includes/Sanitizer.php

   1 <?php
   2 /**
   3  * XHTML sanitizer for MediaWiki
   4  *
   5  * Copyright (C) 2002-2005 Brion Vibber <brion@pobox.com> et al
   6  * http://www.mediawiki.org/
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along
  19  * with this program; if not, write to the Free Software Foundation, Inc.,
  20  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  21  * http://www.gnu.org/copyleft/gpl.html
  22  *
  23  * @file
  24  * @ingroup Parser
  25  */
  26
  27 /**
  28  * Regular expression to match various types of character references in
  29  * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
  30  */
  31 define( 'MW_CHAR_REFS_REGEX',
  32         '/&([A-Za-z0-9\x80-\xff]+);
  33          |&\#([0-9]+);
  34          |&\#x([0-9A-Za-z]+);
  35          |&\#X([0-9A-Za-z]+);
  36          |(&)/x' );
  37
  38 /**
  39  * Regular expression to match HTML/XML attribute pairs within a tag.
  40  * Allows some... latitude.
  41  * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
  42  */
  43 $attrib = '[A-Za-z0-9]';
  44 $space = '[\x09\x0a\x0d\x20]';
  45 define( 'MW_ATTRIBS_REGEX',
  46         "/(?:^|$space)((?:xml:|xmlns:)?$attrib+)
  47           ($space*=$space*
  48                 (?:
  49                  # The attribute value: quoted or alone
  50                   \"([^<\"]*)\"
  51                  | '([^<']*)'
  52                  |  ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
  53                  |  (\#[0-9a-fA-F]+) # Technically wrong, but lots of
  54                                                          # colors are specified like this.
  55                                                          # We'll be normalizing it.
  56                 )
  57            )?(?=$space|\$)/sx" );
  58
  59 /**
  60  * Regular expression to match URIs that could trigger script execution
  61  */
  62 define( 'MW_EVIL_URI_PATTERN', '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i' );
  63
  64 /**
  65  * Regular expression to match namespace attributes
  66  */
  67 define( 'MW_XMLNS_ATTRIBUTE_PATTRN', "/^xmlns:$attrib+$/" );
  68
  69 /**
  70  * List of all named character entities defined in HTML 4.01
  71  * http://www.w3.org/TR/html4/sgml/entities.html
  72  * @private
  73  */
  74 global $wgHtmlEntities;
  75 $wgHtmlEntities = array(
  76         'Aacute'   => 193,
  77         'aacute'   => 225,
  78         'Acirc'    => 194,
  79         'acirc'    => 226,
  80         'acute'    => 180,
  81         'AElig'    => 198,
  82         'aelig'    => 230,
  83         'Agrave'   => 192,
  84         'agrave'   => 224,
  85         'alefsym'  => 8501,
  86         'Alpha'    => 913,
  87         'alpha'    => 945,
  88         'amp'      => 38,
  89         'and'      => 8743,
  90         'ang'      => 8736,
  91         'Aring'    => 197,
  92         'aring'    => 229,
  93         'asymp'    => 8776,
  94         'Atilde'   => 195,
  95         'atilde'   => 227,
  96         'Auml'     => 196,
  97         'auml'     => 228,
  98         'bdquo'    => 8222,
  99         'Beta'     => 914,
 100         'beta'     => 946,
 101         'brvbar'   => 166,
 102         'bull'     => 8226,
 103         'cap'      => 8745,
 104         'Ccedil'   => 199,
 105         'ccedil'   => 231,
 106         'cedil'    => 184,
 107         'cent'     => 162,
 108         'Chi'      => 935,
 109         'chi'      => 967,
 110         'circ'     => 710,
 111         'clubs'    => 9827,
 112         'cong'     => 8773,
 113         'copy'     => 169,
 114         'crarr'    => 8629,
 115         'cup'      => 8746,
 116         'curren'   => 164,
 117         'dagger'   => 8224,
 118         'Dagger'   => 8225,
 119         'darr'     => 8595,
 120         'dArr'     => 8659,
 121         'deg'      => 176,
 122         'Delta'    => 916,
 123         'delta'    => 948,
 124         'diams'    => 9830,
 125         'divide'   => 247,
 126         'Eacute'   => 201,
 127         'eacute'   => 233,
 128         'Ecirc'    => 202,
 129         'ecirc'    => 234,
 130         'Egrave'   => 200,
 131         'egrave'   => 232,
 132         'empty'    => 8709,
 133         'emsp'     => 8195,
 134         'ensp'     => 8194,
 135         'Epsilon'  => 917,
 136         'epsilon'  => 949,
 137         'equiv'    => 8801,
 138         'Eta'      => 919,
 139         'eta'      => 951,
 140         'ETH'      => 208,
 141         'eth'      => 240,
 142         'Euml'     => 203,
 143         'euml'     => 235,
 144         'euro'     => 8364,
 145         'exist'    => 8707,
 146         'fnof'     => 402,
 147         'forall'   => 8704,
 148         'frac12'   => 189,
 149         'frac14'   => 188,
 150         'frac34'   => 190,
 151         'frasl'    => 8260,
 152         'Gamma'    => 915,
 153         'gamma'    => 947,
 154         'ge'       => 8805,
 155         'gt'       => 62,
 156         'harr'     => 8596,
 157         'hArr'     => 8660,
 158         'hearts'   => 9829,
 159         'hellip'   => 8230,
 160         'Iacute'   => 205,
 161         'iacute'   => 237,
 162         'Icirc'    => 206,
 163         'icirc'    => 238,
 164         'iexcl'    => 161,
 165         'Igrave'   => 204,
 166         'igrave'   => 236,
 167         'image'    => 8465,
 168         'infin'    => 8734,
 169         'int'      => 8747,
 170         'Iota'     => 921,
 171         'iota'     => 953,
 172         'iquest'   => 191,
 173         'isin'     => 8712,
 174         'Iuml'     => 207,
 175         'iuml'     => 239,
 176         'Kappa'    => 922,
 177         'kappa'    => 954,
 178         'Lambda'   => 923,
 179         'lambda'   => 955,
 180         'lang'     => 9001,
 181         'laquo'    => 171,
 182         'larr'     => 8592,
 183         'lArr'     => 8656,
 184         'lceil'    => 8968,
 185         'ldquo'    => 8220,
 186         'le'       => 8804,
 187         'lfloor'   => 8970,
 188         'lowast'   => 8727,
 189         'loz'      => 9674,
 190         'lrm'      => 8206,
 191         'lsaquo'   => 8249,
 192         'lsquo'    => 8216,
 193         'lt'       => 60,
 194         'macr'     => 175,
 195         'mdash'    => 8212,
 196         'micro'    => 181,
 197         'middot'   => 183,
 198         'minus'    => 8722,
 199         'Mu'       => 924,
 200         'mu'       => 956,
