includes/Sanitizer.php

   1 <?php
   2 /**
   3  * XHTML sanitizer for MediaWiki
   4  *
   5  * Copyright (C) 2002-2005 Brion Vibber <brion@pobox.com> et al
   6  * http://www.mediawiki.org/
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along
  19  * with this program; if not, write to the Free Software Foundation, Inc.,
  20  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  21  * http://www.gnu.org/copyleft/gpl.html
  22  *
  23  * @file
  24  * @ingroup Parser
  25  */
  26
  27 /**
  28  * Regular expression to match various types of character references in
  29  * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
  30  */
  31 define( 'MW_CHAR_REFS_REGEX',
  32         '/&([A-Za-z0-9\x80-\xff]+);
  33          |&\#([0-9]+);
  34          |&\#x([0-9A-Za-z]+);
  35          |&\#X([0-9A-Za-z]+);
  36          |(&)/x' );
  37
  38 /**
  39  * Regular expression to match HTML/XML attribute pairs within a tag.
  40  * Allows some... latitude.
  41  * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
  42  */
  43 $attrib = '[A-Za-z0-9]';
  44 $space = '[\x09\x0a\x0d\x20]';
  45 define( 'MW_ATTRIBS_REGEX',
  46         "/(?:^|$space)((?:xml:|xmlns:)?$attrib+)
  47           ($space*=$space*
  48                 (?:
  49                  # The attribute value: quoted or alone
  50                   \"([^<\"]*)\"
  51                  | '([^<']*)'
  52                  |  ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
  53                  |  (\#[0-9a-fA-F]+) # Technically wrong, but lots of
  54                                                          # colors are specified like this.
  55                                                          # We'll be normalizing it.
  56                 )
  57            )?(?=$space|\$)/sx" );
  58
  59 /**
  60  * Regular expression to match URIs that could trigger script execution
  61  */
  62 define( 'MW_EVIL_URI_PATTERN', '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i' );
  63
  64 /**
  65  * Regular expression to match namespace attributes
  66  */
  67 define( 'MW_XMLNS_ATTRIBUTE_PATTRN', "/^xmlns:$attrib+$/" );
  68
  69 /**
  70  * List of all named character entities defined in HTML 4.01
  71  * http://www.w3.org/TR/html4/sgml/entities.html
  72  * @private
  73  */
  74 global $wgHtmlEntities;
  75 $wgHtmlEntities = array(
  76         'Aacute'   => 193,
  77         'aacute'   => 225,
  78         'Acirc'    => 194,
  79         'acirc'    => 226,
  80         'acute'    => 180,
  81         'AElig'    => 198,
  82         'aelig'    => 230,
  83         'Agrave'   => 192,
  84         'agrave'   => 224,
  85         'alefsym'  => 8501,
  86         'Alpha'    => 913,
  87         'alpha'    => 945,
  88         'amp'      => 38,
  89         'and'      => 8743,
  90         'ang'      => 8736,
  91         'Aring'    => 197,
  92         'aring'    => 229,
  93         'asymp'    => 8776,
  94         'Atilde'   => 195,
  95         'atilde'   => 227,
  96         'Auml'     => 196,
  97         'auml'     => 228,
  98         'bdquo'    => 8222,
  99         'Beta'     => 914,
 100         'beta'     => 946,
 101         'brvbar'   => 166,
 102         'bull'     => 8226,
 103         'cap'      => 8745,
 104         'Ccedil'   => 199,
 105         'ccedil'   => 231,
 106         'cedil'    => 184,
 107         'cent'     => 162,
 108         'Chi'      => 935,
 109         'chi'      => 967,
 110         'circ'     => 710,
 111         'clubs'    => 9827,
 112         'cong'     => 8773,
 113         'copy'     => 169,
 114         'crarr'    => 8629,
 115         'cup'      => 8746,
 116         'curren'   => 164,
 117         'dagger'   => 8224,
 118         'Dagger'   => 8225,
 119         'darr'     => 8595,
 120         'dArr'     => 8659,
 121         'deg'      => 176,
 122         'Delta'    => 916,
 123         'delta'    => 948,
 124         'diams'    => 9830,
 125         'divide'   => 247,
 126         'Eacute'   => 201,
 127         'eacute'   => 233,
 128         'Ecirc'    => 202,
 129         'ecirc'    => 234,
 130         'Egrave'   => 200,
 131         'egrave'   => 232,
 132         'empty'    => 8709,
 133         'emsp'     => 8195,
 134         'ensp'     => 8194,
 135         'Epsilon'  => 917,
 136         'epsilon'  => 949,
 137         'equiv'    => 8801,
 138         'Eta'      => 919,
 139         'eta'      => 951,
 140         'ETH'      => 208,
 141         'eth'      => 240,
 142         'Euml'     => 203,
 143         'euml'     => 235,
 144         'euro'     => 8364,
 145         'exist'    => 8707,
 146         'fnof'     => 402,
 147         'forall'   => 8704,
 148         'frac12'   => 189,
 149         'frac14'   => 188,
 150         'frac34'   => 190,
 151         'frasl'    => 8260,
 152         'Gamma'    => 915,
 153         'gamma'    => 947,
 154         'ge'       => 8805,
 155         'gt'       => 62,
 156         'harr'     => 8596,
 157         'hArr'     => 8660,
 158         'hearts'   => 9829,
 159         'hellip'   => 8230,
 160         'Iacute'   => 205,
 161         'iacute'   => 237,
 162         'Icirc'    => 206,
 163         'icirc'    => 238,
 164         'iexcl'    => 161,
 165         'Igrave'   => 204,
 166         'igrave'   => 236,
 167         'image'    => 8465,
 168         'infin'    => 8734,
 169         'int'      => 8747,
 170         'Iota'     => 921,
 171         'iota'     => 953,
 172         'iquest'   => 191,
 173         'isin'     => 8712,
 174         'Iuml'     => 207,
 175         'iuml'     => 239,
 176         'Kappa'    => 922,
 177         'kappa'    => 954,
 178         'Lambda'   => 923,
 179         'lambda'   => 955,
 180         'lang'     => 9001,
 181         'laquo'    => 171,
 182         'larr'     => 8592,
 183         'lArr'     => 8656,
 184         'lceil'    => 8968,
 185         'ldquo'    => 8220,
 186         'le'       => 8804,
 187         'lfloor'   => 8970,
 188         'lowast'   => 8727,
 189         'loz'      => 9674,
 190         'lrm'      => 8206,
 191         'lsaquo'   => 8249,
 192         'lsquo'    => 8216,
 193         'lt'       => 60,
 194         'macr'     => 175,
 195         'mdash'    => 8212,
 196         'micro'    => 181,
 197         'middot'   => 183,
 198         'minus'    => 8722,
 199         'Mu'       => 924,
 200         'mu'       => 956,
 201         'nabla'    => 8711,
 202         'nbsp'     => 160,
 203         'ndash'    => 8211,
 204         'ne'       => 8800,
 205         'ni'       => 8715,
 206         'not'      => 172,
 207         'notin'    => 8713,
 208         'nsub'     => 8836,
 209         'Ntilde'   => 209,
 210         'ntilde'   => 241,
 211         'Nu'       => 925,
 212         'nu'       => 957,
 213         'Oacute'   => 211,
 214         'oacute'   => 243,
 215         'Ocirc'    => 212,
 216         'ocirc'    => 244,
 217         'OElig'    => 338,
 218         'oelig'    => 339,
 219         'Ograve'   => 210,
 220         'ograve'   => 242,
 221         'oline'    => 8254,
 222         'Omega'    => 937,
 223         'omega'    => 969,
 224         'Omicron'  => 927,
 225         'omicron'  => 959,
 226         'oplus'    => 8853,
 227         'or'       => 8744,
 228         'ordf'     => 170,
 229         'ordm'     => 186,
 230         'Oslash'   => 216,
 231         'oslash'   => 248,
 232         'Otilde'   => 213,
 233         'otilde'   => 245,
 234         'otimes'   => 8855,
 235         'Ouml'     => 214,
 236         'ouml'     => 246,
 237         'para'     => 182,
 238         'part'     => 8706,
 239         'permil'   => 8240,
 240         'perp'     => 8869,
 241         'Phi'      => 934,
 242         'phi'      => 966,
 243         'Pi'       => 928,
 244         'pi'       => 960,
 245         'piv'      => 982,
 246         'plusmn'   => 177,
 247         'pound'    => 163,
 248         'prime'    => 8242,
 249         'Prime'    => 8243,
 250         'prod'     => 8719,
 251         'prop'     => 8733,
 252         'Psi'      => 936,
 253         'psi'      => 968,
 254         'quot'     => 34,
 255         'radic'    => 8730,
 256         'rang'     => 9002,
 257         'raquo'    => 187,
 258         'rarr'     => 8594,
 259         'rArr'     => 8658,
