includes/Sanitizer.php

   1 <?php
   2 /**
   3  * XHTML sanitizer for MediaWiki
   4  *
   5  * Copyright (C) 2002-2005 Brion Vibber <brion@pobox.com> et al
   6  * http://www.mediawiki.org/
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along
  19  * with this program; if not, write to the Free Software Foundation, Inc.,
  20  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  21  * http://www.gnu.org/copyleft/gpl.html
  22  *
  23  * @file
  24  * @ingroup Parser
  25  */
  26
  27 /**
  28  * Regular expression to match various types of character references in
  29  * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
  30  */
  31 define( 'MW_CHAR_REFS_REGEX',
  32         '/&([A-Za-z0-9\x80-\xff]+);
  33          |&\#([0-9]+);
  34          |&\#x([0-9A-Za-z]+);
  35          |&\#X([0-9A-Za-z]+);
  36          |(&)/x' );
  37
  38 /**
  39  * Regular expression to match HTML/XML attribute pairs within a tag.
  40  * Allows some... latitude.
  41  * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
  42  */
  43 $attrib = '[A-Za-z0-9]';
  44 $space = '[\x09\x0a\x0d\x20]';
  45 define( 'MW_ATTRIBS_REGEX',
  46         "/(?:^|$space)((?:xml:|xmlns:)?$attrib+)
  47           ($space*=$space*
  48                 (?:
  49                  # The attribute value: quoted or alone
  50                   \"([^<\"]*)\"
  51                  | '([^<']*)'
  52                  |  ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
  53                  |  (\#[0-9a-fA-F]+) # Technically wrong, but lots of
  54                                                          # colors are specified like this.
  55                                                          # We'll be normalizing it.
  56                 )
  57            )?(?=$space|\$)/sx" );
  58
  59 /**
  60  * Regular expression to match URIs that could trigger script execution
  61  */
  62 define( 'MW_EVIL_URI_PATTERN', '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i' );
  63
  64 /**
  65  * Regular expression to match namespace attributes
  66  */
  67 define( 'MW_XMLNS_ATTRIBUTE_PATTRN', "/^xmlns:$attrib+$/" );
  68
  69 /**
  70  * List of all named character entities defined in HTML 4.01
  71  * http://www.w3.org/TR/html4/sgml/entities.html
  72  * @private
  73  */
  74 global $wgHtmlEntities;
  75 $wgHtmlEntities = array(
  76         'Aacute'   => 193,
  77         'aacute'   => 225,
  78         'Acirc'    => 194,
  79         'acirc'    => 226,
  80         'acute'    => 180,
  81         'AElig'    => 198,
  82         'aelig'    => 230,
  83         'Agrave'   => 192,
  84         'agrave'   => 224,
  85         'alefsym'  => 8501,
  86         'Alpha'    => 913,
  87         'alpha'    => 945,
  88         'amp'      => 38,
  89         'and'      => 8743,
  90         'ang'      => 8736,
  91         'Aring'    => 197,
  92         'aring'    => 229,
  93         'asymp'    => 8776,
  94         'Atilde'   => 195,
  95         'atilde'   => 227,
  96         'Auml'     => 196,
  97         'auml'     => 228,
  98         'bdquo'    => 8222,
  99         'Beta'     => 914,
 100         'beta'     => 946,
 101         'brvbar'   => 166,
 102         'bull'     => 8226,
 103         'cap'      => 8745,
 104         'Ccedil'   => 199,
 105         'ccedil'   => 231,
 106         'cedil'    => 184,
 107         'cent'     => 162,
 108         'Chi'      => 935,
 109         'chi'      => 967,
 110         'circ'     => 710,
 111         'clubs'    => 9827,
 112         'cong'     => 8773,
 113         'copy'     => 169,
 114         'crarr'    => 8629,
 115         'cup'      => 8746,
 116         'curren'   => 164,
 117         'dagger'   => 8224,
 118         'Dagger'   => 8225,
 119         'darr'     => 8595,
 120         'dArr'     => 8659,
 121         'deg'      => 176,
 122         'Delta'    => 916,
 123         'delta'    => 948,
 124         'diams'    => 9830,
 125         'divide'   => 247,
 126         'Eacute'   => 201,
 127         'eacute'   => 233,
 128         'Ecirc'    => 202,
 129         'ecirc'    => 234,
 130         'Egrave'   => 200,
 131         'egrave'   => 232,
 132         'empty'    => 8709,
 133         'emsp'     => 8195,
 134         'ensp'     => 8194,
 135         'Epsilon'  => 917,
 136         'epsilon'  => 949,
 137         'equiv'    => 8801,
 138         'Eta'      => 919,
 139         'eta'      => 951,
 140         'ETH'      => 208,
 141         'eth'      => 240,
 142         'Euml'     => 203,
 143         'euml'     => 235,
 144         'euro'     => 8364,
 145         'exist'    => 8707,
 146         'fnof'     => 402,
 147         'forall'   => 8704,
 148         'frac12'   => 189,
 149         'frac14'   => 188,
 150         'frac34'   => 190,
 151         'frasl'    => 8260,
 152         'Gamma'    => 915,
 153         'gamma'    => 947,
 154         'ge'       => 8805,
 155         'gt'       => 62,
 156         'harr'     => 8596,
 157         'hArr'     => 8660,
 158         'hearts'   => 9829,
 159         'hellip'   => 8230,
 160         'Iacute'   => 205,
 161         'iacute'   => 237,
 162         'Icirc'    => 206,
 163         'icirc'    => 238,
 164         'iexcl'    => 161,
 165         'Igrave'   => 204,
 166         'igrave'   => 236,
 167         'image'    => 8465,
 168         'infin'    => 8734,
 169         'int'      => 8747,
 170         'Iota'     => 921,
 171         'iota'     => 953,
 172         'iquest'   => 191,
 173         'isin'     => 8712,
 174         'Iuml'     => 207,
 175         'iuml'     => 239,
 176         'Kappa'    => 922,
 177         'kappa'    => 954,
 178         'Lambda'   => 923,
 179         'lambda'   => 955,
 180         'lang'     => 9001,
 181         'laquo'    => 171,
 182         'larr'     => 8592,
 183         'lArr'     => 8656,
 184         'lceil'    => 8968,
 185         'ldquo'    => 8220,
 186         'le'       => 8804,
 187         'lfloor'   => 8970,
 188         'lowast'   => 8727,
 189         'loz'      => 9674,
 190         'lrm'      => 8206,
 191         'lsaquo'   => 8249,
 192         'lsquo'    => 8216,
 193         'lt'       => 60,
 194         'macr'     => 175,
 195         'mdash'    => 8212,
 196         'micro'    => 181,
 197         'middot'   => 183,
 198         'minus'    => 8722,
 199         'Mu'       => 924,
 200         'mu'       => 956,
 201         'nabla'    => 8711,
 202         'nbsp'     => 160,
 203         'ndash'    => 8211,
 204         'ne'       => 8800,
 205         'ni'       => 8715,
 206         'not'      => 172,
 207         'notin'    => 8713,
 208         'nsub'     => 8836,
 209         'Ntilde'   => 209,
 210         'ntilde'   => 241,
 211         'Nu'       => 925,
 212         'nu'       => 957,
 213         'Oacute'   => 211,
 214         'oacute'   => 243,
 215         'Ocirc'    => 212,
 216         'ocirc'    => 244,
 217         'OElig'    => 338,
 218         'oelig'    => 339,
 219         'Ograve'   => 210,
 220         'ograve'   => 242,
 221         'oline'    => 8254,
 222         'Omega'    => 937,
 223         'omega'    => 969,
 224         'Omicron'  => 927,
 225         'omicron'  => 959,
 226         'oplus'    => 8853,
 227         'or'       => 8744,
 228         'ordf'     => 170,
 229         'ordm'     => 186,
 230         'Oslash'   => 216,
 231         'oslash'   => 248,
 232         'Otilde'   => 213,
 233         'otilde'   => 245,
 234         'otimes'   => 8855,
 235         'Ouml'     => 214,
 236         'ouml'     => 246,
 237         'para'     => 182,
 238         'part'     => 8706,
 239         'permil'   => 8240,
 240         'perp'     => 8869,