 201         'nabla'    => 8711,
 202         'nbsp'     => 160,
 203         'ndash'    => 8211,
 204         'ne'       => 8800,
 205         'ni'       => 8715,
 206         'not'      => 172,
 207         'notin'    => 8713,
 208         'nsub'     => 8836,
 209         'Ntilde'   => 209,
 210         'ntilde'   => 241,
 211         'Nu'       => 925,
 212         'nu'       => 957,
 213         'Oacute'   => 211,
 214         'oacute'   => 243,
 215         'Ocirc'    => 212,
 216         'ocirc'    => 244,
 217         'OElig'    => 338,
 218         'oelig'    => 339,
 219         'Ograve'   => 210,
 220         'ograve'   => 242,
 221         'oline'    => 8254,
 222         'Omega'    => 937,
 223         'omega'    => 969,
 224         'Omicron'  => 927,
 225         'omicron'  => 959,
 226         'oplus'    => 8853,
 227         'or'       => 8744,
 228         'ordf'     => 170,
 229         'ordm'     => 186,
 230         'Oslash'   => 216,
 231         'oslash'   => 248,
 232         'Otilde'   => 213,
 233         'otilde'   => 245,
 234         'otimes'   => 8855,
 235         'Ouml'     => 214,
 236         'ouml'     => 246,
 237         'para'     => 182,
 238         'part'     => 8706,
 239         'permil'   => 8240,
 240         'perp'     => 8869,
 241         'Phi'      => 934,
 242         'phi'      => 966,
 243         'Pi'       => 928,
 244         'pi'       => 960,
 245         'piv'      => 982,
 246         'plusmn'   => 177,
 247         'pound'    => 163,
 248         'prime'    => 8242,
 249         'Prime'    => 8243,
 250         'prod'     => 8719,
 251         'prop'     => 8733,
 252         'Psi'      => 936,
 253         'psi'      => 968,
 254         'quot'     => 34,
 255         'radic'    => 8730,
 256         'rang'     => 9002,
 257         'raquo'    => 187,
 258         'rarr'     => 8594,
 259         'rArr'     => 8658,
 260         'rceil'    => 8969,
 261         'rdquo'    => 8221,
 262         'real'     => 8476,
 263         'reg'      => 174,
 264         'rfloor'   => 8971,
 265         'Rho'      => 929,
 266         'rho'      => 961,
 267         'rlm'      => 8207,
 268         'rsaquo'   => 8250,
 269         'rsquo'    => 8217,
 270         'sbquo'    => 8218,
 271         'Scaron'   => 352,
 272         'scaron'   => 353,
 273         'sdot'     => 8901,
 274         'sect'     => 167,
 275         'shy'      => 173,
 276         'Sigma'    => 931,
 277         'sigma'    => 963,
 278         'sigmaf'   => 962,
 279         'sim'      => 8764,
 280         'spades'   => 9824,
 281         'sub'      => 8834,
 282         'sube'     => 8838,
 283         'sum'      => 8721,
 284         'sup'      => 8835,
 285         'sup1'     => 185,
 286         'sup2'     => 178,
 287         'sup3'     => 179,
 288         'supe'     => 8839,
 289         'szlig'    => 223,
 290         'Tau'      => 932,
 291         'tau'      => 964,
 292         'there4'   => 8756,
 293         'Theta'    => 920,
 294         'theta'    => 952,
 295         'thetasym' => 977,
 296         'thinsp'   => 8201,
 297         'THORN'    => 222,
 298         'thorn'    => 254,
 299         'tilde'    => 732,
 300         'times'    => 215,
 301         'trade'    => 8482,
 302         'Uacute'   => 218,
 303         'uacute'   => 250,
 304         'uarr'     => 8593,
 305         'uArr'     => 8657,
 306         'Ucirc'    => 219,
 307         'ucirc'    => 251,
 308         'Ugrave'   => 217,
 309         'ugrave'   => 249,
 310         'uml'      => 168,
 311         'upsih'    => 978,
 312         'Upsilon'  => 933,
 313         'upsilon'  => 965,
 314         'Uuml'     => 220,
 315         'uuml'     => 252,
 316         'weierp'   => 8472,
 317         'Xi'       => 926,
 318         'xi'       => 958,
 319         'Yacute'   => 221,
 320         'yacute'   => 253,
 321         'yen'      => 165,
 322         'Yuml'     => 376,
 323         'yuml'     => 255,
 324         'Zeta'     => 918,
 325         'zeta'     => 950,
 326         'zwj'      => 8205,
 327         'zwnj'     => 8204 );
 328
 329 /**
 330  * Character entity aliases accepted by MediaWiki
 331  */
 332 global $wgHtmlEntityAliases;
 333 $wgHtmlEntityAliases = array(
 334         'רלמ' => 'rlm',
 335         'رلم' => 'rlm',
 336 );
 337
 338
 339 /**
 340  * XHTML sanitizer for MediaWiki
 341  * @ingroup Parser
 342  */
 343 class Sanitizer {
 344         /**
 345          * Cleans up HTML, removes dangerous tags and attributes, and
 346          * removes HTML comments
 347          * @private
 348          * @param $text String
 349          * @param $processCallback Callback to do any variable or parameter replacements in HTML attribute values
 350          * @param $args Array for the processing callback
 351          * @param $extratags Array for any extra tags to include
 352          * @param $removetags Array for any tags (default or extra) to exclude
 353          * @return string
 354          */
 355         static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array(), $removetags = array() ) {
 356                 global $wgUseTidy;
 357
 358                 static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
 359                         $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
 360
 361                 wfProfileIn( __METHOD__ );
 362
 363                 if ( !$staticInitialised ) {
 364
 365                         $htmlpairsStatic = array( # Tags that must be closed
 366                                 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
 367                                 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
 368                                 'strike', 'strong', 'tt', 'var', 'div', 'center',
 369                                 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
 370                                 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u', 'abbr'
 371                         );
 372                         $htmlsingle = array(
 373                                 'br', 'hr', 'li', 'dt', 'dd'
 374                         );
 375                         $htmlsingleonly = array( # Elements that cannot have close tags
 376                                 'br', 'hr'
 377                         );
 378                         $htmlnest = array( # Tags that can be nested--??
