart;
 538                         while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
 539                                 $spaceStart--;
 540                                 $spaceLen++;
 541                         }
 542                         while (substr($text, $spaceStart + $spaceLen, 1) === ' ')
 543                                 $spaceLen++;
 544                         if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart + $spaceLen, 1) === "\n") {
 545                                 # Remove the comment, leading and trailing
 546                                 # spaces, and leave only one newline.
 547                                 $text = substr_replace($text, "\n", $spaceStart, $spaceLen + 1);
 548                         }
 549                         else {
 550                                 # Remove just the comment.
 551                                 $text = substr_replace($text, '', $start, $end - $start);
 552                         }
 553                 }
 554                 wfProfileOut( __METHOD__ );
 555                 return $text;
 556         }
 557
 558         /**
 559          * Take an array of attribute names and values and normalize or discard
 560          * illegal values for the given element type.
 561          *
 562          * - Discards attributes not on a whitelist for the given element
 563          * - Unsafe style attributes are discarded
 564          *
 565          * @param array $attribs
 566          * @param string $element
 567          * @return array
 568          *
 569          * @todo Check for legal values where the DTD limits things.
 570          * @todo Check for unique id attribute :P
 571          */
 572         static function validateTagAttributes( $attribs, $element ) {
 573                 $whitelist = array_flip( Sanitizer::attributeWhitelist( $element ) );
 574                 $out = array();
 575                 foreach( $attribs as $attribute => $value ) {
 576                         if( !isset( $whitelist[$attribute] ) ) {
 577                                 continue;
 578                         }
 579                         # Strip javascript "expression" from stylesheets.
 580                         # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
 581                         if( $attribute == 'style' ) {
 582                                 $value = Sanitizer::checkCss( $value );
 583                                 if( $value === false ) {
 584                                         # haxx0r
 585                                         continue;
 586                                 }
 587                         }
 588
 589                         if ( $attribute === 'id' )
 590                                 $value = Sanitizer::escapeId( $value );
 591
 592                         // If this attribute was previously set, override it.
 593                         // Output should only have one attribute of each name.
 594                         $out[$attribute] = $value;
 595                 }
 596                 return $out;
 597         }
 598
 599         /**
 600          * Pick apart some CSS and check it for forbidden or unsafe structures.
 601          * Returns a sanitized string, or false if it was just too evil.
 602          *
 603          * Currently URL references, 'expression', 'tps' are forbidden.
 604          *
 605          * @param string $value
 606          * @return mixed
 607          */
 608         static function checkCss( $value ) {
 609                 $stripped = Sanitizer::decodeCharReferences( $value );
 610
 611                 // Remove any comments; IE gets token splitting wrong
 612                 $stripped = StringUtils::delimiterReplace( '/*', '*/', ' ', $stripped );
 613
 614                 $value = $stripped;
 615
 616                 // ... and continue checks
 617                 $stripped = preg_replace( '!\\\\([0-9A-Fa-f]{1,6})[ \\n\\r\\t\\f]?!e',
 618                         'codepointToUtf8(hexdec("$1"))', $stripped );
 619                 $stripped = str_replace( '\\', '', $stripped );
 620                 if( preg_match( '/(expression|tps*:\/\/|url\\s*\().*/is',
 621                                 $stripped ) ) {
 622                         # haxx0r
 623                         return false;
 624                 }
 625
 626                 return $value;
 627         }
 628
 629         /**
 630          * Take a tag soup fragment listing an HTML element's attributes
 631          * and normalize it to well-formed XML, discarding unwanted attributes.
 632          * Output is safe for further wikitext processing, with escaping of
 633          * values that could trigger problems.
 634          *
 635          * - Normalizes attribute names to lowercase
 636          * - Discards attributes not on a whitelist for the given element
 637          * - Turns broken or invalid entities into plaintext
 638          * - Double-quotes all attribute values
 639          * - Attributes without values are given the name as attribute
 640          * - Double attributes are discarded
 641          * - Unsafe style attributes are discarded
 642          * - Prepends space if there are attributes.