 241         'Phi'      => 934,
 242         'phi'      => 966,
 243         'Pi'       => 928,
 244         'pi'       => 960,
 245         'piv'      => 982,
 246         'plusmn'   => 177,
 247         'pound'    => 163,
 248         'prime'    => 8242,
 249         'Prime'    => 8243,
 250         'prod'     => 8719,
 251         'prop'     => 8733,
 252         'Psi'      => 936,
 253         'psi'      => 968,
 254         'quot'     => 34,
 255         'radic'    => 8730,
 256         'rang'     => 9002,
 257         'raquo'    => 187,
 258         'rarr'     => 8594,
 259         'rArr'     => 8658,
 260         'rceil'    => 8969,
 261         'rdquo'    => 8221,
 262         'real'     => 8476,
 263         'reg'      => 174,
 264         'rfloor'   => 8971,
 265         'Rho'      => 929,
 266         'rho'      => 961,
 267         'rlm'      => 8207,
 268         'rsaquo'   => 8250,
 269         'rsquo'    => 8217,
 270         'sbquo'    => 8218,
 271         'Scaron'   => 352,
 272         'scaron'   => 353,
 273         'sdot'     => 8901,
 274         'sect'     => 167,
 275         'shy'      => 173,
 276         'Sigma'    => 931,
 277         'sigma'    => 963,
 278         'sigmaf'   => 962,
 279         'sim'      => 8764,
 280         'spades'   => 9824,
 281         'sub'      => 8834,
 282         'sube'     => 8838,
 283         'sum'      => 8721,
 284         'sup'      => 8835,
 285         'sup1'     => 185,
 286         'sup2'     => 178,
 287         'sup3'     => 179,
 288         'supe'     => 8839,
 289         'szlig'    => 223,
 290         'Tau'      => 932,
 291         'tau'      => 964,
 292         'there4'   => 8756,
 293         'Theta'    => 920,
 294         'theta'    => 952,
 295         'thetasym' => 977,
 296         'thinsp'   => 8201,
 297         'THORN'    => 222,
 298         'thorn'    => 254,
 299         'tilde'    => 732,
 300         'times'    => 215,
 301         'trade'    => 8482,
 302         'Uacute'   => 218,
 303         'uacute'   => 250,
 304         'uarr'     => 8593,
 305         'uArr'     => 8657,
 306         'Ucirc'    => 219,
 307         'ucirc'    => 251,
 308         'Ugrave'   => 217,
 309         'ugrave'   => 249,
 310         'uml'      => 168,
 311         'upsih'    => 978,
 312         'Upsilon'  => 933,
 313         'upsilon'  => 965,
 314         'Uuml'     => 220,
 315         'uuml'     => 252,
 316         'weierp'   => 8472,
 317         'Xi'       => 926,
 318         'xi'       => 958,
 319         'Yacute'   => 221,
 320         'yacute'   => 253,
 321         'yen'      => 165,
 322         'Yuml'     => 376,
 323         'yuml'     => 255,
 324         'Zeta'     => 918,
 325         'zeta'     => 950,
 326         'zwj'      => 8205,
 327         'zwnj'     => 8204 );
 328
 329 /**
 330  * Character entity aliases accepted by MediaWiki
 331  */
 332 global $wgHtmlEntityAliases;
 333 $wgHtmlEntityAliases = array(
 334         'רלמ' => 'rlm',
 335         'رلم' => 'rlm',
 336 );
 337
 338
 339 /**
 340  * XHTML sanitizer for MediaWiki
 341  * @ingroup Parser
 342  */
 343 class Sanitizer {
 344         /**
 345          * Cleans up HTML, removes dangerous tags and attributes, and
 346          * removes HTML comments
 347          * @private
 348          * @param $text String
 349          * @param $processCallback Callback to do any variable or parameter replacements in HTML attribute values
 350          * @param $args Array for the processing callback
 351          * @param $extratags Array for any extra tags to include
 352          * @param $removetags Array for any tags (default or extra) to exclude
 353          * @return string
 354          */
 355         static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array(), $removetags = array() ) {
 356                 global $wgUseTidy;
 357
 358                 static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
 359                         $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
 360
 361                 wfProfileIn( __METHOD__ );
 362
 363                 if ( !$staticInitialised ) {
 364
 365                         $htmlpairsStatic = array( # Tags that must be closed
 366                                 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
 367                                 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
 368                                 'strike', 'strong', 'tt', 'var', 'div', 'center',
 369                                 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
 370                                 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u', 'abbr'
 371                         );
 372                         $htmlsingle = array(
 373                                 'br', 'hr', 'li', 'dt', 'dd'
 374                         );
 375                         $htmlsingleonly = array( # Elements that cannot have close tags
 376                                 'br', 'hr'
 377                         );
 378                         $htmlnest = array( # Tags that can be nested--??
 379                                 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
 380                                 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
 381                         );
 382                         $tabletags = array( # Can only appear inside table, we will close them
 383                                 'td', 'th', 'tr',
 384                         );
 385                         $htmllist = array( # Tags used by list
 386                                 'ul','ol',
 387                         );
 388                         $listtags = array( # Tags that can appear in a list
 389                                 'li',
 390                         );
 391
 392                         global $wgAllowImageTag;
 393                         if ( $wgAllowImageTag ) {
 394                                 $htmlsingle[] = 'img';
 395                                 $htmlsingleonly[] = 'img';
 396                         }
 397
 398                         $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
 399                         $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
 400
 401                         # Convert them all to hashtables for faster lookup
 402                         $vars = array( 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
 403                                 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' );
 404                         foreach ( $vars as $var ) {
 405                                 $$var = array_flip( $$var );
 406                         }
 407                         $staticInitialised = true;
 408                 }
 409                 # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
 410                 $extratags = array_flip( $extratags );
 411                 $removetags = array_flip( $removetags );
 412                 $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
 413                 $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ) , $removetags );
 414
 415                 # Remove HTML comments
 416                 $text = Sanitizer::removeHTMLcomments( $text );
 417                 $bits = explode( '<', $text );
 418                 $text = str_replace( '>', '&gt;', array_shift( $bits ) );
 419                 if ( !$wgUseTidy ) {
 420                         $tagstack = $tablestack = array();
 421                         foreach ( $bits as $x ) {
 422                                 $regs = array();
 423                                 # $slash: Does the current element start with a '/'?