 379                                 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
 380                                 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
 381                         );
 382                         $tabletags = array( # Can only appear inside table, we will close them
 383                                 'td', 'th', 'tr',
 384                         );
 385                         $htmllist = array( # Tags used by list
 386                                 'ul','ol',
 387                         );
 388                         $listtags = array( # Tags that can appear in a list
 389                                 'li',
 390                         );
 391
 392                         $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
 393                         $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
 394
 395                         # Convert them all to hashtables for faster lookup
 396                         $vars = array( 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
 397                                 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' );
 398                         foreach ( $vars as $var ) {
 399                                 $$var = array_flip( $$var );
 400                         }
 401                         $staticInitialised = true;
 402                 }
 403                 # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
 404                 $extratags = array_flip( $extratags );
 405                 $removetags = array_flip( $removetags );
 406                 $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
 407                 $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ) , $removetags );
 408
 409                 # Remove HTML comments
 410                 $text = Sanitizer::removeHTMLcomments( $text );
 411                 $bits = explode( '<', $text );
 412                 $text = str_replace( '>', '&gt;', array_shift( $bits ) );
 413                 if ( !$wgUseTidy ) {
 414                         $tagstack = $tablestack = array();
 415                         foreach ( $bits as $x ) {
 416                                 $regs = array();
 417                                 # $slash: Does the current element start with a '/'?
 418                                 # $t: Current element name
 419                                 # $params: String between element name and >
 420                                 # $brace: Ending '>' or '/>'
 421                                 # $rest: Everything until the next element of $bits
 422                                 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
 423                                         list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
 424                                 } else {
 425                                         $slash = $t = $params = $brace = $rest = null;
 426                                 }
 427
 428                                 $badtag = false;
 429                                 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
 430                                         # Check our stack
 431                                         if ( $slash && isset( $htmlsingleonly[$t] ) ) {
 432                                                 $badtag = true;
 433                                         } elseif ( $slash ) {
 434                                                 # Closing a tag... is it the one we just opened?
 435                                                 $ot = @array_pop( $tagstack );
 436                                                 if ( $ot != $t ) {
 437                                                         if ( isset( $htmlsingleallowed[$ot] ) ) {
 438                                                                 # Pop all elements with an optional close tag
 439                                                                 # and see if we find a match below them
 440                                                                 $optstack = array();
 441                                                                 array_push( $optstack, $ot );
 442                                                                 $ot = @array_pop( $tagstack );
 443                                                                 while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
 444                                                                         array_push( $optstack, $ot );
 445                                                                         $ot = @array_pop( $tagstack );
 446                                                                 }
 447                                                                 if ( $t != $ot ) {
 448                                                                         # No match. Push the optional elements back again
 449                                                                         $badtag = true;
 450                                                                         while ( $ot = @array_pop( $optstack ) ) {
 451                                                                                 array_push( $tagstack, $ot );
 452                                                                         }
 453                                                                 }
 454                                                         } else {
 455                                                                 @array_push( $tagstack, $ot );
 456                                                                 # <li> can be nested in <ul> or <ol>, skip those cases:
 457                                                                 if ( !isset( $htmllist[$ot] ) || !isset( $listtags[$t] ) ) {
 458                                                                         $badtag = true;
 459                                                                 }
 460                                                         }
 461                                                 } else {
 462                                                         if ( $t == 'table' ) {
 463                                                                 $tagstack = array_pop( $tablestack );
 464                                                         }
 465                                                 }
 466                                                 $newparams = '';
 467                                         } else {
 468                                                 # Keep track for later
 469                                                 if ( isset( $tabletags[$t] ) &&
 470                                                 !in_array( 'table', $tagstack ) ) {
 471                                                         $badtag = true;
 472                                                 } elseif ( in_array( $t, $tagstack ) &&
 473                                                 !isset( $htmlnest [$t ] ) ) {
 474                                                         $badtag = true;
 475                                                 # Is it a self closed htmlpair ? (bug 5487)
 476                                                 } elseif ( $brace == '/>' &&
 477                                                 isset( $htmlpairs[$t] ) ) {
 478                                                         $badtag = true;
 479                                                 } elseif ( isset( $htmlsingleonly[$t] ) ) {
 480                                                         # Hack to force empty tag for uncloseable elements
 481                                                         $brace = '/>';
 482                                                 } elseif ( isset( $htmlsingle[$t] ) ) {
 483                                                         # Hack to not close $htmlsingle tags
 484                                                         $brace = null;
 485                                                 } elseif ( isset( $tabletags[$t] )
 486                                                 && in_array( $t, $tagstack ) ) {
 487                                                         // New table tag but forgot to close the previous one
 488                                                         $text .= "</$t>";
 489                                                 } else {
 490                                                         if ( $t == 'table' ) {
 491                                                                 array_push( $tablestack, $tagstack );
 492                                                                 $tagstack = array();
 493                                                         }
 494                                                         array_push( $tagstack, $t );
 495                                                 }
 496
 497                                                 # Replace any variables or template parameters with
 498                                                 # plaintext results.
 499                                                 if( is_callable( $processCallback ) ) {
 500                                                         call_user_func_array( $processCallback, array( &$params, $args ) );
 501                                                 }
 502
 503                                                 # Strip non-approved attributes from the tag
 504                                                 $newparams = Sanitizer::fixTagAttributes( $params, $t );
 505                                         }
 506                                         if ( !$badtag ) {
 507                                                 $rest = str_replace( '>', '&gt;', $rest );
 508                                                 $close = ( $brace == '/>' && !$slash ) ? ' /' : '';
 509                                                 $text .= "<$slash$t$newparams$close>$rest";
 510                                                 continue;
 511                                         }
 512                                 }
 513                                 $text .= '&lt;' . str_replace( '>', '&gt;', $x);
 514                         }
 515                         # Close off any remaining tags
 516                         while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
 517                                 $text .= "</$t>\n";
 518                                 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
 519                         }
 520                 } else {
 521                         # this might be possible using tidy itself
 522                         foreach ( $bits as $x ) {
 523                                 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
 524                                 $x, $regs );
 525                                 @list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
 526                                 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
 527                                         if( is_callable( $processCallback ) ) {
 528                                                 call_user_func_array( $processCallback, array( &$params, $args ) );
 529                                         }
 530                                         $newparams = Sanitizer::fixTagAttributes( $params, $t );
 531                                         $rest = str_replace( '>', '&gt;', $rest );
 532                                         $text .= "<$slash$t$newparams$brace$rest";
 533                                 } else {
 534                                         $text .= '&lt;' . str_replace( '>', '&gt;', $x);
 535                                 }
 536                         }
 537                 }
 538                 wfProfileOut( __METHOD__ );
 539                 return $text;
 540         }
 541
 542         /**
 543          * Remove '<!--', '-->', and everything between.
 544          * To avoid leaving blank lines, when a comment is both preceded
 545          * and followed by a newline (ignoring spaces), trim leading and
 546          * trailing spaces and one of the newlines.