 260         'rceil'    => 8969,
 261         'rdquo'    => 8221,
 262         'real'     => 8476,
 263         'reg'      => 174,
 264         'rfloor'   => 8971,
 265         'Rho'      => 929,
 266         'rho'      => 961,
 267         'rlm'      => 8207,
 268         'rsaquo'   => 8250,
 269         'rsquo'    => 8217,
 270         'sbquo'    => 8218,
 271         'Scaron'   => 352,
 272         'scaron'   => 353,
 273         'sdot'     => 8901,
 274         'sect'     => 167,
 275         'shy'      => 173,
 276         'Sigma'    => 931,
 277         'sigma'    => 963,
 278         'sigmaf'   => 962,
 279         'sim'      => 8764,
 280         'spades'   => 9824,
 281         'sub'      => 8834,
 282         'sube'     => 8838,
 283         'sum'      => 8721,
 284         'sup'      => 8835,
 285         'sup1'     => 185,
 286         'sup2'     => 178,
 287         'sup3'     => 179,
 288         'supe'     => 8839,
 289         'szlig'    => 223,
 290         'Tau'      => 932,
 291         'tau'      => 964,
 292         'there4'   => 8756,
 293         'Theta'    => 920,
 294         'theta'    => 952,
 295         'thetasym' => 977,
 296         'thinsp'   => 8201,
 297         'THORN'    => 222,
 298         'thorn'    => 254,
 299         'tilde'    => 732,
 300         'times'    => 215,
 301         'trade'    => 8482,
 302         'Uacute'   => 218,
 303         'uacute'   => 250,
 304         'uarr'     => 8593,
 305         'uArr'     => 8657,
 306         'Ucirc'    => 219,
 307         'ucirc'    => 251,
 308         'Ugrave'   => 217,
 309         'ugrave'   => 249,
 310         'uml'      => 168,
 311         'upsih'    => 978,
 312         'Upsilon'  => 933,
 313         'upsilon'  => 965,
 314         'Uuml'     => 220,
 315         'uuml'     => 252,
 316         'weierp'   => 8472,
 317         'Xi'       => 926,
 318         'xi'       => 958,
 319         'Yacute'   => 221,
 320         'yacute'   => 253,
 321         'yen'      => 165,
 322         'Yuml'     => 376,
 323         'yuml'     => 255,
 324         'Zeta'     => 918,
 325         'zeta'     => 950,
 326         'zwj'      => 8205,
 327         'zwnj'     => 8204 );
 328
 329 /**
 330  * Character entity aliases accepted by MediaWiki
 331  */
 332 global $wgHtmlEntityAliases;
 333 $wgHtmlEntityAliases = array(
 334         'רלמ' => 'rlm',
 335         'رلم' => 'rlm',
 336 );
 337
 338
 339 /**
 340  * XHTML sanitizer for MediaWiki
 341  * @ingroup Parser
 342  */
 343 class Sanitizer {
 344         /**
 345          * Cleans up HTML, removes dangerous tags and attributes, and
 346          * removes HTML comments
 347          * @private
 348          * @param $text String
 349          * @param $processCallback Callback to do any variable or parameter replacements in HTML attribute values
 350          * @param $args Array for the processing callback
 351          * @param $extratags Array for any extra tags to include
 352          * @param $removetags Array for any tags (default or extra) to exclude
 353          * @return string
 354          */
 355         static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array(), $removetags = array() ) {
 356                 global $wgUseTidy;
 357
 358                 static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
 359                         $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
 360
 361                 wfProfileIn( __METHOD__ );
 362
 363                 if ( !$staticInitialised ) {
 364
 365                         $htmlpairsStatic = array( # Tags that must be closed
 366                                 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
 367                                 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
 368                                 'strike', 'strong', 'tt', 'var', 'div', 'center',
 369                                 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
 370                                 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u', 'abbr', 'dfn'
 371                         );
 372                         $htmlsingle = array(
 373                                 'br', 'hr', 'li', 'dt', 'dd'
 374                         );
 375                         $htmlsingleonly = array( # Elements that cannot have close tags
 376                                 'br', 'hr'
 377                         );
 378                         $htmlnest = array( # Tags that can be nested--??
 379                                 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
 380                                 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
 381                         );
 382                         $tabletags = array( # Can only appear inside table, we will close them
 383                                 'td', 'th', 'tr',
 384                         );
 385                         $htmllist = array( # Tags used by list
 386                                 'ul','ol',
 387                         );
 388                         $listtags = array( # Tags that can appear in a list
 389                                 'li',
 390                         );
 391
 392                         global $wgAllowImageTag;
 393                         if ( $wgAllowImageTag ) {
 394                                 $htmlsingle[] = 'img';
 395                                 $htmlsingleonly[] = 'img';
 396                         }
 397
 398                         $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
 399                         $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
 400
 401                         # Convert them all to hashtables for faster lookup
 402                         $vars = array( 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
 403                                 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' );
 404                         foreach ( $vars as $var ) {
 405                                 $$var = array_flip( $$var );
 406                         }
 407                         $staticInitialised = true;
 408                 }
 409                 # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
 410                 $extratags = array_flip( $extratags );
 411                 $removetags = array_flip( $removetags );
 412                 $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
 413                 $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ) , $removetags );
 414
 415                 # Remove HTML comments
 416                 $text = Sanitizer::removeHTMLcomments( $text );
 417                 $bits = explode( '<', $text );
 418                 $text = str_replace( '>', '&gt;', array_shift( $bits ) );
 419                 if ( !$wgUseTidy ) {
 420                         $tagstack = $tablestack = array();
 421                         foreach ( $bits as $x ) {
 422                                 $regs = array();
 423                                 # $slash: Does the current element start with a '/'?
 424                                 # $t: Current element name
 425                                 # $params: String between element name and >
 426                                 # $brace: Ending '>' or '/>'
 427                                 # $rest: Everything until the next element of $bits
 428                                 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
 429                                         list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
 430                                 } else {
 431                                         $slash = $t = $params = $brace = $rest = null;
 432                                 }
 433
 434                                 $badtag = false;
 435                                 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
 436                                         # Check our stack
 437                                         if ( $slash && isset( $htmlsingleonly[$t] ) ) {
 438                                                 $badtag = true;
 439                                         } elseif ( $slash ) {
 440                                                 # Closing a tag... is it the one we just opened?