 424                                 # $t: Current element name
 425                                 # $params: String between element name and >
 426                                 # $brace: Ending '>' or '/>'
 427                                 # $rest: Everything until the next element of $bits
 428                                 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
 429                                         list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
 430                                 } else {
 431                                         $slash = $t = $params = $brace = $rest = null;
 432                                 }
 433
 434                                 $badtag = false;
 435                                 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
 436                                         # Check our stack
 437                                         if ( $slash && isset( $htmlsingleonly[$t] ) ) {
 438                                                 $badtag = true;
 439                                         } elseif ( $slash ) {
 440                                                 # Closing a tag... is it the one we just opened?
 441                                                 $ot = @array_pop( $tagstack );
 442                                                 if ( $ot != $t ) {
 443                                                         if ( isset( $htmlsingleallowed[$ot] ) ) {
 444                                                                 # Pop all elements with an optional close tag
 445                                                                 # and see if we find a match below them
 446                                                                 $optstack = array();
 447                                                                 array_push( $optstack, $ot );
 448                                                                 $ot = @array_pop( $tagstack );
 449                                                                 while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
 450                                                                         array_push( $optstack, $ot );
 451                                                                         $ot = @array_pop( $tagstack );
 452                                                                 }
 453                                                                 if ( $t != $ot ) {
 454                                                                         # No match. Push the optional elements back again
 455                                                                         $badtag = true;
 456                                                                         while ( $ot = @array_pop( $optstack ) ) {
 457                                                                                 array_push( $tagstack, $ot );
 458                                                                         }
 459                                                                 }
 460                                                         } else {
 461                                                                 @array_push( $tagstack, $ot );
 462                                                                 # <li> can be nested in <ul> or <ol>, skip those cases:
 463                                                                 if ( !isset( $htmllist[$ot] ) || !isset( $listtags[$t] ) ) {
 464                                                                         $badtag = true;
 465                                                                 }
 466                                                         }
 467                                                 } else {
 468                                                         if ( $t == 'table' ) {
 469                                                                 $tagstack = array_pop( $tablestack );
 470                                                         }
 471                                                 }
 472                                                 $newparams = '';
 473                                         } else {
 474                                                 # Keep track for later
 475                                                 if ( isset( $tabletags[$t] ) &&
 476                                                 !in_array( 'table', $tagstack ) ) {
 477                                                         $badtag = true;
 478                                                 } elseif ( in_array( $t, $tagstack ) &&
 479                                                 !isset( $htmlnest [$t ] ) ) {
 480                                                         $badtag = true;
 481                                                 # Is it a self closed htmlpair ? (bug 5487)
 482                                                 } elseif ( $brace == '/>' &&
 483                                                 isset( $htmlpairs[$t] ) ) {
 484                                                         $badtag = true;
 485                                                 } elseif ( isset( $htmlsingleonly[$t] ) ) {
 486                                                         # Hack to force empty tag for uncloseable elements
 487                                                         $brace = '/>';
 488                                                 } elseif ( isset( $htmlsingle[$t] ) ) {
 489                                                         # Hack to not close $htmlsingle tags
 490                                                         $brace = null;
 491                                                 } elseif ( isset( $tabletags[$t] )
 492                                                 && in_array( $t, $tagstack ) ) {
 493                                                         // New table tag but forgot to close the previous one
 494                                                         $text .= "</$t>";
 495                                                 } else {
 496                                                         if ( $t == 'table' ) {
 497                                                                 array_push( $tablestack, $tagstack );
 498                                                                 $tagstack = array();
 499                                                         }
 500                                                         array_push( $tagstack, $t );
 501                                                 }
 502
 503                                                 # Replace any variables or template parameters with
 504                                                 # plaintext results.
 505                                                 if( is_callable( $processCallback ) ) {
 506                                                         call_user_func_array( $processCallback, array( &$params, $args ) );
 507                                                 }
 508
 509                                                 # Strip non-approved attributes from the tag
 510                                                 $newparams = Sanitizer::fixTagAttributes( $params, $t );
 511                                         }
 512                                         if ( !$badtag ) {
 513                                                 $rest = str_replace( '>', '&gt;', $rest );
 514                                                 $close = ( $brace == '/>' && !$slash ) ? ' /' : '';
 515                                                 $text .= "<$slash$t$newparams$close>$rest";
 516                                                 continue;
 517                                         }
 518                                 }
 519                                 $text .= '&lt;' . str_replace( '>', '&gt;', $x);
 520                         }
 521                         # Close off any remaining tags
 522                         while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
 523                                 $text .= "</$t>\n";
 524                                 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
 525                         }
 526                 } else {
 527                         # this might be possible using tidy itself
 528                         foreach ( $bits as $x ) {
 529                                 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
 530                                 $x, $regs );
 531                                 @list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
 532                                 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
 533                                         if( is_callable( $processCallback ) ) {
 534                                                 call_user_func_array( $processCallback, array( &$params, $args ) );
 535                                         }
 536                                         $newparams = Sanitizer::fixTagAttributes( $params, $t );
 537                                         $rest = str_replace( '>', '&gt;', $rest );
 538                                         $text .= "<$slash$t$newparams$brace$rest";
 539                                 } else {
 540                                         $text .= '&lt;' . str_replace( '>', '&gt;', $x);
 541                                 }
 542                         }
 543                 }
 544                 wfProfileOut( __METHOD__ );
 545                 return $text;
 546         }
 547
 548         /**
 549          * Remove '<!--', '-->', and everything between.
 550          * To avoid leaving blank lines, when a comment is both preceded
 551          * and followed by a newline (ignoring spaces), trim leading and
 552          * trailing spaces and one of the newlines.
 553          *
 554          * @private
 555          * @param $text String
 556          * @return string
 557          */
 558         static function removeHTMLcomments( $text ) {
 559                 wfProfileIn( __METHOD__ );
 560                 while (($start = strpos($text, '<!--')) !== false) {
 561                         $end = strpos($text, '-->', $start + 4);
 562                         if ($end === false) {
 563                                 # Unterminated comment; bail out
 564                                 break;
 565                         }
 566
 567                         $end += 3;
 568
 569                         # Trim space and newline if the comment is both
 570                         # preceded and followed by a newline
 571                         $spaceStart = max($start - 1, 0);
 572                         $spaceLen = $end - $spaceStart;
 573                         while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
 574                                 $spaceStart--;
 575                                 $spaceLen++;
 576                         }
 577                         while (substr($text, $spaceStart + $spaceLen, 1) === ' ')
 578                                 $spaceLen++;
 579                         if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart + $spaceLen, 1) === "\n") {
 580                                 # Remove the comment, leading and trailing
 581                                 # spaces, and leave only one newline.