 547          *
 548          * @private
 549          * @param $text String
 550          * @return string
 551          */
 552         static function removeHTMLcomments( $text ) {
 553                 wfProfileIn( __METHOD__ );
 554                 while (($start = strpos($text, '<!--')) !== false) {
 555                         $end = strpos($text, '-->', $start + 4);
 556                         if ($end === false) {
 557                                 # Unterminated comment; bail out
 558                                 break;
 559                         }
 560
 561                         $end += 3;
 562
 563                         # Trim space and newline if the comment is both
 564                         # preceded and followed by a newline
 565                         $spaceStart = max($start - 1, 0);
 566                         $spaceLen = $end - $spaceStart;
 567                         while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
 568                                 $spaceStart--;
 569                                 $spaceLen++;
 570                         }
 571                         while (substr($text, $spaceStart + $spaceLen, 1) === ' ')
 572                                 $spaceLen++;
 573                         if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart + $spaceLen, 1) === "\n") {
 574                                 # Remove the comment, leading and trailing
 575                                 # spaces, and leave only one newline.
 576                                 $text = substr_replace($text, "\n", $spaceStart, $spaceLen + 1);
 577                         }
 578                         else {
 579                                 # Remove just the comment.
 580                                 $text = substr_replace($text, '', $start, $end - $start);
 581                         }
 582                 }
 583                 wfProfileOut( __METHOD__ );
 584                 return $text;
 585         }
 586
 587         /**
 588          * Take an array of attribute names and values and normalize or discard
 589          * illegal values for the given element type.
 590          *
 591          * - Discards attributes not on a whitelist for the given element
 592          * - Unsafe style attributes are discarded
 593          * - Invalid id attributes are reencoded
 594          *
 595          * @param $attribs Array
 596          * @param $element String
 597          * @return Array
 598          *
 599          * @todo Check for legal values where the DTD limits things.
 600          * @todo Check for unique id attribute :P
 601          */
 602         static function validateTagAttributes( $attribs, $element ) {
 603                 return Sanitizer::validateAttributes( $attribs,
 604                         Sanitizer::attributeWhitelist( $element ) );
 605         }
 606
 607         /**
 608          * Take an array of attribute names and values and normalize or discard
 609          * illegal values for the given whitelist.
 610          *
 611          * - Discards attributes not the given whitelist
 612          * - Unsafe style attributes are discarded
 613          * - Invalid id attributes are reencoded
 614          *
 615          * @param $attribs Array
 616          * @param $whitelist Array: list of allowed attribute names
 617          * @return Array
 618          *
 619          * @todo Check for legal values where the DTD limits things.
 620          * @todo Check for unique id attribute :P
 621          */
 622         static function validateAttributes( $attribs, $whitelist ) {
 623                 global $wgAllowRdfaAttributes;
 624
 625                 $whitelist = array_flip( $whitelist );
 626                 $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
 627
 628                 $out = array();
 629                 foreach( $attribs as $attribute => $value ) {
 630                         #allow XML namespace declaration if RDFa is enabled
 631                         if ( $wgAllowRdfaAttributes && preg_match( MW_XMLNS_ATTRIBUTE_PATTRN, $attribute ) ) {
 632                                 if ( !preg_match( MW_EVIL_URI_PATTERN, $value ) ) {
 633                                         $out[$attribute] = $value;
 634                                 }
 635
 636                                 continue;
 637                         }
 638
 639                         if( !isset( $whitelist[$attribute] ) ) {
 640                                 continue;
 641                         }
 642
 643                         # Strip javascript "expression" from stylesheets.
 644                         # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
 645                         if( $attribute == 'style' ) {
 646                                 $value = Sanitizer::checkCss( $value );
 647                                 if( $value === false ) {
 648                                         # haxx0r
 649                                         continue;
 650                                 }
 651                         }
 652
 653                         if ( $attribute === 'id' ) {
 654                                 global $wgEnforceHtmlIds;
 655                                 $value = Sanitizer::escapeId( $value,
 656                                         $wgEnforceHtmlIds ? 'noninitial' : 'xml' );
 657                         }
 658
 659                         //RDFa and microdata properties allow URLs, URIs and/or CURIs. check them for sanity
 660                         if ( $attribute === 'rel' || $attribute === 'rev' ||
 661                                 $attribute === 'about' || $attribute === 'property' || $attribute === 'resource' || #RDFa
 662                                 $attribute === 'datatype' || $attribute === 'typeof' ||                             #RDFa
 663                                 $attribute === 'itemid' || $attribute === 'itemprop' || $attribute === 'itemref' || #HTML5 microdata
 664                                 $attribute === 'itemscope' || $attribute === 'itemtype' ) {                         #HTML5 microdata
 665
 666                                 //Paranoia. Allow "simple" values but suppress javascript
 667                                 if ( preg_match( MW_EVIL_URI_PATTERN, $value ) ) {
 668                                         continue;
 669                                 }
 670                         }
 671
 672                         # NOTE: even though elements using href/src are not allowed directly, supply
 673                         #       validation code that can be used by tag hook handlers, etc
 674                         if ( $attribute === 'href' || $attribute === 'src' ) {
 675                                 if ( !preg_match( $hrefExp, $value ) ) {
 676                                         continue; //drop any href or src attributes not using an allowed protocol.
 677                                                   //NOTE: this also drops all relative URLs
 678                                 }
 679                         }
 680
 681                         // If this attribute was previously set, override it.
 682                         // Output should only have one attribute of each name.
 683                         $out[$attribute] = $value;
 684                 }
 685                 return $out;
 686         }
 687
 688         /**
 689          * Merge two sets of HTML attributes.  Conflicting items in the second set
 690          * will override those in the first, except for 'class' attributes which
 691          * will be combined (if they're both strings).
 692          *
 693          * @todo implement merging for other attributes such as style
 694          * @param $a Array
 695          * @param $b Array
 696          * @return array
 697          */
 698         static function mergeAttributes( $a, $b ) {
 699                 $out = array_merge( $a, $b );
 700                 if( isset( $a['class'] ) && isset( $b['class'] )
 701                 && is_string( $a['class'] ) && is_string( $b['class'] )
 702                 && $a['class'] !== $b['class'] ) {
 703                         $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
 704                                 -1, PREG_SPLIT_NO_EMPTY );
 705                         $out['class'] = implode( ' ', array_unique( $classes ) );
 706                 }
 707                 return $out;
 708         }
 709
 710         /**
 711          * Pick apart some CSS and check it for forbidden or unsafe structures.
 712          * Returns a sanitized string, or false if it was just too evil.
 713          *
 714          * Currently URL references, 'expression', 'tps' are forbidden.