 441                                                 $ot = @array_pop( $tagstack );
 442                                                 if ( $ot != $t ) {
 443                                                         if ( isset( $htmlsingleallowed[$ot] ) ) {
 444                                                                 # Pop all elements with an optional close tag
 445                                                                 # and see if we find a match below them
 446                                                                 $optstack = array();
 447                                                                 array_push( $optstack, $ot );
 448                                                                 $ot = @array_pop( $tagstack );
 449                                                                 while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
 450                                                                         array_push( $optstack, $ot );
 451                                                                         $ot = @array_pop( $tagstack );
 452                                                                 }
 453                                                                 if ( $t != $ot ) {
 454                                                                         # No match. Push the optional elements back again
 455                                                                         $badtag = true;
 456                                                                         while ( $ot = @array_pop( $optstack ) ) {
 457                                                                                 array_push( $tagstack, $ot );
 458                                                                         }
 459                                                                 }
 460                                                         } else {
 461                                                                 @array_push( $tagstack, $ot );
 462                                                                 # <li> can be nested in <ul> or <ol>, skip those cases:
 463                                                                 if ( !isset( $htmllist[$ot] ) || !isset( $listtags[$t] ) ) {
 464                                                                         $badtag = true;
 465                                                                 }
 466                                                         }
 467                                                 } else {
 468                                                         if ( $t == 'table' ) {
 469                                                                 $tagstack = array_pop( $tablestack );
 470                                                         }
 471                                                 }
 472                                                 $newparams = '';
 473                                         } else {
 474                                                 # Keep track for later
 475                                                 if ( isset( $tabletags[$t] ) &&
 476                                                 !in_array( 'table', $tagstack ) ) {
 477                                                         $badtag = true;
 478                                                 } elseif ( in_array( $t, $tagstack ) &&
 479                                                 !isset( $htmlnest [$t ] ) ) {
 480                                                         $badtag = true;
 481                                                 # Is it a self closed htmlpair ? (bug 5487)
 482                                                 } elseif ( $brace == '/>' &&
 483                                                 isset( $htmlpairs[$t] ) ) {
 484                                                         $badtag = true;
 485                                                 } elseif ( isset( $htmlsingleonly[$t] ) ) {
 486                                                         # Hack to force empty tag for uncloseable elements
 487                                                         $brace = '/>';
 488                                                 } elseif ( isset( $htmlsingle[$t] ) ) {
 489                                                         # Hack to not close $htmlsingle tags
 490                                                         $brace = null;
 491                                                 } elseif ( isset( $tabletags[$t] )
 492                                                 && in_array( $t, $tagstack ) ) {
 493                                                         // New table tag but forgot to close the previous one
 494                                                         $text .= "</$t>";
 495                                                 } else {
 496                                                         if ( $t == 'table' ) {
 497                                                                 array_push( $tablestack, $tagstack );
 498                                                                 $tagstack = array();
 499                                                         }
 500                                                         array_push( $tagstack, $t );
 501                                                 }
 502
 503                                                 # Replace any variables or template parameters with
 504                                                 # plaintext results.
 505                                                 if( is_callable( $processCallback ) ) {
 506                                                         call_user_func_array( $processCallback, array( &$params, $args ) );
 507                                                 }
 508
 509                                                 # Strip non-approved attributes from the tag
 510                                                 $newparams = Sanitizer::fixTagAttributes( $params, $t );
 511                                         }
 512                                         if ( !$badtag ) {
 513                                                 $rest = str_replace( '>', '&gt;', $rest );
 514                                                 $close = ( $brace == '/>' && !$slash ) ? ' /' : '';
 515                                                 $text .= "<$slash$t$newparams$close>$rest";
 516                                                 continue;
 517                                         }
 518                                 }
 519                                 $text .= '&lt;' . str_replace( '>', '&gt;', $x);
 520                         }
 521                         # Close off any remaining tags
 522                         while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
 523                                 $text .= "</$t>\n";
 524                                 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
 525                         }
 526                 } else {
 527                         # this might be possible using tidy itself
 528                         foreach ( $bits as $x ) {
 529                                 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
 530                                 $x, $regs );
 531                                 @list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
 532                                 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
 533                                         if( is_callable( $processCallback ) ) {
 534                                                 call_user_func_array( $processCallback, array( &$params, $args ) );
 535                                         }
 536                                         $newparams = Sanitizer::fixTagAttributes( $params, $t );
 537                                         $rest = str_replace( '>', '&gt;', $rest );
 538                                         $text .= "<$slash$t$newparams$brace$rest";
 539                                 } else {
 540                                         $text .= '&lt;' . str_replace( '>', '&gt;', $x);
 541                                 }
 542                         }
 543                 }
 544                 wfProfileOut( __METHOD__ );
 545                 return $text;
 546         }
 547
 548         /**
 549          * Remove '<!--', '-->', and everything between.
 550          * To avoid leaving blank lines, when a comment is both preceded
 551          * and followed by a newline (ignoring spaces), trim leading and
 552          * trailing spaces and one of the newlines.
 553          *
 554          * @private
 555          * @param $text String
 556          * @return string
 557          */
 558         static function removeHTMLcomments( $text ) {
 559                 wfProfileIn( __METHOD__ );
 560                 while (($start = strpos($text, '<!--')) !== false) {
 561                         $end = strpos($text, '-->', $start + 4);
 562                         if ($end === false) {
 563                                 # Unterminated comment; bail out
 564                                 break;
 565                         }
 566
 567                         $end += 3;
 568
 569                         # Trim space and newline if the comment is both
 570                         # preceded and followed by a newline
 571                         $spaceStart = max($start - 1, 0);
 572                         $spaceLen = $end - $spaceStart;
 573                         while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
 574                                 $spaceStart--;
 575                                 $spaceLen++;
 576                         }
 577                         while (substr($text, $spaceStart + $spaceLen, 1) === ' ')
 578                                 $spaceLen++;
 579                         if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart + $spaceLen, 1) === "\n") {
 580                                 # Remove the comment, leading and trailing
 581                                 # spaces, and leave only one newline.
 582                                 $text = substr_replace($text, "\n", $spaceStart, $spaceLen + 1);
 583                         }
 584                         else {
 585                                 # Remove just the comment.
 586                                 $text = substr_replace($text, '', $start, $end - $start);
 587                         }
 588                 }
 589                 wfProfileOut( __METHOD__ );
 590                 return $text;
 591         }
 592
 593         /**
 594          * Take an array of attribute names and values and normalize or discard
 595          * illegal values for the given element type.
 596          *
 597          * - Discards attributes not on a whitelist for the given element
 598          * - Unsafe style attributes are discarded
 599          * - Invalid id attributes are reencoded
 600          *
 601          * @param $attribs Array
 602          * @param $element String
 603          * @return Array
 604          *
 605          * @todo Check for legal values where the DTD limits things.
 606          * @todo Check for unique id attribute :P
 607          */
 608         static function validateTagAttributes( $attribs, $element ) {
 609                 return Sanitizer::validateAttributes( $attribs,
 610                         Sanitizer::attributeWhitelist( $element ) );
 611         }
 612
 613         /**
 614          * Take an array of attribute names and values and normalize or discard
 615          * illegal values for the given whitelist.
 616          *
 617          * - Discards attributes not the given whitelist
 618          * - Unsafe style attributes are discarded
 619          * - Invalid id attributes are reencoded
 620          *
 621          * @param $attribs Array
 622          * @param $whitelist Array: list of allowed attribute names
 623          * @return Array
 624          *
 625          * @todo Check for legal values where the DTD limits things.
