includes/Sanitizer.php

   1 <?php
   2 /**
   3  * XHTML sanitizer for MediaWiki
   4  *
   5  * Copyright © 2002-2005 Brion Vibber <brion@pobox.com> et al
   6  * http://www.mediawiki.org/
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along
  19  * with this program; if not, write to the Free Software Foundation, Inc.,
  20  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  21  * http://www.gnu.org/copyleft/gpl.html
  22  *
  23  * @file
  24  * @ingroup Parser
  25  */
  26
  27 /**
  28  * Regular expression to match various types of character references in
  29  * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
  30  */
  31 define( 'MW_CHAR_REFS_REGEX',
  32         '/&([A-Za-z0-9\x80-\xff]+);
  33          |&\#([0-9]+);
  34          |&\#x([0-9A-Za-z]+);
  35          |&\#X([0-9A-Za-z]+);
  36          |(&)/x' );
  37
  38 /**
  39  * Regular expression to match HTML/XML attribute pairs within a tag.
  40  * Allows some... latitude.
  41  * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
  42  */
  43 $attrib_first = '[:A-Z_a-z]';
  44 $attrib = '[:A-Z_a-z-.0-9]';
  45 $space = '[\x09\x0a\x0d\x20]';
  46 define( 'MW_ATTRIBS_REGEX',
  47         "/(?:^|$space)({$attrib_first}{$attrib}*)
  48           ($space*=$space*
  49                 (?:
  50                  # The attribute value: quoted or alone
  51                   \"([^<\"]*)\"
  52                  | '([^<']*)'
  53                  |  ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
  54                  |  (\#[0-9a-fA-F]+) # Technically wrong, but lots of
  55                                                          # colors are specified like this.
  56                                                          # We'll be normalizing it.
  57                 )
  58            )?(?=$space|\$)/sx" );
  59
  60 /**
  61  * Regular expression to match URIs that could trigger script execution
  62  */
  63 define( 'MW_EVIL_URI_PATTERN', '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i' );
  64
  65 /**
  66  * Regular expression to match namespace attributes
  67  */
  68 define( 'MW_XMLNS_ATTRIBUTE_PATTRN', "/^xmlns:$attrib+$/" );
  69
  70 /**
  71  * List of all named character entities defined in HTML 4.01
  72  * http://www.w3.org/TR/html4/sgml/entities.html
  73  * @private
  74  */
  75 global $wgHtmlEntities;
  76 $wgHtmlEntities = array(
  77         'Aacute'   => 193,
  78         'aacute'   => 225,
  79         'Acirc'    => 194,
  80         'acirc'    => 226,
  81         'acute'    => 180,
  82         'AElig'    => 198,
  83         'aelig'    => 230,
  84         'Agrave'   => 192,
  85         'agrave'   => 224,
  86         'alefsym'  => 8501,
  87         'Alpha'    => 913,
  88         'alpha'    => 945,
  89         'amp'      => 38,
  90         'and'      => 8743,
  91         'ang'      => 8736,
  92         'Aring'    => 197,
  93         'aring'    => 229,
  94         'asymp'    => 8776,
  95         'Atilde'   => 195,
  96         'atilde'   => 227,
  97         'Auml'     => 196,
  98         'auml'     => 228,
  99         'bdquo'    => 8222,
 100         'Beta'     => 914,
 101         'beta'     => 946,
 102         'brvbar'   => 166,
 103         'bull'     => 8226,
 104         'cap'      => 8745,
 105         'Ccedil'   => 199,
 106         'ccedil'   => 231,
 107         'cedil'    => 184,
 108         'cent'     => 162,
 109         'Chi'      => 935,
 110         'chi'      => 967,
 111         'circ'     => 710,
 112         'clubs'    => 9827,
 113         'cong'     => 8773,
 114         'copy'     => 169,
 115         'crarr'    => 8629,
 116         'cup'      => 8746,
 117         'curren'   => 164,
 118         'dagger'   => 8224,
 119         'Dagger'   => 8225,
 120         'darr'     => 8595,
 121         'dArr'     => 8659,
 122         'deg'      => 176,
 123         'Delta'    => 916,
 124         'delta'    => 948,
 125         'diams'    => 9830,
 126         'divide'   => 247,
 127         'Eacute'   => 201,
 128         'eacute'   => 233,
 129         'Ecirc'    => 202,
 130         'ecirc'    => 234,
 131         'Egrave'   => 200,
 132         'egrave'   => 232,
 133         'empty'    => 8709,
 134         'emsp'     => 8195,
 135         'ensp'     => 8194,
 136         'Epsilon'  => 917,
 137         'epsilon'  => 949,
 138         'equiv'    => 8801,
 139         'Eta'      => 919,
 140         'eta'      => 951,
 141         'ETH'      => 208,
 142         'eth'      => 240,
 143         'Euml'     => 203,
 144         'euml'     => 235,
 145         'euro'     => 8364,
 146         'exist'    => 8707,
 147         'fnof'     => 402,
 148         'forall'   => 8704,
 149         'frac12'   => 189,
 150         'frac14'   => 188,
 151         'frac34'   => 190,
 152         'frasl'    => 8260,
 153         'Gamma'    => 915,
 154         'gamma'    => 947,
 155         'ge'       => 8805,
 156         'gt'       => 62,
 157         'harr'     => 8596,
 158         'hArr'     => 8660,
 159         'hearts'   => 9829,
 160         'hellip'   => 8230,
 161         'Iacute'   => 205,