 715          *
 716          * @param $value String
 717          * @return Mixed
 718          */
 719         static function checkCss( $value ) {
 720                 $stripped = Sanitizer::decodeCharReferences( $value );
 721
 722                 // Remove any comments; IE gets token splitting wrong
 723                 $stripped = StringUtils::delimiterReplace( '/*', '*/', ' ', $stripped );
 724
 725                 $value = $stripped;
 726
 727                 // ... and continue checks
 728                 $stripped = preg_replace( '!\\\\([0-9A-Fa-f]{1,6})[ \\n\\r\\t\\f]?!e',
 729                         'codepointToUtf8(hexdec("$1"))', $stripped );
 730                 $stripped = str_replace( '\\', '', $stripped );
 731                 if( preg_match( '/(?:expression|tps*:\/\/|url\\s*\().*/is',
 732                                 $stripped ) ) {
 733                         # haxx0r
 734                         return false;
 735                 }
 736
 737                 return $value;
 738         }
 739
 740         /**
 741          * Take a tag soup fragment listing an HTML element's attributes
 742          * and normalize it to well-formed XML, discarding unwanted attributes.
 743          * Output is safe for further wikitext processing, with escaping of
 744          * values that could trigger problems.
 745          *
 746          * - Normalizes attribute names to lowercase
 747          * - Discards attributes not on a whitelist for the given element
 748          * - Turns broken or invalid entities into plaintext
 749          * - Double-quotes all attribute values
 750          * - Attributes without values are given the name as attribute
 751          * - Double attributes are discarded
 752          * - Unsafe style attributes are discarded
 753          * - Prepends space if there are attributes.
 754          *
 755          * @param $text String
 756          * @param $element String
 757          * @return String
 758          */
 759         static function fixTagAttributes( $text, $element ) {
 760                 if( trim( $text ) == '' ) {
 761                         return '';
 762                 }
 763
 764                 $stripped = Sanitizer::validateTagAttributes(
 765                         Sanitizer::decodeTagAttributes( $text ), $element );
 766
 767                 $attribs = array();
 768                 foreach( $stripped as $attribute => $value ) {
 769                         $encAttribute = htmlspecialchars( $attribute );
 770                         $encValue = Sanitizer::safeEncodeAttribute( $value );
 771
 772                         $attribs[] = "$encAttribute=\"$encValue\"";
 773                 }
 774                 return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : '';
 775         }
 776
 777         /**
 778          * Encode an attribute value for HTML output.
 779          * @param $text String
 780          * @return HTML-encoded text fragment
 781          */
 782         static function encodeAttribute( $text ) {
 783                 $encValue = htmlspecialchars( $text, ENT_QUOTES );
 784
 785                 // Whitespace is normalized during attribute decoding,
 786                 // so if we've been passed non-spaces we must encode them
 787                 // ahead of time or they won't be preserved.
 788                 $encValue = strtr( $encValue, array(
 789                         "\n" => '&#10;',
 790                         "\r" => '&#13;',
 791                         "\t" => '&#9;',
 792                 ) );
 793
 794                 return $encValue;
 795         }
 796
 797         /**
 798          * Encode an attribute value for HTML tags, with extra armoring
 799          * against further wiki processing.
 800          * @param $text String
 801          * @return HTML-encoded text fragment
 802          */
 803         static function safeEncodeAttribute( $text ) {
 804                 $encValue = Sanitizer::encodeAttribute( $text );
 805
 806                 # Templates and links may be expanded in later parsing,
 807                 # creating invalid or dangerous output. Suppress this.
 808                 $encValue = strtr( $encValue, array(
 809                         '<'    => '&lt;',   // This should never happen,
 810                         '>'    => '&gt;',   // we've received invalid input
 811                         '"'    => '&quot;', // which should have been escaped.
 812                         '{'    => '&#123;',
 813                         '['    => '&#91;',
 814                         "''"   => '&#39;&#39;',
 815                         'ISBN' => '&#73;SBN',
 816                         'RFC'  => '&#82;FC',
 817                         'PMID' => '&#80;MID',
 818                         '|'    => '&#124;',
 819                         '__'   => '&#95;_',
 820                 ) );
 821
 822                 # Stupid hack
 823                 $encValue = preg_replace_callback(
 824                         '/(' . wfUrlProtocols() . ')/',
 825                         array( 'Sanitizer', 'armorLinksCallback' ),
 826                         $encValue );
 827                 return $encValue;
 828         }
 829
 830         /**
 831          * Given a value escape it so that it can be used in an id attribute and
 832          * return it, this does not validate the value however (see first link)
 833          *
 834          * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters
 835          *                                                          in the id and
 836          *                                                          name attributes
 837          * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
 838          *
 839          * @param $id String: id to validate
 840          * @param $options Mixed: string or array of strings (default is array()):
 841          *   'noninitial': This is a non-initial fragment of an id, not a full id,
 842          *       so don't pay attention if the first character isn't valid at the
 843          *       beginning of an id.
 844          *   'xml': Don't restrict the id to be HTML4-compatible.  This option
 845          *       allows any alphabetic character to be used, per the XML standard.
 846          *       Therefore, it also completely changes the type of escaping: instead
 847          *       of weird dot-encoding, runs of invalid characters (mostly
 848          *       whitespace) are just compressed into a single underscore.
 849          * @return String
 850          */
 851         static function escapeId( $id, $options = array() ) {
 852                 $options = (array)$options;
 853
 854                 if ( !in_array( 'xml', $options ) ) {
 855                         # HTML4-style escaping
 856                         static $replace = array(
 857                                 '%3A' => ':',
 858                                 '%' => '.'
 859                         );
 860
 861                         $id = urlencode( Sanitizer::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
 862                         $id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
 863
 864                         if ( !preg_match( '/^[a-zA-Z]/', $id )
 865                         && !in_array( 'noninitial', $options ) )  {
 866                                 // Initial character must be a letter!
 867                                 $id = "x$id";
 868                         }
 869                         return $id;
 870                 }
 871
 872                 # XML-style escaping.  For the patterns used, see the XML 1.0 standard,
 873                 # 5th edition, NameStartChar and NameChar: <http://www.w3.org/TR/REC-xml/>
 874                 $nameStartChar = ':a-zA-Z_\xC0-\xD6\xD8-\xF6\xF8-\x{2FF}\x{370}-\x{37D}'
 875                         . '\x{37F}-\x{1FFF}\x{200C}-\x{200D}\x{2070}-\x{218F}\x{2C00}-\x{2FEF}'
 876                         . '\x{3001}-\x{D7FF}\x{F900}-\x{FDCF}\x{FDF0}-\x{FFFD}\x{10000}-\x{EFFFF}';
 877                 $nameChar = $nameStartChar . '.\-0-9\xB7\x{0300}-\x{036F}'
 878                         . '\x{203F}-\x{2040}';
 879                 # Replace _ as well so we don't get multiple consecutive underscores
 880                 $id = preg_replace( "/([^$nameChar]|_)+/u", '_', $id );
 881                 $id = trim( $id, '_' );
 882
 883                 if ( !preg_match( "/^[$nameStartChar]/u", $id )
 884                 && !in_array( 'noninitial', $options ) ) {
 885                         $id = "_$id";
 886                 }
 887
 888                 return $id;
 889         }
 890
 891         /**
 892          * Given a value, escape it so that it can be used as a CSS class and
 893          * return it.