 643          *
 644          * @param string $text
 645          * @param string $element
 646          * @return string
 647          */
 648         static function fixTagAttributes( $text, $element ) {
 649                 if( trim( $text ) == '' ) {
 650                         return '';
 651                 }
 652
 653                 $stripped = Sanitizer::validateTagAttributes(
 654                         Sanitizer::decodeTagAttributes( $text ), $element );
 655
 656                 $attribs = array();
 657                 foreach( $stripped as $attribute => $value ) {
 658                         $encAttribute = htmlspecialchars( $attribute );
 659                         $encValue = Sanitizer::safeEncodeAttribute( $value );
 660
 661                         $attribs[] = "$encAttribute=\"$encValue\"";
 662                 }
 663                 return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : '';
 664         }
 665
 666         /**
 667          * Encode an attribute value for HTML output.
 668          * @param $text
 669          * @return HTML-encoded text fragment
 670          */
 671         static function encodeAttribute( $text ) {
 672                 $encValue = htmlspecialchars( $text );
 673
 674                 // Whitespace is normalized during attribute decoding,
 675                 // so if we've been passed non-spaces we must encode them
 676                 // ahead of time or they won't be preserved.
 677                 $encValue = strtr( $encValue, array(
 678                         "\n" => '&#10;',
 679                         "\r" => '&#13;',
 680                         "\t" => '&#9;',
 681                 ) );
 682
 683                 return $encValue;
 684         }
 685
 686         /**
 687          * Encode an attribute value for HTML tags, with extra armoring
 688          * against further wiki processing.
 689          * @param $text
 690          * @return HTML-encoded text fragment
 691          */
 692         static function safeEncodeAttribute( $text ) {
 693                 $encValue = Sanitizer::encodeAttribute( $text );
 694
 695                 # Templates and links may be expanded in later parsing,
 696                 # creating invalid or dangerous output. Suppress this.
 697                 $encValue = strtr( $encValue, array(
 698                         '<'    => '&lt;',   // This should never happen,
 699                         '>'    => '&gt;',   // we've received invalid input
 700                         '"'    => '&quot;', // which should have been escaped.
 701                         '{'    => '&#123;',
 702                         '['    => '&#91;',
 703                         "''"   => '&#39;&#39;',
 704                         'ISBN' => '&#73;SBN',
 705                         'RFC'  => '&#82;FC',
 706                         'PMID' => '&#80;MID',
 707                         '|'    => '&#124;',
 708                         '__'   => '&#95;_',
 709                 ) );
 710
 711                 # Stupid hack
 712                 $encValue = preg_replace_callback(
 713                         '/(' . wfUrlProtocols() . ')/',
 714                         array( 'Sanitizer', 'armorLinksCallback' ),
 715                         $encValue );
 716                 return $encValue;
 717         }
 718
 719         /**
 720          * Given a value escape it so that it can be used in an id attribute and
 721          * return it, this does not validate the value however (see first link)
 722          *
 723          * @link http://www.w3.org/TR/html401/types.html#type-name Valid characters
 724          *                                                          in the id and
 725          *                                                          name attributes
 726          * @link http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
 727          *
 728          * @bug 4461
 729          *
 730          * @static
 731          *
 732          * @param string $id
 733          * @return string
 734          */
 735         static function escapeId( $id ) {
 736                 static $replace = array(
 737                         '%3A' => ':',
 738                         '%' => '.'
 739                 );
 740
 741                 $id = urlencode( Sanitizer::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
 742
 743                 return str_replace( array_keys( $replace ), array_values( $replace ), $id );
 744         }
 745
 746         /**
 747          * Given a value, escape it so that it can be used as a CSS class and
 748          * return it.
 749          *
 750          * @todo For extra validity, input should be validated UTF-8.
 751          *
 752          * @link http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
 753          *
 754          * @param string $class
 755          * @return string
 756          */
 757         static function escapeClass( $class ) {
 758                 // Convert ugly stuff to underscores and kill underscores in ugly places
 759                 return rtrim(preg_replace(
 760                         array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
 761                         '_',
 762                         $class ), '_');
 763         }
 764
 765         /**
 766          * Regex replace callback for armoring links against further processing.