 162         'iacute'   => 237,
 163         'Icirc'    => 206,
 164         'icirc'    => 238,
 165         'iexcl'    => 161,
 166         'Igrave'   => 204,
 167         'igrave'   => 236,
 168         'image'    => 8465,
 169         'infin'    => 8734,
 170         'int'      => 8747,
 171         'Iota'     => 921,
 172         'iota'     => 953,
 173         'iquest'   => 191,
 174         'isin'     => 8712,
 175         'Iuml'     => 207,
 176         'iuml'     => 239,
 177         'Kappa'    => 922,
 178         'kappa'    => 954,
 179         'Lambda'   => 923,
 180         'lambda'   => 955,
 181         'lang'     => 9001,
 182         'laquo'    => 171,
 183         'larr'     => 8592,
 184         'lArr'     => 8656,
 185         'lceil'    => 8968,
 186         'ldquo'    => 8220,
 187         'le'       => 8804,
 188         'lfloor'   => 8970,
 189         'lowast'   => 8727,
 190         'loz'      => 9674,
 191         'lrm'      => 8206,
 192         'lsaquo'   => 8249,
 193         'lsquo'    => 8216,
 194         'lt'       => 60,
 195         'macr'     => 175,
 196         'mdash'    => 8212,
 197         'micro'    => 181,
 198         'middot'   => 183,
 199         'minus'    => 8722,
 200         'Mu'       => 924,
 201         'mu'       => 956,
 202         'nabla'    => 8711,
 203         'nbsp'     => 160,
 204         'ndash'    => 8211,
 205         'ne'       => 8800,
 206         'ni'       => 8715,
 207         'not'      => 172,
 208         'notin'    => 8713,
 209         'nsub'     => 8836,
 210         'Ntilde'   => 209,
 211         'ntilde'   => 241,
 212         'Nu'       => 925,
 213         'nu'       => 957,
 214         'Oacute'   => 211,
 215         'oacute'   => 243,
 216         'Ocirc'    => 212,
 217         'ocirc'    => 244,
 218         'OElig'    => 338,
 219         'oelig'    => 339,
 220         'Ograve'   => 210,
 221         'ograve'   => 242,
 222         'oline'    => 8254,
 223         'Omega'    => 937,
 224         'omega'    => 969,
 225         'Omicron'  => 927,
 226         'omicron'  => 959,
 227         'oplus'    => 8853,
 228         'or'       => 8744,
 229         'ordf'     => 170,
 230         'ordm'     => 186,
 231         'Oslash'   => 216,
 232         'oslash'   => 248,
 233         'Otilde'   => 213,
 234         'otilde'   => 245,
 235         'otimes'   => 8855,
 236         'Ouml'     => 214,
 237         'ouml'     => 246,
 238         'para'     => 182,
 239         'part'     => 8706,
 240         'permil'   => 8240,
 241         'perp'     => 8869,
 242         'Phi'      => 934,
 243         'phi'      => 966,
 244         'Pi'       => 928,
 245         'pi'       => 960,
 246         'piv'      => 982,
 247         'plusmn'   => 177,
 248         'pound'    => 163,
 249         'prime'    => 8242,
 250         'Prime'    => 8243,
 251         'prod'     => 8719,
 252         'prop'     => 8733,
 253         'Psi'      => 936,
 254         'psi'      => 968,
 255         'quot'     => 34,
 256         'radic'    => 8730,
 257         'rang'     => 9002,
 258         'raquo'    => 187,
 259         'rarr'     => 8594,
 260         'rArr'     => 8658,
 261         'rceil'    => 8969,
 262         'rdquo'    => 8221,
 263         'real'     => 8476,
 264         'reg'      => 174,
 265         'rfloor'   => 8971,
 266         'Rho'      => 929,
 267         'rho'      => 961,
 268         'rlm'      => 8207,
 269         'rsaquo'   => 8250,
 270         'rsquo'    => 8217,
 271         'sbquo'    => 8218,
 272         'Scaron'   => 352,
 273         'scaron'   => 353,
 274         'sdot'     => 8901,
 275         'sect'     => 167,
 276         'shy'      => 173,
 277         'Sigma'    => 931,
 278         'sigma'    => 963,
 279         'sigmaf'   => 962,
 280         'sim'      => 8764,
 281         'spades'   => 9824,
 282         'sub'      => 8834,
 283         'sube'     => 8838,
 284         'sum'      => 8721,
 285         'sup'      => 8835,
 286         'sup1'     => 185,
 287         'sup2'     => 178,
 288         'sup3'     => 179,
 289         'supe'     => 8839,
 290         'szlig'    => 223,
 291         'Tau'      => 932,
 292         'tau'      => 964,
 293         'there4'   => 8756,
 294         'Theta'    => 920,
 295         'theta'    => 952,
 296         'thetasym' => 977,
 297         'thinsp'   => 8201,
 298         'THORN'    => 222,
 299         'thorn'    => 254,
 300         'tilde'    => 732,
 301         'times'    => 215,
 302         'trade'    => 8482,
 303         'Uacute'   => 218,
 304         'uacute'   => 250,
 305         'uarr'     => 8593,
 306         'uArr'     => 8657,
 307         'Ucirc'    => 219,
 308         'ucirc'    => 251,
 309         'Ugrave'   => 217,
 310         'ugrave'   => 249,
 311         'uml'      => 168,
 312         'upsih'    => 978,
 313         'Upsilon'  => 933,
 314         'upsilon'  => 965,
 315         'Uuml'     => 220,
 316         'uuml'     => 252,
 317         'weierp'   => 8472,
 318         'Xi'       => 926,
 319         'xi'       => 958,
 320         'Yacute'   => 221,