 582                                 $text = substr_replace($text, "\n", $spaceStart, $spaceLen + 1);
 583                         }
 584                         else {
 585                                 # Remove just the comment.
 586                                 $text = substr_replace($text, '', $start, $end - $start);
 587                         }
 588                 }
 589                 wfProfileOut( __METHOD__ );
 590                 return $text;
 591         }
 592
 593         /**
 594          * Take an array of attribute names and values and normalize or discard
 595          * illegal values for the given element type.
 596          *
 597          * - Discards attributes not on a whitelist for the given element
 598          * - Unsafe style attributes are discarded
 599          * - Invalid id attributes are reencoded
 600          *
 601          * @param $attribs Array
 602          * @param $element String
 603          * @return Array
 604          *
 605          * @todo Check for legal values where the DTD limits things.
 606          * @todo Check for unique id attribute :P
 607          */
 608         static function validateTagAttributes( $attribs, $element ) {
 609                 return Sanitizer::validateAttributes( $attribs,
 610                         Sanitizer::attributeWhitelist( $element ) );
 611         }
 612
 613         /**
 614          * Take an array of attribute names and values and normalize or discard
 615          * illegal values for the given whitelist.
 616          *
 617          * - Discards attributes not the given whitelist
 618          * - Unsafe style attributes are discarded
 619          * - Invalid id attributes are reencoded
 620          *
 621          * @param $attribs Array
 622          * @param $whitelist Array: list of allowed attribute names
 623          * @return Array
 624          *
 625          * @todo Check for legal values where the DTD limits things.
 626          * @todo Check for unique id attribute :P
 627          */
 628         static function validateAttributes( $attribs, $whitelist ) {
 629                 global $wgAllowRdfaAttributes, $wgAllowMicrodataAttributes;
 630
 631                 $whitelist = array_flip( $whitelist );
 632                 $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
 633
 634                 $out = array();
 635                 foreach( $attribs as $attribute => $value ) {
 636                         #allow XML namespace declaration if RDFa is enabled
 637                         if ( $wgAllowRdfaAttributes && preg_match( MW_XMLNS_ATTRIBUTE_PATTRN, $attribute ) ) {
 638                                 if ( !preg_match( MW_EVIL_URI_PATTERN, $value ) ) {
 639                                         $out[$attribute] = $value;
 640                                 }
 641
 642                                 continue;
 643                         }
 644
 645                         if( !isset( $whitelist[$attribute] ) ) {
 646                                 continue;
 647                         }
 648
 649                         # Strip javascript "expression" from stylesheets.
 650                         # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
 651                         if( $attribute == 'style' ) {
 652                                 $value = Sanitizer::checkCss( $value );
 653                                 if( $value === false ) {
 654                                         # haxx0r
 655                                         continue;
 656                                 }
 657                         }
 658
 659                         if ( $attribute === 'id' ) {
 660                                 $value = Sanitizer::escapeId( $value, 'noninitial' );
 661                         }
 662
 663                         //RDFa and microdata properties allow URLs, URIs and/or CURIs. check them for sanity
 664                         if ( $attribute === 'rel' || $attribute === 'rev' ||
 665                                 $attribute === 'about' || $attribute === 'property' || $attribute === 'resource' || #RDFa
 666                                 $attribute === 'datatype' || $attribute === 'typeof' ||                             #RDFa
 667                                 $attribute === 'itemid' || $attribute === 'itemprop' || $attribute === 'itemref' || #HTML5 microdata
 668                                 $attribute === 'itemscope' || $attribute === 'itemtype' ) {                         #HTML5 microdata
 669
 670                                 //Paranoia. Allow "simple" values but suppress javascript
 671                                 if ( preg_match( MW_EVIL_URI_PATTERN, $value ) ) {
 672                                         continue;
 673                                 }
 674                         }
 675
 676                         # NOTE: even though elements using href/src are not allowed directly, supply
 677                         #       validation code that can be used by tag hook handlers, etc
 678                         if ( $attribute === 'href' || $attribute === 'src' ) {
 679                                 if ( !preg_match( $hrefExp, $value ) ) {
 680                                         continue; //drop any href or src attributes not using an allowed protocol.
 681                                                   //NOTE: this also drops all relative URLs
 682                                 }
 683                         }
 684
 685                         // If this attribute was previously set, override it.
 686                         // Output should only have one attribute of each name.
 687                         $out[$attribute] = $value;
 688                 }
 689
 690                 if ( $wgAllowMicrodataAttributes ) {
 691                         # There are some complicated validity constraints we need to
 692                         # enforce here.  First of all, we don't want to allow non-standard
 693                         # itemtypes.
 694                         $allowedTypes = array(
 695                                 'http://microformats.org/profile/hcard',
 696                                 'http://microformats.org/profile/hcalendar#vevent',
 697                                 'http://n.whatwg.org/work',
 698                         );
 699                         if ( isset( $out['itemtype'] ) && !in_array( $out['itemtype'],
 700                         $allowedTypes ) ) {
 701                                 # Kill everything
 702                                 unset( $out['itemscope'] );
 703                         }
 704                         # itemtype, itemid, itemref don't make sense without itemscope
 705                         if ( !array_key_exists( 'itemscope', $out ) ) {
 706                                 unset( $out['itemtype'] );
 707                                 unset( $out['itemid'] );
 708                                 unset( $out['itemref'] );
 709                         }
 710                         # TODO: Strip itemprop if we aren't descendants of an itemscope.
 711                 }
 712                 return $out;
 713         }
 714
 715         /**
 716          * Merge two sets of HTML attributes.  Conflicting items in the second set
 717          * will override those in the first, except for 'class' attributes which
 718          * will be combined (if they're both strings).
 719          *
 720          * @todo implement merging for other attributes such as style
 721          * @param $a Array
 722          * @param $b Array
 723          * @return array
 724          */
 725         static function mergeAttributes( $a, $b ) {
 726                 $out = array_merge( $a, $b );
 727                 if( isset( $a['class'] ) && isset( $b['class'] )
 728                 && is_string( $a['class'] ) && is_string( $b['class'] )
 729                 && $a['class'] !== $b['class'] ) {
 730                         $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
 731                                 -1, PREG_SPLIT_NO_EMPTY );
 732                         $out['class'] = implode( ' ', array_unique( $classes ) );
 733                 }
 734                 return $out;
 735         }
 736
 737         /**
 738          * Pick apart some CSS and check it for forbidden or unsafe structures.
 739          * Returns a sanitized string, or false if it was just too evil.
 740          *
 741          * Currently URL references, 'expression', 'tps' are forbidden.
 742          *
 743          * @param $value String
 744          * @return Mixed
 745          */
 746         static function checkCss( $value ) {
 747                 $value = Sanitizer::decodeCharReferences( $value );
 748
 749                 // Remove any comments; IE gets token splitting wrong
 750                 $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value );
 751
 752                 // Decode escape sequences and line continuation
 753                 // See the grammar in the CSS 2 spec, appendix D, Mozilla implements it accurately.