 626          * @todo Check for unique id attribute :P
 627          */
 628         static function validateAttributes( $attribs, $whitelist ) {
 629                 global $wgAllowRdfaAttributes, $wgAllowMicrodataAttributes;
 630
 631                 $whitelist = array_flip( $whitelist );
 632                 $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
 633
 634                 $out = array();
 635                 foreach( $attribs as $attribute => $value ) {
 636                         #allow XML namespace declaration if RDFa is enabled
 637                         if ( $wgAllowRdfaAttributes && preg_match( MW_XMLNS_ATTRIBUTE_PATTRN, $attribute ) ) {
 638                                 if ( !preg_match( MW_EVIL_URI_PATTERN, $value ) ) {
 639                                         $out[$attribute] = $value;
 640                                 }
 641
 642                                 continue;
 643                         }
 644
 645                         if( !isset( $whitelist[$attribute] ) ) {
 646                                 continue;
 647                         }
 648
 649                         # Strip javascript "expression" from stylesheets.
 650                         # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
 651                         if( $attribute == 'style' ) {
 652                                 $value = Sanitizer::checkCss( $value );
 653                         }
 654
 655                         if ( $attribute === 'id' ) {
 656                                 $value = Sanitizer::escapeId( $value, 'noninitial' );
 657                         }
 658
 659                         //RDFa and microdata properties allow URLs, URIs and/or CURIs. check them for sanity
 660                         if ( $attribute === 'rel' || $attribute === 'rev' ||
 661                                 $attribute === 'about' || $attribute === 'property' || $attribute === 'resource' || #RDFa
 662                                 $attribute === 'datatype' || $attribute === 'typeof' ||                             #RDFa
 663                                 $attribute === 'itemid' || $attribute === 'itemprop' || $attribute === 'itemref' || #HTML5 microdata
 664                                 $attribute === 'itemscope' || $attribute === 'itemtype' ) {                         #HTML5 microdata
 665
 666                                 //Paranoia. Allow "simple" values but suppress javascript
 667                                 if ( preg_match( MW_EVIL_URI_PATTERN, $value ) ) {
 668                                         continue;
 669                                 }
 670                         }
 671
 672                         # NOTE: even though elements using href/src are not allowed directly, supply
 673                         #       validation code that can be used by tag hook handlers, etc
 674                         if ( $attribute === 'href' || $attribute === 'src' ) {
 675                                 if ( !preg_match( $hrefExp, $value ) ) {
 676                                         continue; //drop any href or src attributes not using an allowed protocol.
 677                                                   //NOTE: this also drops all relative URLs
 678                                 }
 679                         }
 680
 681                         // If this attribute was previously set, override it.
 682                         // Output should only have one attribute of each name.
 683                         $out[$attribute] = $value;
 684                 }
 685
 686                 if ( $wgAllowMicrodataAttributes ) {
 687                         # There are some complicated validity constraints we need to
 688                         # enforce here.  First of all, we don't want to allow non-standard
 689                         # itemtypes.
 690                         $allowedTypes = array(
 691                                 'http://microformats.org/profile/hcard',
 692                                 'http://microformats.org/profile/hcalendar#vevent',
 693                                 'http://n.whatwg.org/work',
 694                         );
 695                         if ( isset( $out['itemtype'] ) && !in_array( $out['itemtype'],
 696                         $allowedTypes ) ) {
 697                                 # Kill everything
 698                                 unset( $out['itemscope'] );
 699                         }
 700                         # itemtype, itemid, itemref don't make sense without itemscope
 701                         if ( !array_key_exists( 'itemscope', $out ) ) {
 702                                 unset( $out['itemtype'] );
 703                                 unset( $out['itemid'] );
 704                                 unset( $out['itemref'] );
 705                         }
 706                         # TODO: Strip itemprop if we aren't descendants of an itemscope.
 707                 }
 708                 return $out;
 709         }
 710
 711         /**
 712          * Merge two sets of HTML attributes.  Conflicting items in the second set
 713          * will override those in the first, except for 'class' attributes which
 714          * will be combined (if they're both strings).
 715          *
 716          * @todo implement merging for other attributes such as style
 717          * @param $a Array
 718          * @param $b Array
 719          * @return array
 720          */
 721         static function mergeAttributes( $a, $b ) {
 722                 $out = array_merge( $a, $b );
 723                 if( isset( $a['class'] ) && isset( $b['class'] )
 724                 && is_string( $a['class'] ) && is_string( $b['class'] )
 725                 && $a['class'] !== $b['class'] ) {
 726                         $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
 727                                 -1, PREG_SPLIT_NO_EMPTY );
 728                         $out['class'] = implode( ' ', array_unique( $classes ) );
 729                 }
 730                 return $out;
 731         }
 732
 733         /**
 734          * Pick apart some CSS and check it for forbidden or unsafe structures.
 735          * Returns a sanitized string, or false if it was just too evil.
 736          *
 737          * Currently URL references, 'expression', 'tps' are forbidden.
 738          *
 739          * @param $value String
 740          * @return Mixed
 741          */
 742         static function checkCss( $value ) {
 743                 $value = Sanitizer::decodeCharReferences( $value );
 744
 745                 // Remove any comments; IE gets token splitting wrong
 746                 $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value );
 747
 748                 // Decode escape sequences and line continuation
 749                 // See the grammar in the CSS 2 spec, appendix D.
 750                 static $decodeRegex, $reencodeTable;
 751                 if ( !$decodeRegex ) {
 752                         $space = '[\\x20\\t\\r\\n\\f]';
 753                         $nl = '(?:\\n|\\r\\n|\\r|\\f)';
 754                         $backslash = '\\\\';
 755                         $decodeRegex = "/ $backslash
 756                                 (?:
 757                                         ($nl) |  # 1. Line continuation
 758                                         ([0-9A-Fa-f]{1,6})$space? |  # 2. character number
 759                                         (.) | # 3. backslash cancelling special meaning
 760                                         () | # 4. backslash at end of string
 761                                 )/xu";
 762                 }
 763                 $value = preg_replace_callback( $decodeRegex,
 764                         array( __CLASS__, 'cssDecodeCallback' ), $value );
 765
 766                 // Reject problematic keywords and control characters
 767                 if ( preg_match( '/[\000-\010\016-\037\177]/', $value ) ) {
 768                         return '/* invalid control char */';
 769                 } elseif ( preg_match( '! expression | filter\s*: | accelerator\s*: | url\s*\( !ix', $value ) ) {
 770                         return '/* insecure input */';
 771                 }
 772                 return $value;
 773         }
 774
 775         static function cssDecodeCallback( $matches ) {
 776                 if ( $matches[1] !== '' ) {
 777                         // Line continuation
 778                         return '';
 779                 } elseif ( $matches[2] !== '' ) {
 780                         $char = codepointToUtf8( hexdec( $matches[2] ) );
 781                 } elseif ( $matches[3] !== '' ) {
 782                         $char = $matches[3];
 783                 } else {
 784                         $char = '\\';
 785                 }
 786                 if ( $char == "\n" || $char == '"' || $char == "'" || $char == '\\' ) {
 787                         // These characters need to be escaped in strings
 788                         // Clean up the escape sequence to avoid parsing errors by clients
 789                         return '\\' . dechex( ord( $char ) ) . ' ';
 790                 } else {
 791                         // Decode unnecessary escape
 792                         return $char;
 793                 }
 794         }
 795
 796         /**
 797         * Take an associative array of attribute name/value pairs
 798         * and generate a css style representing all the style-related
 799         * attributes. If there already a style attribute in the array,
 800         * it is also included in the value returned.