 321         'yacute'   => 253,
 322         'yen'      => 165,
 323         'Yuml'     => 376,
 324         'yuml'     => 255,
 325         'Zeta'     => 918,
 326         'zeta'     => 950,
 327         'zwj'      => 8205,
 328         'zwnj'     => 8204 );
 329
 330 /**
 331  * Character entity aliases accepted by MediaWiki
 332  */
 333 global $wgHtmlEntityAliases;
 334 $wgHtmlEntityAliases = array(
 335         'רלמ' => 'rlm',
 336         'رلم' => 'rlm',
 337 );
 338
 339
 340 /**
 341  * XHTML sanitizer for MediaWiki
 342  * @ingroup Parser
 343  */
 344 class Sanitizer {
 345         /**
 346          * Cleans up HTML, removes dangerous tags and attributes, and
 347          * removes HTML comments
 348          * @private
 349          * @param $text String
 350          * @param $processCallback Callback to do any variable or parameter replacements in HTML attribute values
 351          * @param $args Array for the processing callback
 352          * @param $extratags Array for any extra tags to include
 353          * @param $removetags Array for any tags (default or extra) to exclude
 354          * @return string
 355          */
 356         static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array(), $removetags = array() ) {
 357                 global $wgUseTidy;
 358
 359                 static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
 360                         $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
 361
 362                 wfProfileIn( __METHOD__ );
 363
 364                 if ( !$staticInitialised ) {
 365
 366                         $htmlpairsStatic = array( # Tags that must be closed
 367                                 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
 368                                 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
 369                                 'strike', 'strong', 'tt', 'var', 'div', 'center',
 370                                 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
 371                                 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u', 'abbr', 'dfn'
 372                         );
 373                         $htmlsingle = array(
 374                                 'br', 'hr', 'li', 'dt', 'dd'
 375                         );
 376                         $htmlsingleonly = array( # Elements that cannot have close tags
 377                                 'br', 'hr'
 378                         );
 379                         $htmlnest = array( # Tags that can be nested--??
 380                                 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
 381                                 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
 382                         );
 383                         $tabletags = array( # Can only appear inside table, we will close them
 384                                 'td', 'th', 'tr',
 385                         );
 386                         $htmllist = array( # Tags used by list
 387                                 'ul','ol',
 388                         );
 389                         $listtags = array( # Tags that can appear in a list
 390                                 'li',
 391                         );
 392
 393                         global $wgAllowImageTag;
 394                         if ( $wgAllowImageTag ) {
 395                                 $htmlsingle[] = 'img';
 396                                 $htmlsingleonly[] = 'img';
 397                         }
 398
 399                         $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
 400                         $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
 401
 402                         # Convert them all to hashtables for faster lookup
 403                         $vars = array( 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
 404                                 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' );
 405                         foreach ( $vars as $var ) {
 406                                 $$var = array_flip( $$var );
 407                         }
 408                         $staticInitialised = true;
 409                 }
 410                 # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
 411                 $extratags = array_flip( $extratags );
 412                 $removetags = array_flip( $removetags );
 413                 $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
 414                 $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ) , $removetags );
 415
 416                 # Remove HTML comments
 417                 $text = Sanitizer::removeHTMLcomments( $text );
 418                 $bits = explode( '<', $text );
 419                 $text = str_replace( '>', '&gt;', array_shift( $bits ) );
 420                 if ( !$wgUseTidy ) {
 421                         $tagstack = $tablestack = array();
 422                         foreach ( $bits as $x ) {
 423                                 $regs = array();
 424                                 # $slash: Does the current element start with a '/'?