 754                 // IE 8 doesn't implement it at all, but there's no way to introduce url() into
 755                 // IE that doesn't hit Mozilla also.
 756                 static $decodeRegex;
 757                 if ( !$decodeRegex ) {
 758                         $space = '[\\x20\\t\\r\\n\\f]';
 759                         $nl = '(?:\\n|\\r\\n|\\r|\\f)';
 760                         $backslash = '\\\\';
 761                         $decodeRegex = "/ $backslash
 762                                 (?:
 763                                         ($nl) |  # 1. Line continuation
 764                                         ([0-9A-Fa-f]{1,6})$space? |  # 2. character number
 765                                         (.) # 3. backslash cancelling special meaning
 766                                 )/xu";
 767                 }
 768                 $decoded = preg_replace_callback( $decodeRegex,
 769                         array( __CLASS__, 'cssDecodeCallback' ), $value );
 770                 if ( preg_match( '!expression|https?://|url\s*\(!i', $decoded ) ) {
 771                         // Not allowed
 772                         return false;
 773                 } else {
 774                         // Allowed, return CSS with comments stripped
 775                         return $value;
 776                 }
 777         }
 778
 779         static function cssDecodeCallback( $matches ) {
 780                 if ( $matches[1] !== '' ) {
 781                         return '';
 782                 } elseif ( $matches[2] !== '' ) {
 783                         return codepointToUtf8( hexdec( $matches[2] ) );
 784                 } elseif ( $matches[3] !== '' ) {
 785                         return $matches[3];
 786                 } else {
 787                         throw new MWException( __METHOD__.': invalid match' );
 788                 }
 789         }
 790
 791         /**
 792          * Take a tag soup fragment listing an HTML element's attributes
 793          * and normalize it to well-formed XML, discarding unwanted attributes.
 794          * Output is safe for further wikitext processing, with escaping of
 795          * values that could trigger problems.
 796          *
 797          * - Normalizes attribute names to lowercase
 798          * - Discards attributes not on a whitelist for the given element
 799          * - Turns broken or invalid entities into plaintext
 800          * - Double-quotes all attribute values
 801          * - Attributes without values are given the name as attribute
 802          * - Double attributes are discarded
 803          * - Unsafe style attributes are discarded
 804          * - Prepends space if there are attributes.
 805          *
 806          * @param $text String
 807          * @param $element String
 808          * @return String
 809          */
 810         static function fixTagAttributes( $text, $element ) {
 811                 if( trim( $text ) == '' ) {
 812                         return '';
 813                 }
 814
 815                 $stripped = Sanitizer::validateTagAttributes(
 816                         Sanitizer::decodeTagAttributes( $text ), $element );
 817
 818                 $attribs = array();
 819                 foreach( $stripped as $attribute => $value ) {
 820                         $encAttribute = htmlspecialchars( $attribute );
 821                         $encValue = Sanitizer::safeEncodeAttribute( $value );
 822
 823                         $attribs[] = "$encAttribute=\"$encValue\"";
 824                 }
 825                 return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : '';
 826         }
 827
 828         /**
 829          * Encode an attribute value for HTML output.
 830          * @param $text String
 831          * @return HTML-encoded text fragment
 832          */
 833         static function encodeAttribute( $text ) {
 834                 $encValue = htmlspecialchars( $text, ENT_QUOTES );
 835
 836                 // Whitespace is normalized during attribute decoding,
 837                 // so if we've been passed non-spaces we must encode them
 838                 // ahead of time or they won't be preserved.
 839                 $encValue = strtr( $encValue, array(
 840                         "\n" => '&#10;',
 841                         "\r" => '&#13;',
 842                         "\t" => '&#9;',
 843                 ) );
 844
 845                 return $encValue;
 846         }
 847
 848         /**
 849          * Encode an attribute value for HTML tags, with extra armoring
 850          * against further wiki processing.
 851          * @param $text String
 852          * @return HTML-encoded text fragment
 853          */
 854         static function safeEncodeAttribute( $text ) {
 855                 $encValue = Sanitizer::encodeAttribute( $text );
 856
 857                 # Templates and links may be expanded in later parsing,
 858                 # creating invalid or dangerous output. Suppress this.
 859                 $encValue = strtr( $encValue, array(
 860                         '<'    => '&lt;',   // This should never happen,
 861                         '>'    => '&gt;',   // we've received invalid input
 862                         '"'    => '&quot;', // which should have been escaped.
 863                         '{'    => '&#123;',
 864                         '['    => '&#91;',
 865                         "''"   => '&#39;&#39;',
 866                         'ISBN' => '&#73;SBN',
 867                         'RFC'  => '&#82;FC',
 868                         'PMID' => '&#80;MID',
 869                         '|'    => '&#124;',
 870                         '__'   => '&#95;_',
 871                 ) );
 872
 873                 # Stupid hack
 874                 $encValue = preg_replace_callback(
 875                         '/(' . wfUrlProtocols() . ')/',
 876                         array( 'Sanitizer', 'armorLinksCallback' ),
 877                         $encValue );
 878                 return $encValue;
 879         }
 880
 881         /**
 882          * Given a value, escape it so that it can be used in an id attribute and
 883          * return it.  This will use HTML5 validation if $wgExperimentalHtmlIds is
 884          * true, allowing anything but ASCII whitespace.  Otherwise it will use
 885          * HTML 4 rules, which means a narrow subset of ASCII, with bad characters
 886          * escaped with lots of dots.
 887          *
 888          * To ensure we don't have to bother escaping anything, we also strip ', ",
 889          * & even if $wgExperimentalIds is true.  TODO: Is this the best tactic?
 890          * We also strip # because it upsets IE6.
 891          *
 892          * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters
 893          *                                                          in the id and
 894          *                                                          name attributes
 895          * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
 896          * @see http://www.whatwg.org/specs/web-apps/current-work/multipage/elements.html#the-id-attribute
 897          *   HTML5 definition of id attribute
 898          *
 899          * @param $id String: id to escape
 900          * @param $options Mixed: string or array of strings (default is array()):
 901          *   'noninitial': This is a non-initial fragment of an id, not a full id,
 902          *       so don't pay attention if the first character isn't valid at the
 903          *       beginning of an id.  Only matters if $wgExperimentalHtmlIds is
 904          *       false.
 905          *   'legacy': Behave the way the old HTML 4-based ID escaping worked even
 906          *       if $wgExperimentalHtmlIds is used, so we can generate extra
 907          *       anchors and links won't break.
 908          * @return String
 909          */
 910         static function escapeId( $id, $options = array() ) {
 911                 global $wgHtml5, $wgExperimentalHtmlIds;
 912                 $options = (array)$options;
 913
 914                 if ( $wgHtml5 && $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) {
 915                         $id = Sanitizer::decodeCharReferences( $id );
 916                         $id = preg_replace( '/[ \t\n\r\f_\'"&#]+/', '_', $id );
 917                         $id = trim( $id, '_' );
 918                         if ( $id === '' ) {
 919                                 # Must have been all whitespace to start with.