 767          * @param array $matches
 768          * @return string
 769          * @private
 770          */
 771         private static function armorLinksCallback( $matches ) {
 772                 return str_replace( ':', '&#58;', $matches[1] );
 773         }
 774
 775         /**
 776          * Return an associative array of attribute names and values from
 777          * a partial tag string. Attribute names are forces to lowercase,
 778          * character references are decoded to UTF-8 text.
 779          *
 780          * @param string
 781          * @return array
 782          */
 783         static function decodeTagAttributes( $text ) {
 784                 $attribs = array();
 785
 786                 if( trim( $text ) == '' ) {
 787                         return $attribs;
 788                 }
 789
 790                 $pairs = array();
 791                 if( !preg_match_all(
 792                         MW_ATTRIBS_REGEX,
 793                         $text,
 794                         $pairs,
 795                         PREG_SET_ORDER ) ) {
 796                         return $attribs;
 797                 }
 798
 799                 foreach( $pairs as $set ) {
 800                         $attribute = strtolower( $set[1] );
 801                         $value = Sanitizer::getTagAttributeCallback( $set );
 802
 803                         // Normalize whitespace
 804                         $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
 805                         $value = trim( $value );
 806
 807                         // Decode character references
 808                         $attribs[$attribute] = Sanitizer::decodeCharReferences( $value );
 809                 }
 810                 return $attribs;
 811         }
 812
 813         /**
 814          * Pick the appropriate attribute value from a match set from the
 815          * MW_ATTRIBS_REGEX matches.
 816          *
 817          * @param array $set
 818          * @return string
 819          * @private
 820          */
 821         private static function getTagAttributeCallback( $set ) {
 822                 if( isset( $set[6] ) ) {
 823                         # Illegal #XXXXXX color with no quotes.
 824                         return $set[6];
 825                 } elseif( isset( $set[5] ) ) {
 826                         # No quotes.
 827                         return $set[5];
 828                 } elseif( isset( $set[4] ) ) {
 829                         # Single-quoted
 830                         return $set[4];
 831                 } elseif( isset( $set[3] ) ) {
 832                         # Double-quoted
 833                         return $set[3];
 834                 } elseif( !isset( $set[2] ) ) {
 835                         # In XHTML, attributes must have a value.
 836                         # For 'reduced' form, return explicitly the attribute name here.
 837                         return $set[1];
 838                 } else {
 839                         throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
 840                 }
 841         }
 842
 843         /**
 844          * Normalize whitespace and character references in an XML source-
 845          * encoded text for an attribute value.
 846          *
 847          * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
 848          * but note that we're not returning the value, but are returning
 849          * XML source fragments that will be slapped into output.
 850          *
 851          * @param string $text
 852          * @return string
 853          * @private
 854          */
 855         private static function normalizeAttributeValue( $text ) {
 856                 return str_replace( '"', '&quot;',
 857                         preg_replace(
 858                                 '/\r\n|[\x20\x0d\x0a\x09]/',
 859                                 ' ',
 860                                 Sanitizer::normalizeCharReferences( $text ) ) );
 861         }
 862
 863         /**
 864          * Ensure that any entities and character references are legal
 865          * for XML and XHTML specifically. Any stray bits will be
 866          * &amp;-escaped to result in a valid text fragment.