 425                                 # $t: Current element name
 426                                 # $params: String between element name and >
 427                                 # $brace: Ending '>' or '/>'
 428                                 # $rest: Everything until the next element of $bits
 429                                 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
 430                                         list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
 431                                 } else {
 432                                         $slash = $t = $params = $brace = $rest = null;
 433                                 }
 434
 435                                 $badtag = false;
 436                                 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
 437                                         # Check our stack
 438                                         if ( $slash && isset( $htmlsingleonly[$t] ) ) {
 439                                                 $badtag = true;
 440                                         } elseif ( $slash ) {
 441                                                 # Closing a tag... is it the one we just opened?
 442                                                 $ot = @array_pop( $tagstack );
 443                                                 if ( $ot != $t ) {
 444                                                         if ( isset( $htmlsingleallowed[$ot] ) ) {
 445                                                                 # Pop all elements with an optional close tag
 446                                                                 # and see if we find a match below them
 447                                                                 $optstack = array();
 448                                                                 array_push( $optstack, $ot );
 449                                                                 $ot = @array_pop( $tagstack );
 450                                                                 while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
 451                                                                         array_push( $optstack, $ot );
 452                                                                         $ot = @array_pop( $tagstack );
 453                                                                 }
 454                                                                 if ( $t != $ot ) {
 455                                                                         # No match. Push the optional elements back again
 456                                                                         $badtag = true;
 457                                                                         while ( $ot = @array_pop( $optstack ) ) {
 458                                                                                 array_push( $tagstack, $ot );
 459                                                                         }
 460                                                                 }
 461                                                         } else {
 462                                                                 @array_push( $tagstack, $ot );
 463                                                                 # <li> can be nested in <ul> or <ol>, skip those cases:
 464                                                                 if ( !isset( $htmllist[$ot] ) || !isset( $listtags[$t] ) ) {
 465                                                                         $badtag = true;
 466                                                                 }
 467                                                         }
 468                                                 } else {
 469                                                         if ( $t == 'table' ) {
 470                                                                 $tagstack = array_pop( $tablestack );
 471                                                         }
 472                                                 }
 473                                                 $newparams = '';
 474                                         } else {
 475                                                 # Keep track for later
 476                                                 if ( isset( $tabletags[$t] ) &&
 477                                                 !in_array( 'table', $tagstack ) ) {
 478                                                         $badtag = true;
 479                                                 } elseif ( in_array( $t, $tagstack ) &&
 480                                                 !isset( $htmlnest [$t ] ) ) {
 481                                                         $badtag = true;
 482                                                 # Is it a self closed htmlpair ? (bug 5487)
 483                                                 } elseif ( $brace == '/>' &&
 484                                                 isset( $htmlpairs[$t] ) ) {
 485                                                         $badtag = true;
 486                                                 } elseif ( isset( $htmlsingleonly[$t] ) ) {
 487                                                         # Hack to force empty tag for uncloseable elements
 488                                                         $brace = '/>';
 489                                                 } elseif ( isset( $htmlsingle[$t] ) ) {
 490                                                         # Hack to not close $htmlsingle tags
 491                                                         $brace = null;
 492                                                 } elseif ( isset( $tabletags[$t] )
 493                                                 && in_array( $t, $tagstack ) ) {
 494                                                         // New table tag but forgot to close the previous one
 495                                                         $text .= "</$t>";
 496                                                 } else {
 497                                                         if ( $t == 'table' ) {
 498                                                                 array_push( $tablestack, $tagstack );
 499                                                                 $tagstack = array();
 500                                                         }
 501                                                         array_push( $tagstack, $t );
 502                                                 }
 503
 504                                                 # Replace any variables or template parameters with
 505                                                 # plaintext results.
 506                                                 if( is_callable( $processCallback ) ) {
 507                                                         call_user_func_array( $processCallback, array( &$params, $args ) );
 508                                                 }
 509
 510                                                 # Strip non-approved attributes from the tag
 511                                                 $newparams = Sanitizer::fixTagAttributes( $params, $t );
 512                                         }
 513                                         if ( !$badtag ) {
 514                                                 $rest = str_replace( '>', '&gt;', $rest );
 515                                                 $close = ( $brace == '/>' && !$slash ) ? ' /' : '';
 516                                                 $text .= "<$slash$t$newparams$close>$rest";
 517                                                 continue;
 518                                         }
 519                                 }
 520                                 $text .= '&lt;' . str_replace( '>', '&gt;', $x);
 521                         }
 522                         # Close off any remaining tags
 523                         while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
 524                                 $text .= "</$t>\n";
 525                                 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
 526                         }
 527                 } else {
 528                         # this might be possible using tidy itself
 529                         foreach ( $bits as $x ) {
 530                                 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
 531                                 $x, $regs );
 532                                 @list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
 533                                 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
 534                                         if( is_callable( $processCallback ) ) {
 535                                                 call_user_func_array( $processCallback, array( &$params, $args ) );
 536                                         }
 537                                         $newparams = Sanitizer::fixTagAttributes( $params, $t );
 538                                         $rest = str_replace( '>', '&gt;', $rest );
 539                                         $text .= "<$slash$t$newparams$brace$rest";
 540                                 } else {
 541                                         $text .= '&lt;' . str_replace( '>', '&gt;', $x);
 542                                 }
 543                         }
 544                 }
 545                 wfProfileOut( __METHOD__ );
 546                 return $text;
 547         }
 548
 549         /**
 550          * Remove '<!--', '-->', and everything between.