 801         */
 802         static function styleFromAttributes( $attributes ) {
 803                 $styles = array();
 804
 805                 foreach ( $attributes as $attribute => $value ) {
 806                         if ( $attribute == 'bgcolor' ) {
 807                                 $styles[] = "background-color: $value";
 808                         } else if ( $attribute == 'border' ) {
 809                                 $styles[] = "border-width: $value";
 810                         } else if ( $attribute == 'align' ) {
 811                                 $styles[] = "text-align: $value";
 812                         } else if ( $attribute == 'valign' ) {
 813                                 $styles[] = "vertical-align: $value";
 814                         } else if ( $attribute == 'width' ) {
 815                                 if ( preg_match( '/\d+/', $value ) === false ) {
 816                                       $value .= 'px';
 817                                 }
 818
 819                                 $styles[] = "width: $value";
 820                         } else if ( $attribute == 'height' ) {
 821                                 if ( preg_match( '/\d+/', $value ) === false ) {
 822                                       $value .= 'px';
 823                                 }
 824
 825                                 $styles[] = "height: $value";
 826                         } else if ( $attribute == 'nowrap' ) {
 827                                 if ( $value ) {
 828                                         $styles[] = "white-space: nowrap";
 829                                 }
 830                         }
 831                 }
 832
 833                 if ( isset( $attributes[ 'style' ] ) ) {
 834                         $styles[] = $attributes[ 'style' ];
 835                 }
 836
 837                 if ( !$styles ) return '';
 838                 else return implode( '; ', $styles );
 839         }
 840
 841         /**
 842          * Take a tag soup fragment listing an HTML element's attributes
 843          * and normalize it to well-formed XML, discarding unwanted attributes.
 844          * Output is safe for further wikitext processing, with escaping of
 845          * values that could trigger problems.
 846          *
 847          * - Normalizes attribute names to lowercase
 848          * - Discards attributes not on a whitelist for the given element
 849          * - Turns broken or invalid entities into plaintext
 850          * - Double-quotes all attribute values
 851          * - Attributes without values are given the name as attribute
 852          * - Double attributes are discarded
 853          * - Unsafe style attributes are discarded
 854          * - Prepends space if there are attributes.
 855          *
 856          * @param $text String
 857          * @param $element String
 858          * @param $defaults Array (optional) associative array of default attributes to splice in.
 859          *                      class and style attributes are combined. Otherwise, values from
 860          *                      $attributes take precedence over values from $defaults.
 861          * @return String
 862          */
 863         static function fixTagAttributes( $text, $element, $defaults = null ) {
 864                 if( trim( $text ) == '' ) {
 865                         return '';
 866                 }
 867
 868                 $decoded = Sanitizer::decodeTagAttributes( $text );
 869                 $stripped = Sanitizer::validateTagAttributes( $decoded, $element );
 870                 $attribs = Sanitizer::collapseTagAttributes( $stripped, $defaults );
 871
 872                 return $attribs;
 873         }
 874
 875         /**
 876          * Take an associative array or attribute name/value pairs
 877          * and collapses it to well-formed XML.
 878          * Does not filter attributes.
 879          * Output is safe for further wikitext processing, with escaping of
 880          * values that could trigger problems.
 881          *
 882          * - Double-quotes all attribute values
 883          * - Prepends space if there are attributes.
 884          *
 885          * @param $attributes Array is an associative array of attribute name/value pairs.
 886          *                      Assumed to be sanitized already.
 887          * @param $defaults Array (optional) associative array of default attributes to splice in.
 888          *                      class and style attributes are combined. Otherwise, values from
 889          *                      $attributes take precedence over values from $defaults.
 890          * @return String
 891          */
 892         static function collapseTagAttributes( $attributes, $defaults = null ) {
 893                 if ( $defaults ) {
 894                         foreach( $defaults as $attribute => $value ) {
 895                                 if ( isset( $attributes[ $attribute ] ) ) {
 896                                         if ( $attribute == 'class' ) {
 897                                                 $value .= ' '. $attributes[ $attribute ];
 898                                         } else if ( $attribute == 'style' ) {
 899                                                 $value .= '; ' . $attributes[ $attribute ];
 900                                         } else {
 901                                                 continue;
 902                                         }
 903                                 }
 904
 905                                 $attributes[ $attribute ] = $value;
 906                         }
 907                 }
 908
 909                 $chunks = array();
 910
 911                 foreach( $attributes as $attribute => $value ) {
 912                         $encAttribute = htmlspecialchars( $attribute );
 913                         $encValue = Sanitizer::safeEncodeAttribute( $value );
 914
 915                         $chunks[] = "$encAttribute=\"$encValue\"";
 916                 }
 917                 return count( $chunks ) ? ' ' . implode( ' ', $chunks ) : '';
 918         }
 919
 920         /**
 921          * Encode an attribute value for HTML output.
 922          * @param $text String
 923          * @return HTML-encoded text fragment
 924          */
 925         static function encodeAttribute( $text ) {
 926                 $encValue = htmlspecialchars( $text, ENT_QUOTES );
 927
 928                 // Whitespace is normalized during attribute decoding,
 929                 // so if we've been passed non-spaces we must encode them
 930                 // ahead of time or they won't be preserved.
 931                 $encValue = strtr( $encValue, array(
 932                         "\n" => '&#10;',
 933                         "\r" => '&#13;',
 934                         "\t" => '&#9;',
 935                 ) );
 936
 937                 return $encValue;
 938         }
 939
 940         /**
 941          * Encode an attribute value for HTML tags, with extra armoring
 942          * against further wiki processing.
 943          * @param $text String
 944          * @return HTML-encoded text fragment
 945          */
 946         static function safeEncodeAttribute( $text ) {
 947                 $encValue = Sanitizer::encodeAttribute( $text );
 948
 949                 # Templates and links may be expanded in later parsing,
 950                 # creating invalid or dangerous output. Suppress this.
 951                 $encValue = strtr( $encValue, array(
 952                         '<'    => '&lt;',   // This should never happen,
 953                         '>'    => '&gt;',   // we've received invalid input
 954                         '"'    => '&quot;', // which should have been escaped.
 955                         '{'    => '&#123;',
 956                         '['    => '&#91;',
 957                         "''"   => '&#39;&#39;',
 958                         'ISBN' => '&#73;SBN',
 959                         'RFC'  => '&#82;FC',
 960                         'PMID' => '&#80;MID',
 961                         '|'    => '&#124;',
 962                         '__'   => '&#95;_',
 963                 ) );
 964
 965                 # Stupid hack
 966                 $encValue = preg_replace_callback(
 967                         '/(' . wfUrlProtocols() . ')/',
 968                         array( 'Sanitizer', 'armorLinksCallback' ),
 969                         $encValue );
 970                 return $encValue;
 971         }
 972
 973         /**
 974          * Given a value, escape it so that it can be used in an id attribute and
 975          * return it.  This will use HTML5 validation if $wgExperimentalHtmlIds is
 976          * true, allowing anything but ASCII whitespace.  Otherwise it will use
 977          * HTML 4 rules, which means a narrow subset of ASCII, with bad characters
 978          * escaped with lots of dots.
 979          *
 980          * To ensure we don't have to bother escaping anything, we also strip ', ",
 981          * & even if $wgExperimentalIds is true.  TODO: Is this the best tactic?
 982          * We also strip # because it upsets IE6.