 894          *
 895          * @todo For extra validity, input should be validated UTF-8.
 896          *
 897          * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
 898          *
 899          * @param $class String
 900          * @return String
 901          */
 902         static function escapeClass( $class ) {
 903                 // Convert ugly stuff to underscores and kill underscores in ugly places
 904                 return rtrim(preg_replace(
 905                         array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
 906                         '_',
 907                         $class ), '_');
 908         }
 909
 910         /**
 911          * Given HTML input, escape with htmlspecialchars but un-escape entites.
 912          * This allows (generally harmless) entities like &nbsp; to survive.
 913          *
 914          * @param $html String to escape
 915          * @return String: escaped input
 916          */
 917         static function escapeHtmlAllowEntities( $html ) {
 918                 # It seems wise to escape ' as well as ", as a matter of course.  Can't
 919                 # hurt.
 920                 $html = htmlspecialchars( $html, ENT_QUOTES );
 921                 $html = str_replace( '&amp;', '&', $html );
 922                 $html = Sanitizer::normalizeCharReferences( $html );
 923                 return $html;
 924         }
 925
 926         /**
 927          * Regex replace callback for armoring links against further processing.
 928          * @param $matches Array
 929          * @return string
 930          */
 931         private static function armorLinksCallback( $matches ) {
 932                 return str_replace( ':', '&#58;', $matches[1] );
 933         }
 934
 935         /**
 936          * Return an associative array of attribute names and values from
 937          * a partial tag string. Attribute names are forces to lowercase,
 938          * character references are decoded to UTF-8 text.
 939          *
 940          * @param $text String
 941          * @return Array
 942          */
 943         public static function decodeTagAttributes( $text ) {
 944                 if( trim( $text ) == '' ) {
 945                         return array();
 946                 }
 947
 948                 $attribs = array();
 949                 $pairs = array();
 950                 if( !preg_match_all(
 951                         MW_ATTRIBS_REGEX,
 952                         $text,
 953                         $pairs,
 954                         PREG_SET_ORDER ) ) {
 955                         return $attribs;
 956                 }
 957
 958                 foreach( $pairs as $set ) {
 959                         $attribute = strtolower( $set[1] );
 960                         $value = Sanitizer::getTagAttributeCallback( $set );
 961
 962                         // Normalize whitespace
 963                         $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
 964                         $value = trim( $value );
 965
 966                         // Decode character references
 967                         $attribs[$attribute] = Sanitizer::decodeCharReferences( $value );
 968                 }
 969                 return $attribs;
 970         }
 971
 972         /**
 973          * Pick the appropriate attribute value from a match set from the
 974          * MW_ATTRIBS_REGEX matches.
 975          *
 976          * @param $set Array
 977          * @return String
 978          */
 979         private static function getTagAttributeCallback( $set ) {
 980                 if( isset( $set[6] ) ) {
 981                         # Illegal #XXXXXX color with no quotes.
 982                         return $set[6];
 983                 } elseif( isset( $set[5] ) ) {
 984                         # No quotes.
 985                         return $set[5];
 986                 } elseif( isset( $set[4] ) ) {
 987                         # Single-quoted
 988                         return $set[4];
 989                 } elseif( isset( $set[3] ) ) {
 990                         # Double-quoted
 991                         return $set[3];
 992                 } elseif( !isset( $set[2] ) ) {
 993                         # In XHTML, attributes must have a value.
 994                         # For 'reduced' form, return explicitly the attribute name here.
 995                         return $set[1];
 996                 } else {
 997                         throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
 998                 }
 999         }
1000
1001         /**
1002          * Normalize whitespace and character references in an XML source-
1003          * encoded text for an attribute value.
1004          *
1005          * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
1006          * but note that we're not returning the value, but are returning
1007          * XML source fragments that will be slapped into output.
1008          *
1009          * @param $text String
1010          * @return String
1011          */
1012         private static function normalizeAttributeValue( $text ) {
1013                 return str_replace( '"', '&quot;',
1014                         self::normalizeWhitespace(
1015                                 Sanitizer::normalizeCharReferences( $text ) ) );
1016         }
1017
1018         private static function normalizeWhitespace( $text ) {
1019                 return preg_replace(
1020                         '/\r\n|[\x20\x0d\x0a\x09]/',
1021                         ' ',
1022                         $text );
1023         }
1024
1025         /**
1026          * Ensure that any entities and character references are legal
1027          * for XML and XHTML specifically. Any stray bits will be
1028          * &amp;-escaped to result in a valid text fragment.
1029          *
1030          * a. any named char refs must be known in XHTML
1031          * b. any numeric char refs must be legal chars, not invalid or forbidden
1032          * c. use &#x, not &#X
1033          * d. fix or reject non-valid attributes
1034          *
1035          * @param $text String
1036          * @return String
1037          * @private
1038          */
1039         static function normalizeCharReferences( $text ) {
1040                 return preg_replace_callback(
1041                         MW_CHAR_REFS_REGEX,
1042                         array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
1043                         $text );
1044         }
1045         /**
1046          * @param $matches String
1047          * @return String
1048          */
1049         static function normalizeCharReferencesCallback( $matches ) {
1050                 $ret = null;
1051                 if( $matches[1] != '' ) {
1052                         $ret = Sanitizer::normalizeEntity( $matches[1] );
1053                 } elseif( $matches[2] != '' ) {
1054                         $ret = Sanitizer::decCharReference( $matches[2] );
1055                 } elseif( $matches[3] != ''  ) {
1056                         $ret = Sanitizer::hexCharReference( $matches[3] );
1057                 } elseif( $matches[4] != '' ) {
1058                         $ret = Sanitizer::hexCharReference( $matches[4] );
1059                 }
1060                 if( is_null( $ret ) ) {
1061                         return htmlspecialchars( $matches[0] );
1062                 } else {
1063                         return $ret;
1064                 }
1065         }
1066
1067         /**
1068          * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1069          * return the named entity reference as is. If the entity is a
1070          * MediaWiki-specific alias, returns the HTML equivalent. Otherwise,
1071          * returns HTML-escaped text of pseudo-entity source (eg &amp;foo;)
1072          *
1073          * @param $name String
1074          * @return String
1075          */
1076         static function normalizeEntity( $name ) {
1077                 global $wgHtmlEntities, $wgHtmlEntityAliases;
1078                 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1079                         return "&{$wgHtmlEntityAliases[$name]};";
1080                 } elseif( isset( $wgHtmlEntities[$name] ) ) {
1081                         return "&$name;";
1082                 } else {
1083                         return "&amp;$name;";
1084                 }
1085         }
1086
1087         static function decCharReference( $codepoint ) {
1088                 $point = intval( $codepoint );
1089                 if( Sanitizer::validateCodepoint( $point ) ) {
1090                         return sprintf( '&#%d;', $point );
1091                 } else {
1092                         return null;
1093                 }
1094         }
1095
1096         static function hexCharReference( $codepoint ) {
1097                 $point = hexdec( $codepoint );
1098                 if( Sanitizer::validateCodepoint( $point ) ) {
1099                         return sprintf( '&#x%x;', $point );
1100                 } else {
1101                         return null;
1102                 }
1103         }
1104
1105         /**
1106          * Returns true if a given Unicode codepoint is a valid character in XML.