 551          * To avoid leaving blank lines, when a comment is both preceded
 552          * and followed by a newline (ignoring spaces), trim leading and
 553          * trailing spaces and one of the newlines.
 554          *
 555          * @private
 556          * @param $text String
 557          * @return string
 558          */
 559         static function removeHTMLcomments( $text ) {
 560                 wfProfileIn( __METHOD__ );
 561                 while (($start = strpos($text, '<!--')) !== false) {
 562                         $end = strpos($text, '-->', $start + 4);
 563                         if ($end === false) {
 564                                 # Unterminated comment; bail out
 565                                 break;
 566                         }
 567
 568                         $end += 3;
 569
 570                         # Trim space and newline if the comment is both
 571                         # preceded and followed by a newline
 572                         $spaceStart = max($start - 1, 0);
 573                         $spaceLen = $end - $spaceStart;
 574                         while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
 575                                 $spaceStart--;
 576                                 $spaceLen++;
 577                         }
 578                         while (substr($text, $spaceStart + $spaceLen, 1) === ' ')
 579                                 $spaceLen++;
 580                         if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart + $spaceLen, 1) === "\n") {
 581                                 # Remove the comment, leading and trailing
 582                                 # spaces, and leave only one newline.
 583                                 $text = substr_replace($text, "\n", $spaceStart, $spaceLen + 1);
 584                         }
 585                         else {
 586                                 # Remove just the comment.
 587                                 $text = substr_replace($text, '', $start, $end - $start);
 588                         }
 589                 }
 590                 wfProfileOut( __METHOD__ );
 591                 return $text;
 592         }
 593
 594         /**
 595          * Take an array of attribute names and values and normalize or discard
 596          * illegal values for the given element type.
 597          *
 598          * - Discards attributes not on a whitelist for the given element
 599          * - Unsafe style attributes are discarded
 600          * - Invalid id attributes are reencoded
 601          *
 602          * @param $attribs Array
 603          * @param $element String
 604          * @return Array
 605          *
 606          * @todo Check for legal values where the DTD limits things.
 607          * @todo Check for unique id attribute :P
 608          */
 609         static function validateTagAttributes( $attribs, $element ) {
 610                 return Sanitizer::validateAttributes( $attribs,
 611                         Sanitizer::attributeWhitelist( $element ) );
 612         }
 613
 614         /**
 615          * Take an array of attribute names and values and normalize or discard
 616          * illegal values for the given whitelist.
 617          *
 618          * - Discards attributes not the given whitelist
 619          * - Unsafe style attributes are discarded
 620          * - Invalid id attributes are reencoded
 621          *
 622          * @param $attribs Array
 623          * @param $whitelist Array: list of allowed attribute names
 624          * @return Array
 625          *
 626          * @todo Check for legal values where the DTD limits things.
 627          * @todo Check for unique id attribute :P
 628          */
 629         static function validateAttributes( $attribs, $whitelist ) {
 630                 global $wgAllowRdfaAttributes, $wgAllowMicrodataAttributes;
 631
 632                 $whitelist = array_flip( $whitelist );
 633                 $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
 634
 635                 $out = array();
 636                 foreach( $attribs as $attribute => $value ) {
 637                         #allow XML namespace declaration if RDFa is enabled
 638                         if ( $wgAllowRdfaAttributes && preg_match( MW_XMLNS_ATTRIBUTE_PATTRN, $attribute ) ) {
 639                                 if ( !preg_match( MW_EVIL_URI_PATTERN, $value ) ) {
 640                                         $out[$attribute] = $value;
 641                                 }
 642
 643                                 continue;
 644                         }
 645
 646                         if( !isset( $whitelist[$attribute] ) ) {
 647                                 continue;
 648                         }
 649
 650                         # Strip javascript "expression" from stylesheets.
 651                         # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
 652                         if( $attribute == 'style' ) {
 653                                 $value = Sanitizer::checkCss( $value );
 654                         }
 655
 656                         if ( $attribute === 'id' ) {
 657                                 $value = Sanitizer::escapeId( $value, 'noninitial' );
 658                         }
 659
 660                         //RDFa and microdata properties allow URLs, URIs and/or CURIs. check them for sanity
 661                         if ( $attribute === 'rel' || $attribute === 'rev' ||
 662                                 $attribute === 'about' || $attribute === 'property' || $attribute === 'resource' || #RDFa
 663                                 $attribute === 'datatype' || $attribute === 'typeof' ||                             #RDFa
 664                                 $attribute === 'itemid' || $attribute === 'itemprop' || $attribute === 'itemref' || #HTML5 microdata
 665                                 $attribute === 'itemscope' || $attribute === 'itemtype' ) {                         #HTML5 microdata
 666
 667                                 //Paranoia. Allow "simple" values but suppress javascript
 668                                 if ( preg_match( MW_EVIL_URI_PATTERN, $value ) ) {
 669                                         continue;
 670                                 }
 671                         }
 672
 673                         # NOTE: even though elements using href/src are not allowed directly, supply
 674                         #       validation code that can be used by tag hook handlers, etc
 675                         if ( $attribute === 'href' || $attribute === 'src' ) {
 676                                 if ( !preg_match( $hrefExp, $value ) ) {
 677                                         continue; //drop any href or src attributes not using an allowed protocol.