 983          *
 984          * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters
 985          *                                                          in the id and
 986          *                                                          name attributes
 987          * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
 988          * @see http://www.whatwg.org/specs/web-apps/current-work/multipage/elements.html#the-id-attribute
 989          *   HTML5 definition of id attribute
 990          *
 991          * @param $id String: id to escape
 992          * @param $options Mixed: string or array of strings (default is array()):
 993          *   'noninitial': This is a non-initial fragment of an id, not a full id,
 994          *       so don't pay attention if the first character isn't valid at the
 995          *       beginning of an id.  Only matters if $wgExperimentalHtmlIds is
 996          *       false.
 997          *   'legacy': Behave the way the old HTML 4-based ID escaping worked even
 998          *       if $wgExperimentalHtmlIds is used, so we can generate extra
 999          *       anchors and links won't break.
1000          * @return String
1001          */
1002         static function escapeId( $id, $options = array() ) {
1003                 global $wgHtml5, $wgExperimentalHtmlIds;
1004                 $options = (array)$options;
1005
1006                 if ( $wgHtml5 && $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) {
1007                         $id = Sanitizer::decodeCharReferences( $id );
1008                         $id = preg_replace( '/[ \t\n\r\f_\'"&#]+/', '_', $id );
1009                         $id = trim( $id, '_' );
1010                         if ( $id === '' ) {
1011                                 # Must have been all whitespace to start with.
1012                                 return '_';
1013                         } else {
1014                                 return $id;
1015                         }
1016                 }
1017
1018                 # HTML4-style escaping
1019                 static $replace = array(
1020                         '%3A' => ':',
1021                         '%' => '.'
1022                 );
1023
1024                 $id = urlencode( Sanitizer::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
1025                 $id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
1026
1027                 if ( !preg_match( '/^[a-zA-Z]/', $id )
1028                 && !in_array( 'noninitial', $options ) )  {
1029                         // Initial character must be a letter!
1030                         $id = "x$id";
1031                 }
1032                 return $id;
1033         }
1034
1035         /**
1036          * Given a value, escape it so that it can be used as a CSS class and
1037          * return it.
1038          *
1039          * @todo For extra validity, input should be validated UTF-8.
1040          *
1041          * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
1042          *
1043          * @param $class String
1044          * @return String
1045          */
1046         static function escapeClass( $class ) {
1047                 // Convert ugly stuff to underscores and kill underscores in ugly places
1048                 return rtrim(preg_replace(
1049                         array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
1050                         '_',
1051                         $class ), '_');
1052         }
1053
1054         /**
1055          * Given HTML input, escape with htmlspecialchars but un-escape entites.
1056          * This allows (generally harmless) entities like &#160; to survive.
1057          *
1058          * @param $html String to escape
1059          * @return String: escaped input
1060          */
1061         static function escapeHtmlAllowEntities( $html ) {
1062                 $html = Sanitizer::decodeCharReferences( $html );
1063                 # It seems wise to escape ' as well as ", as a matter of course.  Can't
1064                 # hurt.
1065                 $html = htmlspecialchars( $html, ENT_QUOTES );
1066                 return $html;
1067         }
1068
1069         /**
1070          * Regex replace callback for armoring links against further processing.
1071          * @param $matches Array
1072          * @return string
1073          */
1074         private static function armorLinksCallback( $matches ) {
1075                 return str_replace( ':', '&#58;', $matches[1] );
1076         }
1077
1078         /**
1079          * Return an associative array of attribute names and values from
1080          * a partial tag string. Attribute names are forces to lowercase,
1081          * character references are decoded to UTF-8 text.
1082          *
1083          * @param $text String
1084          * @return Array
1085          */
1086         public static function decodeTagAttributes( $text ) {
1087                 if( trim( $text ) == '' ) {
1088                         return array();
1089                 }
1090
1091                 $attribs = array();
1092                 $pairs = array();
1093                 if( !preg_match_all(
1094                         MW_ATTRIBS_REGEX,
1095                         $text,
1096                         $pairs,
1097                         PREG_SET_ORDER ) ) {
1098                         return $attribs;
1099                 }
1100
1101                 foreach( $pairs as $set ) {
1102                         $attribute = strtolower( $set[1] );
1103                         $value = Sanitizer::getTagAttributeCallback( $set );
1104
1105                         // Normalize whitespace
1106                         $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1107                         $value = trim( $value );
1108
1109                         // Decode character references
1110                         $attribs[$attribute] = Sanitizer::decodeCharReferences( $value );
1111                 }
1112                 return $attribs;
1113         }
1114
1115         /**
1116          * Pick the appropriate attribute value from a match set from the
1117          * MW_ATTRIBS_REGEX matches.
1118          *
1119          * @param $set Array
1120          * @return String
1121          */
1122         private static function getTagAttributeCallback( $set ) {
1123                 if( isset( $set[6] ) ) {
1124                         # Illegal #XXXXXX color with no quotes.
1125                         return $set[6];
1126                 } elseif( isset( $set[5] ) ) {
1127                         # No quotes.
1128                         return $set[5];
1129                 } elseif( isset( $set[4] ) ) {
1130                         # Single-quoted
1131                         return $set[4];
1132                 } elseif( isset( $set[3] ) ) {
1133                         # Double-quoted
1134                         return $set[3];
1135                 } elseif( !isset( $set[2] ) ) {
1136                         # In XHTML, attributes must have a value.
1137                         # For 'reduced' form, return explicitly the attribute name here.
1138                         return $set[1];
1139                 } else {
1140                         throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1141                 }
1142         }
1143
1144         /**
1145          * Normalize whitespace and character references in an XML source-
1146          * encoded text for an attribute value.
1147          *
1148          * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
1149          * but note that we're not returning the value, but are returning
1150          * XML source fragments that will be slapped into output.
1151          *
1152          * @param $text String
1153          * @return String
1154          */
1155         private static function normalizeAttributeValue( $text ) {
1156                 return str_replace( '"', '&quot;',
1157                         self::normalizeWhitespace(
1158                                 Sanitizer::normalizeCharReferences( $text ) ) );
1159         }
1160
1161         private static function normalizeWhitespace( $text ) {
1162                 return preg_replace(
1163                         '/\r\n|[\x20\x0d\x0a\x09]/',
1164                         ' ',
1165                         $text );
1166         }
1167
1168         /**
1169          * Normalizes whitespace in a section name, such as might be returned
1170          * by Parser::stripSectionName(), for use in the id's that are used for
1171          * section links.
1172          *
1173          * @param $section String
1174          * @return String
1175          */
1176         static function normalizeSectionNameWhitespace( $section ) {
1177                 return trim( preg_replace( '/[ _]+/', ' ', $section ) );
1178         }
1179
1180         /**
1181          * Ensure that any entities and character references are legal
1182          * for XML and XHTML specifically. Any stray bits will be
1183          * &amp;-escaped to result in a valid text fragment.