 920                                 return '_';
 921                         } else {
 922                                 return $id;
 923                         }
 924                 }
 925
 926                 # HTML4-style escaping
 927                 static $replace = array(
 928                         '%3A' => ':',
 929                         '%' => '.'
 930                 );
 931
 932                 $id = urlencode( Sanitizer::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
 933                 $id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
 934
 935                 if ( !preg_match( '/^[a-zA-Z]/', $id )
 936                 && !in_array( 'noninitial', $options ) )  {
 937                         // Initial character must be a letter!
 938                         $id = "x$id";
 939                 }
 940                 return $id;
 941         }
 942
 943         /**
 944          * Given a value, escape it so that it can be used as a CSS class and
 945          * return it.
 946          *
 947          * @todo For extra validity, input should be validated UTF-8.
 948          *
 949          * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
 950          *
 951          * @param $class String
 952          * @return String
 953          */
 954         static function escapeClass( $class ) {
 955                 // Convert ugly stuff to underscores and kill underscores in ugly places
 956                 return rtrim(preg_replace(
 957                         array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
 958                         '_',
 959                         $class ), '_');
 960         }
 961
 962         /**
 963          * Given HTML input, escape with htmlspecialchars but un-escape entites.
 964          * This allows (generally harmless) entities like &nbsp; to survive.
 965          *
 966          * @param $html String to escape
 967          * @return String: escaped input
 968          */
 969         static function escapeHtmlAllowEntities( $html ) {
 970                 # It seems wise to escape ' as well as ", as a matter of course.  Can't
 971                 # hurt.
 972                 $html = htmlspecialchars( $html, ENT_QUOTES );
 973                 $html = str_replace( '&amp;', '&', $html );
 974                 $html = Sanitizer::normalizeCharReferences( $html );
 975                 return $html;
 976         }
 977
 978         /**
 979          * Regex replace callback for armoring links against further processing.
 980          * @param $matches Array
 981          * @return string
 982          */
 983         private static function armorLinksCallback( $matches ) {
 984                 return str_replace( ':', '&#58;', $matches[1] );
 985         }
 986
 987         /**
 988          * Return an associative array of attribute names and values from
 989          * a partial tag string. Attribute names are forces to lowercase,
 990          * character references are decoded to UTF-8 text.
 991          *
 992          * @param $text String
 993          * @return Array
 994          */
 995         public static function decodeTagAttributes( $text ) {
 996                 if( trim( $text ) == '' ) {
 997                         return array();
 998                 }
 999
1000                 $attribs = array();
1001                 $pairs = array();
1002                 if( !preg_match_all(
1003                         MW_ATTRIBS_REGEX,
1004                         $text,
1005                         $pairs,
1006                         PREG_SET_ORDER ) ) {
1007                         return $attribs;
1008                 }
1009
1010                 foreach( $pairs as $set ) {
1011                         $attribute = strtolower( $set[1] );
1012                         $value = Sanitizer::getTagAttributeCallback( $set );
1013
1014                         // Normalize whitespace
1015                         $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1016                         $value = trim( $value );
1017
1018                         // Decode character references
1019                         $attribs[$attribute] = Sanitizer::decodeCharReferences( $value );
1020                 }
1021                 return $attribs;
1022         }
1023
1024         /**
1025          * Pick the appropriate attribute value from a match set from the
1026          * MW_ATTRIBS_REGEX matches.
1027          *
1028          * @param $set Array
1029          * @return String
1030          */
1031         private static function getTagAttributeCallback( $set ) {
1032                 if( isset( $set[6] ) ) {
1033                         # Illegal #XXXXXX color with no quotes.
1034                         return $set[6];
1035                 } elseif( isset( $set[5] ) ) {
1036                         # No quotes.
1037                         return $set[5];
1038                 } elseif( isset( $set[4] ) ) {
1039                         # Single-quoted
1040                         return $set[4];
1041                 } elseif( isset( $set[3] ) ) {
1042                         # Double-quoted
1043                         return $set[3];
1044                 } elseif( !isset( $set[2] ) ) {
1045                         # In XHTML, attributes must have a value.
1046                         # For 'reduced' form, return explicitly the attribute name here.
1047                         return $set[1];
1048                 } else {
1049                         throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1050                 }
1051         }
1052
1053         /**
1054          * Normalize whitespace and character references in an XML source-
1055          * encoded text for an attribute value.
1056          *
1057          * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
1058          * but note that we're not returning the value, but are returning
1059          * XML source fragments that will be slapped into output.
1060          *
1061          * @param $text String
1062          * @return String
1063          */
1064         private static function normalizeAttributeValue( $text ) {
1065                 return str_replace( '"', '&quot;',
1066                         self::normalizeWhitespace(
1067                                 Sanitizer::normalizeCharReferences( $text ) ) );
1068         }
1069
1070         private static function normalizeWhitespace( $text ) {
1071                 return preg_replace(
1072                         '/\r\n|[\x20\x0d\x0a\x09]/',
1073                         ' ',
1074                         $text );
1075         }
1076
1077         /**
1078          * Ensure that any entities and character references are legal
1079          * for XML and XHTML specifically. Any stray bits will be
1080          * &amp;-escaped to result in a valid text fragment.
1081          *
1082          * a. any named char refs must be known in XHTML
1083          * b. any numeric char refs must be legal chars, not invalid or forbidden
1084          * c. use &#x, not &#X
1085          * d. fix or reject non-valid attributes
1086          *
1087          * @param $text String
1088          * @return String
1089          * @private
1090          */
1091         static function normalizeCharReferences( $text ) {
1092                 return preg_replace_callback(
1093                         MW_CHAR_REFS_REGEX,
1094                         array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
1095                         $text );
1096         }
1097         /**
1098          * @param $matches String
1099          * @return String
1100          */
1101         static function normalizeCharReferencesCallback( $matches ) {
1102                 $ret = null;
1103                 if( $matches[1] != '' ) {
1104                         $ret = Sanitizer::normalizeEntity( $matches[1] );
1105                 } elseif( $matches[2] != '' ) {
1106                         $ret = Sanitizer::decCharReference( $matches[2] );
1107                 } elseif( $matches[3] != ''  ) {
1108                         $ret = Sanitizer::hexCharReference( $matches[3] );
1109                 } elseif( $matches[4] != '' ) {
1110                         $ret = Sanitizer::hexCharReference( $matches[4] );
1111                 }
1112                 if( is_null( $ret ) ) {
1113                         return htmlspecialchars( $matches[0] );
1114                 } else {
1115                         return $ret;
1116                 }
1117         }
1118
1119         /**
1120          * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1121          * return the named entity reference as is. If the entity is a
1122          * MediaWiki-specific alias, returns the HTML equivalent. Otherwise,
1123          * returns HTML-escaped text of pseudo-entity source (eg &amp;foo;)
1124          *
1125          * @param $name String
1126          * @return String
1127          */
1128         static function normalizeEntity( $name ) {
1129                 global $wgHtmlEntities, $wgHtmlEntityAliases;
1130                 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1131                         return "&{$wgHtmlEntityAliases[$name]};";
1132                 } elseif( isset( $wgHtmlEntities[$name] ) ) {
1133                         return "&$name;";
1134                 } else {
1135                         return "&amp;$name;";
1136                 }
1137         }
1138
1139         static function decCharReference( $codepoint ) {
1140                 $point = intval( $codepoint );
1141                 if( Sanitizer::validateCodepoint( $point ) ) {
1142                         return sprintf( '&#%d;', $point );
1143                 } else {
1144                         return null;
1145                 }
1146         }
1147
1148         static function hexCharReference( $codepoint ) {
1149                 $point = hexdec( $codepoint );
1150                 if( Sanitizer::validateCodepoint( $point ) ) {
1151                         return sprintf( '&#x%x;', $point );
1152                 } else {
1153                         return null;
1154                 }
1155         }
1156
1157         /**
1158          * Returns true if a given Unicode codepoint is a valid character in XML.