 678                                                   //NOTE: this also drops all relative URLs
 679                                 }
 680                         }
 681
 682                         // If this attribute was previously set, override it.
 683                         // Output should only have one attribute of each name.
 684                         $out[$attribute] = $value;
 685                 }
 686
 687                 if ( $wgAllowMicrodataAttributes ) {
 688                         # There are some complicated validity constraints we need to
 689                         # enforce here.  First of all, we don't want to allow non-standard
 690                         # itemtypes.
 691                         $allowedTypes = array(
 692                                 'http://microformats.org/profile/hcard',
 693                                 'http://microformats.org/profile/hcalendar#vevent',
 694                                 'http://n.whatwg.org/work',
 695                         );
 696                         if ( isset( $out['itemtype'] ) && !in_array( $out['itemtype'],
 697                         $allowedTypes ) ) {
 698                                 # Kill everything
 699                                 unset( $out['itemscope'] );
 700                         }
 701                         # itemtype, itemid, itemref don't make sense without itemscope
 702                         if ( !array_key_exists( 'itemscope', $out ) ) {
 703                                 unset( $out['itemtype'] );
 704                                 unset( $out['itemid'] );
 705                                 unset( $out['itemref'] );
 706                         }
 707                         # TODO: Strip itemprop if we aren't descendants of an itemscope.
 708                 }
 709                 return $out;
 710         }
 711
 712         /**
 713          * Merge two sets of HTML attributes.  Conflicting items in the second set
 714          * will override those in the first, except for 'class' attributes which
 715          * will be combined (if they're both strings).
 716          *
 717          * @todo implement merging for other attributes such as style
 718          * @param $a Array
 719          * @param $b Array
 720          * @return array
 721          */
 722         static function mergeAttributes( $a, $b ) {
 723                 $out = array_merge( $a, $b );
 724                 if( isset( $a['class'] ) && isset( $b['class'] )
 725                 && is_string( $a['class'] ) && is_string( $b['class'] )
 726                 && $a['class'] !== $b['class'] ) {
 727                         $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
 728                                 -1, PREG_SPLIT_NO_EMPTY );
 729                         $out['class'] = implode( ' ', array_unique( $classes ) );
 730                 }
 731                 return $out;
 732         }
 733
 734         /**
 735          * Pick apart some CSS and check it for forbidden or unsafe structures.
 736          * Returns a sanitized string, or false if it was just too evil.
 737          *
 738          * Currently URL references, 'expression', 'tps' are forbidden.
 739          *
 740          * @param $value String
 741          * @return Mixed
 742          */
 743         static function checkCss( $value ) {
 744                 $value = Sanitizer::decodeCharReferences( $value );
 745
 746                 // Remove any comments; IE gets token splitting wrong
 747                 $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value );
 748
 749                 // Decode escape sequences and line continuation
 750                 // See the grammar in the CSS 2 spec, appendix D.
 751                 static $decodeRegex, $reencodeTable;
 752                 if ( !$decodeRegex ) {
 753                         $space = '[\\x20\\t\\r\\n\\f]';
 754                         $nl = '(?:\\n|\\r\\n|\\r|\\f)';
 755                         $backslash = '\\\\';
 756                         $decodeRegex = "/ $backslash
 757                                 (?:
 758                                         ($nl) |  # 1. Line continuation
 759                                         ([0-9A-Fa-f]{1,6})$space? |  # 2. character number
 760                                         (.) | # 3. backslash cancelling special meaning
 761                                         () | # 4. backslash at end of string
 762                                 )/xu";
 763                 }
 764                 $value = preg_replace_callback( $decodeRegex,
 765                         array( __CLASS__, 'cssDecodeCallback' ), $value );
 766
 767                 // Reject problematic keywords and control characters
 768                 if ( preg_match( '/[\000-\010\016-\037\177]/', $value ) ) {
 769                         return '/* invalid control char */';
 770                 } elseif ( preg_match( '! expression | filter\s*: | accelerator\s*: | url\s*\( !ix', $value ) ) {
 771                         return '/* insecure input */';
 772                 }
 773                 return $value;
 774         }
 775
 776         static function cssDecodeCallback( $matches ) {
 777                 if ( $matches[1] !== '' ) {
 778                         // Line continuation
 779                         return '';
 780                 } elseif ( $matches[2] !== '' ) {
 781                         $char = codepointToUtf8( hexdec( $matches[2] ) );
 782                 } elseif ( $matches[3] !== '' ) {
 783                         $char = $matches[3];
 784                 } else {
 785                         $char = '\\';
 786                 }
 787                 if ( $char == "\n" || $char == '"' || $char == "'" || $char == '\\' ) {
 788                         // These characters need to be escaped in strings
 789                         // Clean up the escape sequence to avoid parsing errors by clients
 790                         return '\\' . dechex( ord( $char ) ) . ' ';
 791                 } else {
 792                         // Decode unnecessary escape
 793                         return $char;
 794                 }
 795         }
 796
 797         /**
 798         * Take an associative array of attribute name/value pairs
 799         * and generate a css style representing all the style-related
 800         * attributes. If there already a style attribute in the array,
 801         * it is also included in the value returned.