1184          *
1185          * a. any named char refs must be known in XHTML
1186          * b. any numeric char refs must be legal chars, not invalid or forbidden
1187          * c. use &#x, not &#X
1188          * d. fix or reject non-valid attributes
1189          *
1190          * @param $text String
1191          * @return String
1192          * @private
1193          */
1194         static function normalizeCharReferences( $text ) {
1195                 return preg_replace_callback(
1196                         MW_CHAR_REFS_REGEX,
1197                         array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
1198                         $text );
1199         }
1200         /**
1201          * @param $matches String
1202          * @return String
1203          */
1204         static function normalizeCharReferencesCallback( $matches ) {
1205                 $ret = null;
1206                 if( $matches[1] != '' ) {
1207                         $ret = Sanitizer::normalizeEntity( $matches[1] );
1208                 } elseif( $matches[2] != '' ) {
1209                         $ret = Sanitizer::decCharReference( $matches[2] );
1210                 } elseif( $matches[3] != ''  ) {
1211                         $ret = Sanitizer::hexCharReference( $matches[3] );
1212                 } elseif( $matches[4] != '' ) {
1213                         $ret = Sanitizer::hexCharReference( $matches[4] );
1214                 }
1215                 if( is_null( $ret ) ) {
1216                         return htmlspecialchars( $matches[0] );
1217                 } else {
1218                         return $ret;
1219                 }
1220         }
1221
1222         /**
1223          * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1224          * return the named entity reference as is. If the entity is a
1225          * MediaWiki-specific alias, returns the HTML equivalent. Otherwise,
1226          * returns HTML-escaped text of pseudo-entity source (eg &amp;foo;)
1227          *
1228          * @param $name String
1229          * @return String
1230          */
1231         static function normalizeEntity( $name ) {
1232                 global $wgHtmlEntities, $wgHtmlEntityAliases;
1233                 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1234                         return "&{$wgHtmlEntityAliases[$name]};";
1235                 } elseif( isset( $wgHtmlEntities[$name] ) ) {
1236                         return "&$name;";
1237                 } else {
1238                         return "&amp;$name;";
1239                 }
1240         }
1241
1242         static function decCharReference( $codepoint ) {
1243                 $point = intval( $codepoint );
1244                 if( Sanitizer::validateCodepoint( $point ) ) {
1245                         return sprintf( '&#%d;', $point );
1246                 } else {
1247                         return null;
1248                 }
1249         }
1250
1251         static function hexCharReference( $codepoint ) {
1252                 $point = hexdec( $codepoint );
1253                 if( Sanitizer::validateCodepoint( $point ) ) {
1254                         return sprintf( '&#x%x;', $point );
1255                 } else {
1256                         return null;
1257                 }
1258         }
1259
1260         /**
1261          * Returns true if a given Unicode codepoint is a valid character in XML.
1262          * @param $codepoint Integer
1263          * @return Boolean
1264          */
1265         private static function validateCodepoint( $codepoint ) {
1266                 return ($codepoint ==    0x09)
1267                         || ($codepoint ==    0x0a)
1268                         || ($codepoint ==    0x0d)
1269                         || ($codepoint >=    0x20 && $codepoint <=   0xd7ff)
1270                         || ($codepoint >=  0xe000 && $codepoint <=   0xfffd)
1271                         || ($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
1272         }
1273
1274         /**
1275          * Decode any character references, numeric or named entities,
1276          * in the text and return a UTF-8 string.
1277          *
1278          * @param $text String
1279          * @return String
1280          */
1281         public static function decodeCharReferences( $text ) {
1282                 return preg_replace_callback(
1283                         MW_CHAR_REFS_REGEX,
1284                         array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1285                         $text );
1286         }
1287
1288         /**
1289          * Decode any character references, numeric or named entities,
1290          * in the next and normalize the resulting string. (bug 14952)
1291          *
1292          * This is useful for page titles, not for text to be displayed,
1293          * MediaWiki allows HTML entities to escape normalization as a feature.
1294          *
1295          * @param $text String (already normalized, containing entities)
1296          * @return String (still normalized, without entities)
1297          */
1298         public static function decodeCharReferencesAndNormalize( $text ) {
1299                 global $wgContLang;
1300                 $text = preg_replace_callback(
1301                         MW_CHAR_REFS_REGEX,
1302                         array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1303                         $text, /* limit */ -1, $count );
1304
1305                 if ( $count ) {
1306                         return $wgContLang->normalize( $text );
1307                 } else {
1308                         return $text;
1309                 }
1310         }
1311
1312         /**
1313          * @param $matches String
1314          * @return String
1315          */
1316         static function decodeCharReferencesCallback( $matches ) {
1317                 if( $matches[1] != '' ) {
1318                         return Sanitizer::decodeEntity( $matches[1] );
1319                 } elseif( $matches[2] != '' ) {
1320                         return  Sanitizer::decodeChar( intval( $matches[2] ) );
1321                 } elseif( $matches[3] != ''  ) {
1322                         return  Sanitizer::decodeChar( hexdec( $matches[3] ) );
1323                 } elseif( $matches[4] != '' ) {
1324                         return  Sanitizer::decodeChar( hexdec( $matches[4] ) );
1325                 }
1326                 # Last case should be an ampersand by itself
1327                 return $matches[0];
1328         }
1329
1330         /**
1331          * Return UTF-8 string for a codepoint if that is a valid
1332          * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
1333          * @param $codepoint Integer
1334          * @return String
1335          * @private
1336          */
1337         static function decodeChar( $codepoint ) {
1338                 if( Sanitizer::validateCodepoint( $codepoint ) ) {
1339                         return codepointToUtf8( $codepoint );
1340                 } else {
1341                         return UTF8_REPLACEMENT;
1342                 }
1343         }
1344
1345         /**
1346          * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1347          * return the UTF-8 encoding of that character. Otherwise, returns
1348          * pseudo-entity source (eg &foo;)
1349          *
1350          * @param $name Strings
1351          * @return String
1352          */
1353         static function decodeEntity( $name ) {
1354                 global $wgHtmlEntities, $wgHtmlEntityAliases;
1355                 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1356                         $name = $wgHtmlEntityAliases[$name];
1357                 }
1358                 if( isset( $wgHtmlEntities[$name] ) ) {
1359                         return codepointToUtf8( $wgHtmlEntities[$name] );
1360                 } else {
1361                         return "&$name;";
1362                 }
1363         }
1364
1365         /**
1366          * Fetch the whitelist of acceptable attributes for a given element name.
1367          *
1368          * @param $element String
1369          * @return Array
1370          */
1371         static function attributeWhitelist( $element ) {
1372                 static $list;
1373                 if( !isset( $list ) ) {
1374                         $list = Sanitizer::setupAttributeWhitelist();
1375                 }
1376                 return isset( $list[$element] )
1377                         ? $list[$element]
1378                         : array();
1379         }
1380
1381         /**
1382          * Foreach array key (an allowed HTML element), return an array
1383          * of allowed attributes
1384          * @return Array
1385          */
1386         static function setupAttributeWhitelist() {
1387                 global $wgAllowRdfaAttributes, $wgHtml5, $wgAllowMicrodataAttributes;
1388
1389                 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );
1390
1391                 if ( $wgAllowRdfaAttributes ) {
1392                         #RDFa attributes as specified in section 9 of http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1393                         $common = array_merge( $common, array(
1394                             'about', 'property', 'resource', 'datatype', 'typeof',
1395                         ) );
1396                 }
1397
1398                 if ( $wgHtml5 && $wgAllowMicrodataAttributes ) {
1399                         # add HTML5 microdata tages as pecified by http://www.whatwg.org/specs/web-apps/current-work/multipage/microdata.html#the-microdata-model
1400                         $common = array_merge( $common, array(
1401                             'itemid', 'itemprop', 'itemref', 'itemscope', 'itemtype'
1402                         ) );
1403                 }
1404
1405                 $block = array_merge( $common, array( 'align' ) );
1406                 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1407                 $tablecell = array( 'abbr',
1408                                     'axis',
1409                                     'headers',
1410                                     'scope',
1411                                     'rowspan',
1412                                     'colspan',
1413                                     'nowrap', # deprecated
1414                                     'width',  # deprecated
1415                                     'height', # deprecated
1416                                     'bgcolor' # deprecated
1417                                     );
1418
1419                 # Numbers refer to sections in HTML 4.01 standard describing the element.