 867          *
 868          * a. any named char refs must be known in XHTML
 869          * b. any numeric char refs must be legal chars, not invalid or forbidden
 870          * c. use &#x, not &#X
 871          * d. fix or reject non-valid attributes
 872          *
 873          * @param string $text
 874          * @return string
 875          * @private
 876          */
 877         static function normalizeCharReferences( $text ) {
 878                 return preg_replace_callback(
 879                         MW_CHAR_REFS_REGEX,
 880                         array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
 881                         $text );
 882         }
 883         /**
 884          * @param string $matches
 885          * @return string
 886          */
 887         static function normalizeCharReferencesCallback( $matches ) {
 888                 $ret = null;
 889                 if( $matches[1] != '' ) {
 890                         $ret = Sanitizer::normalizeEntity( $matches[1] );
 891                 } elseif( $matches[2] != '' ) {
 892                         $ret = Sanitizer::decCharReference( $matches[2] );
 893                 } elseif( $matches[3] != ''  ) {
 894                         $ret = Sanitizer::hexCharReference( $matches[3] );
 895                 } elseif( $matches[4] != '' ) {
 896                         $ret = Sanitizer::hexCharReference( $matches[4] );
 897                 }
 898                 if( is_null( $ret ) ) {
 899                         return htmlspecialchars( $matches[0] );
 900                 } else {
 901                         return $ret;
 902                 }
 903         }
 904
 905         /**
 906          * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
 907          * return the named entity reference as is. Otherwise, returns
 908          * HTML-escaped text of pseudo-entity source (eg &amp;foo;)
 909          *
 910          * @param string $name
 911          * @return string
 912          * @static
 913          */
 914         static function normalizeEntity( $name ) {
 915                 global $wgHtmlEntities;
 916                 if( isset( $wgHtmlEntities[$name] ) ) {
 917                         return "&$name;";
 918                 } else {
 919                         return "&amp;$name;";
 920                 }
 921         }
 922
 923         static function decCharReference( $codepoint ) {
 924                 $point = intval( $codepoint );
 925                 if( Sanitizer::validateCodepoint( $point ) ) {
 926                         return sprintf( '&#%d;', $point );
 927                 } else {
 928                         return null;
 929                 }
 930         }
 931
 932         static function hexCharReference( $codepoint ) {
 933                 $point = hexdec( $codepoint );
 934                 if( Sanitizer::validateCodepoint( $point ) ) {
 935                         return sprintf( '&#x%x;', $point );
 936                 } else {
 937                         return null;
 938                 }
 939         }
 940
 941         /**
 942          * Returns true if a given Unicode codepoint is a valid character in XML.
 943          * @param int $codepoint
 944          * @return bool
 945          */
 946         private static function validateCodepoint( $codepoint ) {
 947                 return ($codepoint ==    0x09)
 948                         || ($codepoint ==    0x0a)
 949                         || ($codepoint ==    0x0d)
 950                         || ($codepoint >=    0x20 && $codepoint <=   0xd7ff)
 951                         || ($codepoint >=  0xe000 && $codepoint <=   0xfffd)
 952                         || ($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
 953         }
 954
 955         /**
 956          * Decode any character references, numeric or named entities,
 957          * in the text and return a UTF-8 string.
 958          *
 959          * @param string $text
 960          * @return string
 961          * @public
 962          * @static
 963          */
 964         public static function decodeCharReferences( $text ) {
 965                 return preg_replace_callback(
 966                         MW_CHAR_REFS_REGEX,
 967                         array( 'Sanitizer', 'decodeCharReferencesCallback' ),
 968                         $text );
 969         }
 970
 971         /**
 972          * @param string $matches
 973          * @return string
 974          */
 975         static function decodeCharReferencesCallback( $matches ) {
 976                 if( $matches[1] != '' ) {
 977                         return Sanitizer::decodeEntity( $matches[1] );
 978                 } elseif( $matches[2] != '' ) {
 979                         return  Sanitizer::decodeChar( intval( $matches[2] ) );
 980                 } elseif( $matches[3] != ''  ) {
 981                         return  Sanitizer::decodeChar( hexdec( $matches[3] ) );
 982                 } elseif( $matches[4] != '' ) {
 983                         return  Sanitizer::decodeChar( hexdec( $matches[4] ) );
 984                 }
 985                 # Last case should be an ampersand by itself
 986                 return $matches[0];
 987         }
 988
 989         /**
 990          * Return UTF-8 string for a codepoint if that is a valid
 991          * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
 992          * @param int $codepoint
 993          * @return string
 994          * @private
 995          */
 996         static function decodeChar( $codepoint ) {
 997                 if( Sanitizer::validateCodepoint( $codepoint ) ) {
 998                         return codepointToUtf8( $codepoint );
 999                 } else {
1000                         return UTF8_REPLACEMENT;
1001                 }
1002         }
1003
1004         /**
1005          * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1006          * return the UTF-8 encoding of that character. Otherwise, returns
1007          * pseudo-entity source (eg &foo;)
1008          *
1009          * @param string $name
1010          * @return string
1011          */
1012         static function decodeEntity( $name ) {
1013                 global $wgHtmlEntities;
1014                 if( isset( $wgHtmlEntities[$name] ) ) {
1015                         return codepointToUtf8( $wgHtmlEntities[$name] );
1016                 } else {
1017                         return "&$name;";
1018                 }
1019         }
1020
1021         /**
1022          * Fetch the whitelist of acceptable attributes for a given
1023          * element name.