 802         */
 803         static function styleFromAttributes( $attributes ) {
 804                 $styles = array();
 805
 806                 foreach ( $attributes as $attribute => $value ) {
 807                         if ( $attribute == 'bgcolor' ) {
 808                                 $styles[] = "background-color: $value";
 809                         } else if ( $attribute == 'border' ) {
 810                                 $styles[] = "border-width: $value";
 811                         } else if ( $attribute == 'align' ) {
 812                                 $styles[] = "text-align: $value";
 813                         } else if ( $attribute == 'valign' ) {
 814                                 $styles[] = "vertical-align: $value";
 815                         } else if ( $attribute == 'width' ) {
 816                                 if ( preg_match( '/\d+/', $value ) === false ) {
 817                                       $value .= 'px';
 818                                 }
 819
 820                                 $styles[] = "width: $value";
 821                         } else if ( $attribute == 'height' ) {
 822                                 if ( preg_match( '/\d+/', $value ) === false ) {
 823                                       $value .= 'px';
 824                                 }
 825
 826                                 $styles[] = "height: $value";
 827                         } else if ( $attribute == 'nowrap' ) {
 828                                 if ( $value ) {
 829                                         $styles[] = "white-space: nowrap";
 830                                 }
 831                         }
 832                 }
 833
 834                 if ( isset( $attributes[ 'style' ] ) ) {
 835                         $styles[] = $attributes[ 'style' ];
 836                 }
 837
 838                 if ( !$styles ) return '';
 839                 else return implode( '; ', $styles );
 840         }
 841
 842         /**
 843          * Take a tag soup fragment listing an HTML element's attributes
 844          * and normalize it to well-formed XML, discarding unwanted attributes.
 845          * Output is safe for further wikitext processing, with escaping of
 846          * values that could trigger problems.
 847          *
 848          * - Normalizes attribute names to lowercase
 849          * - Discards attributes not on a whitelist for the given element
 850          * - Turns broken or invalid entities into plaintext
 851          * - Double-quotes all attribute values
 852          * - Attributes without values are given the name as attribute
 853          * - Double attributes are discarded
 854          * - Unsafe style attributes are discarded
 855          * - Prepends space if there are attributes.
 856          *
 857          * @param $text String
 858          * @param $element String
 859          * @param $defaults Array (optional) associative array of default attributes to splice in.
 860          *                      class and style attributes are combined. Otherwise, values from
 861          *                      $attributes take precedence over values from $defaults.
 862          * @return String
 863          */
 864         static function fixTagAttributes( $text, $element, $defaults = null ) {
 865                 if( trim( $text ) == '' ) {
 866                         return '';
 867                 }
 868
 869                 $decoded = Sanitizer::decodeTagAttributes( $text );
 870                 $stripped = Sanitizer::validateTagAttributes( $decoded, $element );
 871                 $attribs = Sanitizer::collapseTagAttributes( $stripped, $defaults );
 872
 873                 return $attribs;
 874         }
 875
 876         /**
 877          * Take an associative array or attribute name/value pairs
 878          * and collapses it to well-formed XML.
 879          * Does not filter attributes.
 880          * Output is safe for further wikitext processing, with escaping of
 881          * values that could trigger problems.
 882          *
 883          * - Double-quotes all attribute values
 884          * - Prepends space if there are attributes.
 885          *
 886          * @param $attributes Array is an associative array of attribute name/value pairs.
 887          *                      Assumed to be sanitized already.
 888          * @param $defaults Array (optional) associative array of default attributes to splice in.
 889          *                      class and style attributes are combined. Otherwise, values from
 890          *                      $attributes take precedence over values from $defaults.