1159          * @param $codepoint Integer
1160          * @return Boolean
1161          */
1162         private static function validateCodepoint( $codepoint ) {
1163                 return ($codepoint ==    0x09)
1164                         || ($codepoint ==    0x0a)
1165                         || ($codepoint ==    0x0d)
1166                         || ($codepoint >=    0x20 && $codepoint <=   0xd7ff)
1167                         || ($codepoint >=  0xe000 && $codepoint <=   0xfffd)
1168                         || ($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
1169         }
1170
1171         /**
1172          * Decode any character references, numeric or named entities,
1173          * in the text and return a UTF-8 string.
1174          *
1175          * @param $text String
1176          * @return String
1177          */
1178         public static function decodeCharReferences( $text ) {
1179                 return preg_replace_callback(
1180                         MW_CHAR_REFS_REGEX,
1181                         array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1182                         $text );
1183         }
1184
1185         /**
1186          * Decode any character references, numeric or named entities,
1187          * in the next and normalize the resulting string. (bug 14952)
1188          *
1189          * This is useful for page titles, not for text to be displayed,
1190          * MediaWiki allows HTML entities to escape normalization as a feature.
1191          *
1192          * @param $text String (already normalized, containing entities)
1193          * @return String (still normalized, without entities)
1194          */
1195         public static function decodeCharReferencesAndNormalize( $text ) {
1196                 global $wgContLang;
1197                 $text = preg_replace_callback(
1198                         MW_CHAR_REFS_REGEX,
1199                         array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1200                         $text, /* limit */ -1, $count );
1201
1202                 if ( $count ) {
1203                         return $wgContLang->normalize( $text );
1204                 } else {
1205                         return $text;
1206                 }
1207         }
1208
1209         /**
1210          * @param $matches String
1211          * @return String
1212          */
1213         static function decodeCharReferencesCallback( $matches ) {
1214                 if( $matches[1] != '' ) {
1215                         return Sanitizer::decodeEntity( $matches[1] );
1216                 } elseif( $matches[2] != '' ) {
1217                         return  Sanitizer::decodeChar( intval( $matches[2] ) );
1218                 } elseif( $matches[3] != ''  ) {
1219                         return  Sanitizer::decodeChar( hexdec( $matches[3] ) );
1220                 } elseif( $matches[4] != '' ) {
1221                         return  Sanitizer::decodeChar( hexdec( $matches[4] ) );
1222                 }
1223                 # Last case should be an ampersand by itself
1224                 return $matches[0];
1225         }
1226
1227         /**
1228          * Return UTF-8 string for a codepoint if that is a valid
1229          * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
1230          * @param $codepoint Integer
1231          * @return String
1232          * @private
1233          */
1234         static function decodeChar( $codepoint ) {
1235                 if( Sanitizer::validateCodepoint( $codepoint ) ) {
1236                         return codepointToUtf8( $codepoint );
1237                 } else {
1238                         return UTF8_REPLACEMENT;
1239                 }
1240         }
1241
1242         /**
1243          * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1244          * return the UTF-8 encoding of that character. Otherwise, returns
1245          * pseudo-entity source (eg &foo;)
1246          *
1247          * @param $name Strings
1248          * @return String
1249          */
1250         static function decodeEntity( $name ) {
1251                 global $wgHtmlEntities, $wgHtmlEntityAliases;
1252                 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1253                         $name = $wgHtmlEntityAliases[$name];
1254                 }
1255                 if( isset( $wgHtmlEntities[$name] ) ) {
1256                         return codepointToUtf8( $wgHtmlEntities[$name] );
1257                 } else {
1258                         return "&$name;";
1259                 }
1260         }
1261
1262         /**
1263          * Fetch the whitelist of acceptable attributes for a given element name.
1264          *
1265          * @param $element String
1266          * @return Array
1267          */
1268         static function attributeWhitelist( $element ) {
1269                 static $list;
1270                 if( !isset( $list ) ) {
1271                         $list = Sanitizer::setupAttributeWhitelist();
1272                 }
1273                 return isset( $list[$element] )
1274                         ? $list[$element]
1275                         : array();
1276         }
1277
1278         /**
1279          * Foreach array key (an allowed HTML element), return an array
1280          * of allowed attributes
1281          * @return Array
1282          */
1283         static function setupAttributeWhitelist() {
1284                 global $wgAllowRdfaAttributes, $wgHtml5, $wgAllowMicrodataAttributes;
1285
1286                 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );
1287
1288                 if ( $wgAllowRdfaAttributes ) {
1289                         #RDFa attributes as specified in section 9 of http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1290                         $common = array_merge( $common, array(
1291                             'about', 'property', 'resource', 'datatype', 'typeof',
1292                         ) );
1293                 }
1294
1295                 if ( $wgHtml5 && $wgAllowMicrodataAttributes ) {
1296                         # add HTML5 microdata tages as pecified by http://www.whatwg.org/specs/web-apps/current-work/multipage/microdata.html#the-microdata-model
1297                         $common = array_merge( $common, array(
1298                             'itemid', 'itemprop', 'itemref', 'itemscope', 'itemtype'
1299                         ) );
1300                 }
1301
1302                 $block = array_merge( $common, array( 'align' ) );
1303                 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1304                 $tablecell = array( 'abbr',
1305                                     'axis',
1306                                     'headers',
1307                                     'scope',
1308                                     'rowspan',
1309                                     'colspan',
1310                                     'nowrap', # deprecated
1311                                     'width',  # deprecated
1312                                     'height', # deprecated
1313                                     'bgcolor' # deprecated
1314                                     );
1315
1316                 # Numbers refer to sections in HTML 4.01 standard describing the element.
1317                 # See: http://www.w3.org/TR/html4/
1318                 $whitelist = array (
1319                         # 7.5.4
1320                         'div'        => $block,
1321                         'center'     => $common, # deprecated
1322                         'span'       => $block, # ??