1107          * @param $codepoint Integer
1108          * @return Boolean
1109          */
1110         private static function validateCodepoint( $codepoint ) {
1111                 return ($codepoint ==    0x09)
1112                         || ($codepoint ==    0x0a)
1113                         || ($codepoint ==    0x0d)
1114                         || ($codepoint >=    0x20 && $codepoint <=   0xd7ff)
1115                         || ($codepoint >=  0xe000 && $codepoint <=   0xfffd)
1116                         || ($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
1117         }
1118
1119         /**
1120          * Decode any character references, numeric or named entities,
1121          * in the text and return a UTF-8 string.
1122          *
1123          * @param $text String
1124          * @return String
1125          */
1126         public static function decodeCharReferences( $text ) {
1127                 return preg_replace_callback(
1128                         MW_CHAR_REFS_REGEX,
1129                         array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1130                         $text );
1131         }
1132
1133         /**
1134          * @param $matches String
1135          * @return String
1136          */
1137         static function decodeCharReferencesCallback( $matches ) {
1138                 if( $matches[1] != '' ) {
1139                         return Sanitizer::decodeEntity( $matches[1] );
1140                 } elseif( $matches[2] != '' ) {
1141                         return  Sanitizer::decodeChar( intval( $matches[2] ) );
1142                 } elseif( $matches[3] != ''  ) {
1143                         return  Sanitizer::decodeChar( hexdec( $matches[3] ) );
1144                 } elseif( $matches[4] != '' ) {
1145                         return  Sanitizer::decodeChar( hexdec( $matches[4] ) );
1146                 }
1147                 # Last case should be an ampersand by itself
1148                 return $matches[0];
1149         }
1150
1151         /**
1152          * Return UTF-8 string for a codepoint if that is a valid
1153          * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
1154          * @param $codepoint Integer
1155          * @return String
1156          * @private
1157          */
1158         static function decodeChar( $codepoint ) {
1159                 if( Sanitizer::validateCodepoint( $codepoint ) ) {
1160                         return codepointToUtf8( $codepoint );
1161                 } else {
1162                         return UTF8_REPLACEMENT;
1163                 }
1164         }
1165
1166         /**
1167          * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1168          * return the UTF-8 encoding of that character. Otherwise, returns
1169          * pseudo-entity source (eg &foo;)
1170          *
1171          * @param $name Strings
1172          * @return String
1173          */
1174         static function decodeEntity( $name ) {
1175                 global $wgHtmlEntities, $wgHtmlEntityAliases;
1176                 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1177                         $name = $wgHtmlEntityAliases[$name];
1178                 }
1179                 if( isset( $wgHtmlEntities[$name] ) ) {
1180                         return codepointToUtf8( $wgHtmlEntities[$name] );
1181                 } else {
1182                         return "&$name;";
1183                 }
1184         }
1185
1186         /**
1187          * Fetch the whitelist of acceptable attributes for a given element name.
1188          *
1189          * @param $element String
1190          * @return Array
1191          */
1192         static function attributeWhitelist( $element ) {
1193                 static $list;
1194                 if( !isset( $list ) ) {
1195                         $list = Sanitizer::setupAttributeWhitelist();
1196                 }
1197                 return isset( $list[$element] )
1198                         ? $list[$element]
1199                         : array();
1200         }
1201
1202         /**
1203          * Foreach array key (an allowed HTML element), return an array
1204          * of allowed attributes
1205          * @return Array
1206          */
1207         static function setupAttributeWhitelist() {
1208                 global $wgAllowRdfaAttributes, $wgHtml5, $wgAllowMicrodataAttributes;
1209
1210                 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style', 'xml:lang' );
1211
1212                 if ( $wgAllowRdfaAttributes ) {
1213                         #RDFa attributes as specified in section 9 of http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1214                         $common = array_merge( $common, array(
1215                             'about', 'property', 'resource', 'datatype', 'typeof',
1216                         ) );
1217                 }
1218
1219                 if ( $wgHtml5 && $wgAllowMicrodataAttributes ) {
1220                         # add HTML5 microdata tages as pecified by http://www.whatwg.org/specs/web-apps/current-work/multipage/microdata.html#the-microdata-model
1221                         $common = array_merge( $common, array(
1222                             'itemid', 'itemprop', 'itemref', 'itemscope', 'itemtype'
1223                         ) );
1224                 }
1225
1226                 $block = array_merge( $common, array( 'align' ) );
1227                 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1228                 $tablecell = array( 'abbr',
1229                                     'axis',
1230                                     'headers',
1231                                     'scope',
1232                                     'rowspan',
1233                                     'colspan',
1234                                     'nowrap', # deprecated
1235                                     'width',  # deprecated
1236                                     'height', # deprecated
1237                                     'bgcolor' # deprecated
1238                                     );
1239
1240                 # Numbers refer to sections in HTML 4.01 standard describing the element.
1241                 # See: http://www.w3.org/TR/html4/
1242                 $whitelist = array (
1243                         # 7.5.4
1244                         'div'        => $block,
1245                         'center'     => $common, # deprecated
1246                         'span'       => $block, # ??