1024          *
1025          * @param string $element
1026          * @return array
1027          */
1028         static function attributeWhitelist( $element ) {
1029                 static $list;
1030                 if( !isset( $list ) ) {
1031                         $list = Sanitizer::setupAttributeWhitelist();
1032                 }
1033                 return isset( $list[$element] )
1034                         ? $list[$element]
1035                         : array();
1036         }
1037
1038         /**
1039          * @todo Document it a bit
1040          * @return array
1041          */
1042         static function setupAttributeWhitelist() {
1043                 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );
1044                 $block = array_merge( $common, array( 'align' ) );
1045                 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1046                 $tablecell = array( 'abbr',
1047                                     'axis',
1048                                     'headers',
1049                                     'scope',
1050                                     'rowspan',
1051                                     'colspan',
1052                                     'nowrap', # deprecated
1053                                     'width',  # deprecated
1054                                     'height', # deprecated
1055                                     'bgcolor' # deprecated
1056                                     );
1057
1058                 # Numbers refer to sections in HTML 4.01 standard describing the element.
1059                 # See: http://www.w3.org/TR/html4/
1060                 $whitelist = array (
1061                         # 7.5.4
1062                         'div'        => $block,
1063                         'center'     => $common, # deprecated
1064                         'span'       => $block, # ??
1065
1066                         # 7.5.5
1067                         'h1'         => $block,
1068                         'h2'         => $block,
1069                         'h3'         => $block,
1070                         'h4'         => $block,
1071                         'h5'         => $block,
1072                         'h6'         => $block,
1073
1074                         # 7.5.6
1075                         # address
1076
1077                         # 8.2.4
1078                         # bdo
1079
1080                         # 9.2.1
1081                         'em'         => $common,
1082                         'strong'     => $common,
1083                         'cite'       => $common,
1084                         # dfn
1085                         'code'       => $common,
1086                         # samp
1087                         # kbd
1088                         'var'        => $common,
1089                         # abbr
1090                         # acronym
1091
1092                         # 9.2.2
1093                         'blockquote' => array_merge( $common, array( 'cite' ) ),
1094                         # q
1095
1096                         # 9.2.3
1097                         'sub'        => $common,
1098                         'sup'        => $common,
1099
1100                         # 9.3.1
1101                         'p'          => $block,
1102
1103                         # 9.3.2
1104                         'br'         => array( 'id', 'class', 'title', 'style', 'clear' ),
1105
1106                         # 9.3.4
1107                         'pre'        => array_merge( $common, array( 'width' ) ),
1108
1109                         # 9.4
1110                         'ins'        => array_merge( $common, array( 'cite', 'datetime' ) ),
1111                         'del'        => array_merge( $common, array( 'cite', 'datetime' ) ),
1112
1113                         # 10.2
1114                         'ul'         => array_merge( $common, array( 'type' ) ),
1115                         'ol'         => array_merge( $common, array( 'type', 'start' ) ),
1116                         'li'         => array_merge( $common, array( 'type', 'value' ) ),
1117
1118                         # 10.3
1119                         'dl'         => $common,
1120                         'dd'         => $common,
1121                         'dt'         => $common,
1122
1123                         # 11.2.1
1124                         'table'      => array_merge( $common,
1125                                                                 array( 'summary', 'width', 'border', 'frame',
1126                                                                                 'rules', 'cellspacing', 'cellpadding',
1127                                                                                 'align', 'bgcolor',
1128                                                                 ) ),
1129
1130                         # 11.2.2
1131                         'caption'    => array_merge( $common, array( 'align' ) ),
1132
1133                         # 11.2.3
1134                         'thead'      => array_merge( $common, $tablealign ),
1135                         'tfoot'      => array_merge( $common, $tablealign ),
1136                         'tbody'      => array_merge( $common, $tablealign ),
1137
1138                         # 11.2.4
1139                         'colgroup'   => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1140                         'col'        => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1141
1142                         # 11.2.5
1143                         'tr'         => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1144
1145                         # 11.2.6
1146                         'td'         => array_merge( $common, $tablecell, $tablealign ),
1147                         'th'         => array_merge( $common, $tablecell, $tablealign ),
1148
1149                         # 15.2.1
1150                         'tt'         => $common,
1151                         'b'          => $common,
1152                         'i'          => $common,
1153                         'big'        => $common,
1154                         'small'      => $common,
1155                         'strike'     => $common,
1156                         's'          => $common,
1157                         'u'          => $common,
1158
1159                         # 15.2.2
1160                         'font'       => array_merge( $common, array( 'size', 'color', 'face' ) ),
1161                         # basefont
1162
1163                         # 15.3
1164                         'hr'         => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1165
1166                         # XHTML Ruby annotation text module, simple ruby only.