1323
1324                         # 7.5.5
1325                         'h1'         => $block,
1326                         'h2'         => $block,
1327                         'h3'         => $block,
1328                         'h4'         => $block,
1329                         'h5'         => $block,
1330                         'h6'         => $block,
1331
1332                         # 7.5.6
1333                         # address
1334
1335                         # 8.2.4
1336                         # bdo
1337
1338                         # 9.2.1
1339                         'em'         => $common,
1340                         'strong'     => $common,
1341                         'cite'       => $common,
1342                         # dfn
1343                         'code'       => $common,
1344                         # samp
1345                         # kbd
1346                         'var'        => $common,
1347                         'abbr'       => $common,
1348                         # acronym
1349
1350                         # 9.2.2
1351                         'blockquote' => array_merge( $common, array( 'cite' ) ),
1352                         # q
1353
1354                         # 9.2.3
1355                         'sub'        => $common,
1356                         'sup'        => $common,
1357
1358                         # 9.3.1
1359                         'p'          => $block,
1360
1361                         # 9.3.2
1362                         'br'         => array( 'id', 'class', 'title', 'style', 'clear' ),
1363
1364                         # 9.3.4
1365                         'pre'        => array_merge( $common, array( 'width' ) ),
1366
1367                         # 9.4
1368                         'ins'        => array_merge( $common, array( 'cite', 'datetime' ) ),
1369                         'del'        => array_merge( $common, array( 'cite', 'datetime' ) ),
1370
1371                         # 10.2
1372                         'ul'         => array_merge( $common, array( 'type' ) ),
1373                         'ol'         => array_merge( $common, array( 'type', 'start' ) ),
1374                         'li'         => array_merge( $common, array( 'type', 'value' ) ),
1375
1376                         # 10.3
1377                         'dl'         => $common,
1378                         'dd'         => $common,
1379                         'dt'         => $common,
1380
1381                         # 11.2.1
1382                         'table'      => array_merge( $common,
1383                                                                 array( 'summary', 'width', 'border', 'frame',
1384                                                                                 'rules', 'cellspacing', 'cellpadding',
1385                                                                                 'align', 'bgcolor',
1386                                                                 ) ),
1387
1388                         # 11.2.2
1389                         'caption'    => array_merge( $common, array( 'align' ) ),
1390
1391                         # 11.2.3
1392                         'thead'      => array_merge( $common, $tablealign ),
1393                         'tfoot'      => array_merge( $common, $tablealign ),
1394                         'tbody'      => array_merge( $common, $tablealign ),
1395
1396                         # 11.2.4
1397                         'colgroup'   => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1398                         'col'        => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1399
1400                         # 11.2.5
1401                         'tr'         => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1402
1403                         # 11.2.6
1404                         'td'         => array_merge( $common, $tablecell, $tablealign ),
1405                         'th'         => array_merge( $common, $tablecell, $tablealign ),
1406
1407                         # 12.2 # NOTE: <a> is not allowed directly, but the attrib whitelist is used from the Parser object
1408                         'a'          => array_merge( $common, array( 'href', 'rel', 'rev' ) ), # rel/rev esp. for RDFa
1409
1410                         # 13.2
1411                         # Not usually allowed, but may be used for extension-style hooks
1412                         # such as <math> when it is rasterized, or if $wgAllowImageTag is
1413                         # true
1414                         'img'        => array_merge( $common, array( 'alt', 'src', 'width', 'height' ) ),
1415
1416                         # 15.2.1
1417                         'tt'         => $common,
1418                         'b'          => $common,
1419                         'i'          => $common,
1420                         'big'        => $common,
1421                         'small'      => $common,
1422                         'strike'     => $common,
1423                         's'          => $common,
1424                         'u'          => $common,
1425
1426                         # 15.2.2
1427                         'font'       => array_merge( $common, array( 'size', 'color', 'face' ) ),
1428                         # basefont
1429
1430                         # 15.3
1431                         'hr'         => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1432
1433                         # XHTML Ruby annotation text module, simple ruby only.
1434                         # http://www.w3c.org/TR/ruby/
1435                         'ruby'       => $common,
1436                         # rbc
1437                         # rtc
1438                         'rb'         => $common,
1439                         'rt'         => $common, #array_merge( $common, array( 'rbspan' ) ),
1440                         'rp'         => $common,
1441
1442                         # MathML root element, where used for extensions
1443                         # 'title' may not be 100% valid here; it's XHTML
1444                         # http://www.w3.org/TR/REC-MathML/
1445                         'math'       => array( 'class', 'style', 'id', 'title' ),
1446                         );
1447                 return $whitelist;
1448         }
1449
1450         /**
1451          * Take a fragment of (potentially invalid) HTML and return
1452          * a version with any tags removed, encoded as plain text.
1453          *
1454          * Warning: this return value must be further escaped for literal
1455          * inclusion in HTML output as of 1.10!
1456          *
1457          * @param $text String: HTML fragment
1458          * @return String
1459          */
1460         static function stripAllTags( $text ) {
1461                 # Actual <tags>
1462                 $text = StringUtils::delimiterReplace( '<', '>', '', $text );
1463
1464                 # Normalize &entities and whitespace
1465                 $text = self::decodeCharReferences( $text );
1466                 $text = self::normalizeWhitespace( $text );
1467
1468                 return $text;
1469         }
1470
1471         /**
1472          * Hack up a private DOCTYPE with HTML's standard entity declarations.
1473          * PHP 4 seemed to know these if you gave it an HTML doctype, but
1474          * PHP 5.1 doesn't.
1475          *
1476          * Use for passing XHTML fragments to PHP's XML parsing functions
1477          *
1478          * @return String
1479          */
1480         static function hackDocType() {
1481                 global $wgHtmlEntities;
1482                 $out = "<!DOCTYPE html [\n";
1483                 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1484                         $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1485                 }
1486                 $out .= "]>\n";
1487                 return $out;
1488         }
1489
1490         static function cleanUrl( $url ) {
1491                 # Normalize any HTML entities in input. They will be
1492                 # re-escaped by makeExternalLink().
1493                 $url = Sanitizer::decodeCharReferences( $url );
1494
1495                 # Escape any control characters introduced by the above step
1496                 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F\|]/e', "urlencode('\\0')", $url );
1497
1498                 # Validate hostname portion
1499                 $matches = array();
1500                 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1501                         list( /* $whole */, $protocol, $host, $rest ) = $matches;
1502
1503                         // Characters that will be ignored in IDNs.
1504                         // http://tools.ietf.org/html/3454#section-3.1
1505                         // Strip them before further processing so blacklists and such work.
1506                         $strip = "/
1507                                 \\s|          # general whitespace
1508                                 \xc2\xad|     # 00ad SOFT HYPHEN
1509                                 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1510                                 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1511                                 \xe2\x81\xa0| # 2060 WORD JOINER
1512                                 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1513                                 \xcd\x8f|     # 034f COMBINING GRAPHEME JOINER
1514                                 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1515                                 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1516                                 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1517                                 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1518                                 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1519                                 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1520                                 /xuD";
1521
1522                         $host = preg_replace( $strip, '', $host );
1523
1524                         // @todo Fixme: validate hostnames here
1525
1526                         return $protocol . $host . $rest;
1527                 } else {
1528                         return $url;
1529                 }
1530         }
1531
1532 }