1247
1248                         # 7.5.5
1249                         'h1'         => $block,
1250                         'h2'         => $block,
1251                         'h3'         => $block,
1252                         'h4'         => $block,
1253                         'h5'         => $block,
1254                         'h6'         => $block,
1255
1256                         # 7.5.6
1257                         # address
1258
1259                         # 8.2.4
1260                         # bdo
1261
1262                         # 9.2.1
1263                         'em'         => $common,
1264                         'strong'     => $common,
1265                         'cite'       => $common,
1266                         # dfn
1267                         'code'       => $common,
1268                         # samp
1269                         # kbd
1270                         'var'        => $common,
1271                         'abbr'       => $common,
1272                         # acronym
1273
1274                         # 9.2.2
1275                         'blockquote' => array_merge( $common, array( 'cite' ) ),
1276                         # q
1277
1278                         # 9.2.3
1279                         'sub'        => $common,
1280                         'sup'        => $common,
1281
1282                         # 9.3.1
1283                         'p'          => $block,
1284
1285                         # 9.3.2
1286                         'br'         => array( 'id', 'class', 'title', 'style', 'clear' ),
1287
1288                         # 9.3.4
1289                         'pre'        => array_merge( $common, array( 'width' ) ),
1290
1291                         # 9.4
1292                         'ins'        => array_merge( $common, array( 'cite', 'datetime' ) ),
1293                         'del'        => array_merge( $common, array( 'cite', 'datetime' ) ),
1294
1295                         # 10.2
1296                         'ul'         => array_merge( $common, array( 'type' ) ),
1297                         'ol'         => array_merge( $common, array( 'type', 'start' ) ),
1298                         'li'         => array_merge( $common, array( 'type', 'value' ) ),
1299
1300                         # 10.3
1301                         'dl'         => $common,
1302                         'dd'         => $common,
1303                         'dt'         => $common,
1304
1305                         # 11.2.1
1306                         'table'      => array_merge( $common,
1307                                                                 array( 'summary', 'width', 'border', 'frame',
1308                                                                                 'rules', 'cellspacing', 'cellpadding',
1309                                                                                 'align', 'bgcolor',
1310                                                                 ) ),
1311
1312                         # 11.2.2
1313                         'caption'    => array_merge( $common, array( 'align' ) ),
1314
1315                         # 11.2.3
1316                         'thead'      => array_merge( $common, $tablealign ),
1317                         'tfoot'      => array_merge( $common, $tablealign ),
1318                         'tbody'      => array_merge( $common, $tablealign ),
1319
1320                         # 11.2.4
1321                         'colgroup'   => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1322                         'col'        => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1323
1324                         # 11.2.5
1325                         'tr'         => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1326
1327                         # 11.2.6
1328                         'td'         => array_merge( $common, $tablecell, $tablealign ),
1329                         'th'         => array_merge( $common, $tablecell, $tablealign ),
1330
1331                         # 12.2 # NOTE: <a> is not allowed directly, but the attrib whitelist is used from the Parser object
1332                         'a'          => array_merge( $common, array( 'href', 'rel', 'rev' ) ), # rel/rev esp. for RDFa
1333
1334                         # 13.2
1335                         # Not usually allowed, but may be used for extension-style hooks
1336                         # such as <math> when it is rasterized
1337                         'img'        => array_merge( $common, array( 'alt' ) ),
1338
1339                         # 15.2.1
1340                         'tt'         => $common,
1341                         'b'          => $common,
1342                         'i'          => $common,
1343                         'big'        => $common,
1344                         'small'      => $common,
1345                         'strike'     => $common,
1346                         's'          => $common,
1347                         'u'          => $common,
1348
1349                         # 15.2.2
1350                         'font'       => array_merge( $common, array( 'size', 'color', 'face' ) ),
1351                         # basefont
1352
1353                         # 15.3
1354                         'hr'         => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1355
1356                         # XHTML Ruby annotation text module, simple ruby only.
1357                         # http://www.w3c.org/TR/ruby/
1358                         'ruby'       => $common,
1359                         # rbc
1360                         # rtc
1361                         'rb'         => $common,
1362                         'rt'         => $common, #array_merge( $common, array( 'rbspan' ) ),
1363                         'rp'         => $common,
1364
1365                         # MathML root element, where used for extensions
1366                         # 'title' may not be 100% valid here; it's XHTML
1367                         # http://www.w3.org/TR/REC-MathML/
1368                         'math'       => array( 'class', 'style', 'id', 'title' ),
1369                         );
1370                 return $whitelist;
1371         }
1372
1373         /**
1374          * Take a fragment of (potentially invalid) HTML and return
1375          * a version with any tags removed, encoded as plain text.
1376          *
1377          * Warning: this return value must be further escaped for literal
1378          * inclusion in HTML output as of 1.10!
1379          *
1380          * @param $text String: HTML fragment
1381          * @return String
1382          */
1383         static function stripAllTags( $text ) {
1384                 # Actual <tags>
1385                 $text = StringUtils::delimiterReplace( '<', '>', '', $text );
1386
1387                 # Normalize &entities and whitespace
1388                 $text = self::decodeCharReferences( $text );
1389                 $text = self::normalizeWhitespace( $text );
1390
1391                 return $text;
1392         }
1393
1394         /**
1395          * Hack up a private DOCTYPE with HTML's standard entity declarations.
1396          * PHP 4 seemed to know these if you gave it an HTML doctype, but
1397          * PHP 5.1 doesn't.
1398          *
1399          * Use for passing XHTML fragments to PHP's XML parsing functions
1400          *
1401          * @return String
1402          */
1403         static function hackDocType() {
1404                 global $wgHtmlEntities;
1405                 $out = "<!DOCTYPE html [\n";
1406                 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1407                         $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1408                 }
1409                 $out .= "]>\n";
1410                 return $out;
1411         }
1412
1413         static function cleanUrl( $url ) {
1414                 # Normalize any HTML entities in input. They will be
1415                 # re-escaped by makeExternalLink().
1416                 $url = Sanitizer::decodeCharReferences( $url );
1417
1418                 # Escape any control characters introduced by the above step
1419                 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F]/e', "urlencode('\\0')", $url );
1420
1421                 # Validate hostname portion
1422                 $matches = array();
1423                 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1424                         list( /* $whole */, $protocol, $host, $rest ) = $matches;
1425
1426                         // Characters that will be ignored in IDNs.
1427                         // http://tools.ietf.org/html/3454#section-3.1
1428                         // Strip them before further processing so blacklists and such work.
1429                         $strip = "/
1430                                 \\s|          # general whitespace
1431                                 \xc2\xad|     # 00ad SOFT HYPHEN
1432                                 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1433                                 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1434                                 \xe2\x81\xa0| # 2060 WORD JOINER
1435                                 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1436                                 \xcd\x8f|     # 034f COMBINING GRAPHEME JOINER
1437                                 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1438                                 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1439                                 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1440                                 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1441                                 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1442                                 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1443                                 /xuD";
1444
1445                         $host = preg_replace( $strip, '', $host );
1446
1447                         // @todo Fixme: validate hostnames here
1448
1449                         return $protocol . $host . $rest;
1450                 } else {
1451                         return $url;
1452                 }
1453         }
1454
1455 }