1167                         # http://www.w3c.org/TR/ruby/
1168                         'ruby'       => $common,
1169                         # rbc
1170                         # rtc
1171                         'rb'         => $common,
1172                         'rt'         => $common, #array_merge( $common, array( 'rbspan' ) ),
1173                         'rp'         => $common,
1174                         );
1175                 return $whitelist;
1176         }
1177
1178         /**
1179          * Take a fragment of (potentially invalid) HTML and return
1180          * a version with any tags removed, encoded suitably for literal
1181          * inclusion in an attribute value.
1182          *
1183          * @param string $text HTML fragment
1184          * @return string
1185          */
1186         static function stripAllTags( $text ) {
1187                 # Actual <tags>
1188                 $text = StringUtils::delimiterReplace( '<', '>', '', $text );
1189
1190                 # Normalize &entities and whitespace
1191                 $text = Sanitizer::normalizeAttributeValue( $text );
1192
1193                 # Will be placed into "double-quoted" attributes,
1194                 # make sure remaining bits are safe.
1195                 $text = str_replace(
1196                         array('<', '>', '"'),
1197                         array('&lt;', '&gt;', '&quot;'),
1198                         $text );
1199
1200                 return $text;
1201         }
1202
1203         /**
1204          * Hack up a private DOCTYPE with HTML's standard entity declarations.
1205          * PHP 4 seemed to know these if you gave it an HTML doctype, but
1206          * PHP 5.1 doesn't.
1207          *
1208          * Use for passing XHTML fragments to PHP's XML parsing functions
1209          *
1210          * @return string
1211          * @static
1212          */
1213         static function hackDocType() {
1214                 global $wgHtmlEntities;
1215                 $out = "<!DOCTYPE html [\n";
1216                 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1217                         $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1218                 }
1219                 $out .= "]>\n";
1220                 return $out;
1221         }
1222
1223         static function cleanUrl( $url, $hostname=true ) {
1224                 # Normalize any HTML entities in input. They will be
1225                 # re-escaped by makeExternalLink().
1226                 $url = Sanitizer::decodeCharReferences( $url );
1227
1228                 # Escape any control characters introduced by the above step
1229                 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F]/e', "urlencode('\\0')", $url );
1230
1231                 # Validate hostname portion
1232                 $matches = array();
1233                 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1234                         list( /* $whole */, $protocol, $host, $rest ) = $matches;
1235
1236                         // Characters that will be ignored in IDNs.
1237                         // http://tools.ietf.org/html/3454#section-3.1
1238                         // Strip them before further processing so blacklists and such work.
1239                         $strip = "/
1240                                 \\s|          # general whitespace
1241                                 \xc2\xad|     # 00ad SOFT HYPHEN
1242                                 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1243                                 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1244                                 \xe2\x81\xa0| # 2060 WORD JOINER
1245                                 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1246                                 \xcd\x8f|     # 034f COMBINING GRAPHEME JOINER
1247                                 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1248                                 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1249                                 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1250                                 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1251                                 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1252                                 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1253                                 /xuD";
1254
1255                         $host = preg_replace( $strip, '', $host );
1256
1257                         // @fixme: validate hostnames here
1258
1259                         return $protocol . $host . $rest;
1260                 } else {
1261                         return $url;
1262                 }
1263         }
1264
1265 }
1266
1267 ?>