1420                 # See: http://www.w3.org/TR/html4/
1421                 $whitelist = array (
1422                         # 7.5.4
1423                         'div'        => $block,
1424                         'center'     => $common, # deprecated
1425                         'span'       => $block, # ??
1426
1427                         # 7.5.5
1428                         'h1'         => $block,
1429                         'h2'         => $block,
1430                         'h3'         => $block,
1431                         'h4'         => $block,
1432                         'h5'         => $block,
1433                         'h6'         => $block,
1434
1435                         # 7.5.6
1436                         # address
1437
1438                         # 8.2.4
1439                         # bdo
1440
1441                         # 9.2.1
1442                         'em'         => $common,
1443                         'strong'     => $common,
1444                         'cite'       => $common,
1445                         'dfn'        => $common,
1446                         'code'       => $common,
1447                         # samp
1448                         # kbd
1449                         'var'        => $common,
1450                         'abbr'       => $common,
1451                         # acronym
1452
1453                         # 9.2.2
1454                         'blockquote' => array_merge( $common, array( 'cite' ) ),
1455                         # q
1456
1457                         # 9.2.3
1458                         'sub'        => $common,
1459                         'sup'        => $common,
1460
1461                         # 9.3.1
1462                         'p'          => $block,
1463
1464                         # 9.3.2
1465                         'br'         => array( 'id', 'class', 'title', 'style', 'clear' ),
1466
1467                         # 9.3.4
1468                         'pre'        => array_merge( $common, array( 'width' ) ),
1469
1470                         # 9.4
1471                         'ins'        => array_merge( $common, array( 'cite', 'datetime' ) ),
1472                         'del'        => array_merge( $common, array( 'cite', 'datetime' ) ),
1473
1474                         # 10.2
1475                         'ul'         => array_merge( $common, array( 'type' ) ),
1476                         'ol'         => array_merge( $common, array( 'type', 'start' ) ),
1477                         'li'         => array_merge( $common, array( 'type', 'value' ) ),
1478
1479                         # 10.3
1480                         'dl'         => $common,
1481                         'dd'         => $common,
1482                         'dt'         => $common,
1483
1484                         # 11.2.1
1485                         'table'      => array_merge( $common,
1486                                                                 array( 'summary', 'width', 'border', 'frame',
1487                                                                                 'rules', 'cellspacing', 'cellpadding',
1488                                                                                 'align', 'bgcolor',
1489                                                                 ) ),
1490
1491                         # 11.2.2
1492                         'caption'    => array_merge( $common, array( 'align' ) ),
1493
1494                         # 11.2.3
1495                         'thead'      => array_merge( $common, $tablealign ),
1496                         'tfoot'      => array_merge( $common, $tablealign ),
1497                         'tbody'      => array_merge( $common, $tablealign ),
1498
1499                         # 11.2.4
1500                         'colgroup'   => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1501                         'col'        => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1502
1503                         # 11.2.5
1504                         'tr'         => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1505
1506                         # 11.2.6
1507                         'td'         => array_merge( $common, $tablecell, $tablealign ),
1508                         'th'         => array_merge( $common, $tablecell, $tablealign ),
1509
1510                         # 12.2 # NOTE: <a> is not allowed directly, but the attrib whitelist is used from the Parser object
1511                         'a'          => array_merge( $common, array( 'href', 'rel', 'rev' ) ), # rel/rev esp. for RDFa
1512
1513                         # 13.2
1514                         # Not usually allowed, but may be used for extension-style hooks
1515                         # such as <math> when it is rasterized, or if $wgAllowImageTag is
1516                         # true
1517                         'img'        => array_merge( $common, array( 'alt', 'src', 'width', 'height' ) ),
1518
1519                         # 15.2.1
1520                         'tt'         => $common,
1521                         'b'          => $common,
1522                         'i'          => $common,
1523                         'big'        => $common,
1524                         'small'      => $common,
1525                         'strike'     => $common,
1526                         's'          => $common,
1527                         'u'          => $common,
1528
1529                         # 15.2.2
1530                         'font'       => array_merge( $common, array( 'size', 'color', 'face' ) ),
1531                         # basefont
1532
1533                         # 15.3
1534                         'hr'         => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1535
1536                         # XHTML Ruby annotation text module, simple ruby only.
1537                         # http://www.w3c.org/TR/ruby/
1538                         'ruby'       => $common,
1539                         # rbc
1540                         # rtc
1541                         'rb'         => $common,
1542                         'rt'         => $common, #array_merge( $common, array( 'rbspan' ) ),
1543                         'rp'         => $common,
1544
1545                         # MathML root element, where used for extensions
1546                         # 'title' may not be 100% valid here; it's XHTML
1547                         # http://www.w3.org/TR/REC-MathML/
1548                         'math'       => array( 'class', 'style', 'id', 'title' ),
1549                         );
1550                 return $whitelist;
1551         }
1552
1553         /**
1554          * Take a fragment of (potentially invalid) HTML and return
1555          * a version with any tags removed, encoded as plain text.
1556          *
1557          * Warning: this return value must be further escaped for literal
1558          * inclusion in HTML output as of 1.10!
1559          *
1560          * @param $text String: HTML fragment
1561          * @return String
1562          */
1563         static function stripAllTags( $text ) {
1564                 # Actual <tags>
1565                 $text = StringUtils::delimiterReplace( '<', '>', '', $text );
1566
1567                 # Normalize &entities and whitespace
1568                 $text = self::decodeCharReferences( $text );
1569                 $text = self::normalizeWhitespace( $text );
1570
1571                 return $text;
1572         }
1573
1574         /**
1575          * Hack up a private DOCTYPE with HTML's standard entity declarations.
1576          * PHP 4 seemed to know these if you gave it an HTML doctype, but
1577          * PHP 5.1 doesn't.
1578          *
1579          * Use for passing XHTML fragments to PHP's XML parsing functions
1580          *
1581          * @return String
1582          */
1583         static function hackDocType() {
1584                 global $wgHtmlEntities;
1585                 $out = "<!DOCTYPE html [\n";
1586                 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1587                         $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1588                 }
1589                 $out .= "]>\n";
1590                 return $out;
1591         }
1592
1593         static function cleanUrl( $url ) {
1594                 # Normalize any HTML entities in input. They will be
1595                 # re-escaped by makeExternalLink().
1596                 $url = Sanitizer::decodeCharReferences( $url );
1597
1598                 # Escape any control characters introduced by the above step
1599                 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F\|]/e', "urlencode('\\0')", $url );
1600
1601                 # Validate hostname portion
1602                 $matches = array();
1603                 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1604                         list( /* $whole */, $protocol, $host, $rest ) = $matches;
1605
1606                         // Characters that will be ignored in IDNs.
1607                         // http://tools.ietf.org/html/3454#section-3.1
1608                         // Strip them before further processing so blacklists and such work.
1609                         $strip = "/
1610                                 \\s|          # general whitespace
1611                                 \xc2\xad|     # 00ad SOFT HYPHEN
1612                                 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1613                                 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1614                                 \xe2\x81\xa0| # 2060 WORD JOINER
1615                                 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1616                                 \xcd\x8f|     # 034f COMBINING GRAPHEME JOINER
1617                                 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1618                                 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1619                                 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1620                                 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1621                                 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1622                                 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1623                                 /xuD";
1624
1625                         $host = preg_replace( $strip, '', $host );
1626
1627                         // @todo Fixme: validate hostnames here
1628
1629                         return $protocol . $host . $rest;
1630                 } else {
1631                         return $url;
1632                 }
1633         }
1634
1635 }