 891          * @return String
 892          */
 893         static function collapseTagAttributes( $attributes, $defaults = null ) {
 894                 if ( $defaults ) {
 895                         foreach( $defaults as $attribute => $value ) {
 896                                 if ( isset( $attributes[ $attribute ] ) ) {
 897                                         if ( $attribute == 'class' ) {
 898                                                 $value .= ' '. $attributes[ $attribute ];
 899                                         } else if ( $attribute == 'style' ) {
 900                                                 $value .= '; ' . $attributes[ $attribute ];
 901                                         } else {
 902                                                 continue;
 903                                         }
 904                                 }
 905
 906                                 $attributes[ $attribute ] = $value;
 907                         }
 908                 }
 909
 910                 $chunks = array();
 911
 912                 foreach( $attributes as $attribute => $value ) {
 913                         $encAttribute = htmlspecialchars( $attribute );
 914                         $encValue = Sanitizer::safeEncodeAttribute( $value );
 915
 916                         $chunks[] = "$encAttribute=\"$encValue\"";
 917                 }
 918                 return count( $chunks ) ? ' ' . implode( ' ', $chunks ) : '';
 919         }
 920
 921         /**
 922          * Encode an attribute value for HTML output.
 923          * @param $text String
 924          * @return HTML-encoded text fragment
 925          */
 926         static function encodeAttribute( $text ) {
 927                 $encValue = htmlspecialchars( $text, ENT_QUOTES );
 928
 929                 // Whitespace is normalized during attribute decoding,
 930                 // so if we've been passed non-spaces we must encode them
 931                 // ahead of time or they won't be preserved.
 932                 $encValue = strtr( $encValue, array(
 933                         "\n" => '&#10;',
 934                         "\r" => '&#13;',
 935                         "\t" => '&#9;',
 936                 ) );
 937
 938                 return $encValue;
 939         }
 940
 941         /**
 942          * Encode an attribute value for HTML tags, with extra armoring
 943          * against further wiki processing.
 944          * @param $text String
 945          * @return HTML-encoded text fragment
 946          */
 947         static function safeEncodeAttribute( $text ) {
 948                 $encValue = Sanitizer::encodeAttribute( $text );
 949
 950                 # Templates and links may be expanded in later parsing,
 951                 # creating invalid or dangerous output. Suppress this.
 952                 $encValue = strtr( $encValue, array(
 953                         '<'    => '&lt;',   // This should never happen,
 954                         '>'    => '&gt;',   // we've received invalid input
 955                         '"'    => '&quot;', // which should have been escaped.
 956                         '{'    => '&#123;',
 957                         '['    => '&#91;',
 958                         "''"   => '&#39;&#39;',
 959                         'ISBN' => '&#73;SBN',
 960                         'RFC'  => '&#82;FC',
 961                         'PMID' => '&#80;MID',
 962                         '|'    => '&#124;',
 963                         '__'   => '&#95;_',
 964                 ) );
 965
 966                 # Stupid hack
 967                 $encValue = preg_replace_callback(
 968                         '/(' . wfUrlProtocols() . ')/',
 969                         array( 'Sanitizer', 'armorLinksCallback' ),
 970                         $encValue );
 971                 return $encValue;
 972         }
 973
 974         /**
 975          * Given a value, escape it so that it can be used in an id attribute and
 976          * return it.  This will use HTML5 validation if $wgExperimentalHtmlIds is
 977          * true, allowing anything but ASCII whitespace.  Otherwise it will use
 978          * HTML 4 rules, which means a narrow subset of ASCII, with bad characters
 979          * escaped with lots of dots.
 980          *
 981          * To ensure we don't have to bother escaping anything, we also strip ', ",
 982          * & even if $wgExperimentalIds is true.  TODO: Is this the best tactic?
 983          * We also strip # because it upsets IE6.
 984          *
 985          * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters
 986          *                                                          in the id and
 987          *                                                          name attributes
 988          * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
 989          * @see http://www.whatwg.org/specs/web-apps/current-work/multipage/elements.html#the-id-attribute
 990          *   HTML5 definition of id attribute
 991          *
 992          * @param $id String: id to escape
 993          * @param $options Mixed: string or array of strings (default is array()):
 994          *   'noninitial': This is a non-initial fragment of an id, not a full id,
 995          *       so don't pay attention if the first character isn't valid at the
 996          *       beginning of an id.  Only matters if $wgExperimentalHtmlIds is
 997          *       false.
 998          *   'legacy': Behave the way the old HTML 4-based ID escaping worked even
 999          *       if $wgExperimentalHtmlIds is used, so we can generate extra
1000          *       anchors and links won't break.
1001          * @return String
1002          */
1003         static function escapeId( $id, $options = array() ) {
1004                 global $wgHtml5, $wgExperimentalHtmlIds;
1005                 $options = (array)$options;
1006
1007                 if ( $wgHtml5 && $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) {
1008                         $id = Sanitizer::decodeCharReferences( $id );
1009                         $id = preg_replace( '/[ \t\n\r\f_\'"&#]+/', '_', $id );
1010                         $id = trim( $id, '_' );
1011                         if ( $id === '' ) {
1012                                 # Must have been all whitespace to start with.
1013                                 return '_';
1014                         } else {
1015                                 return $id;
1016                         }
1017                 }
1018
1019                 # HTML4-style escaping
1020                 static $replace = array(
1021                         '%3A' => ':',
1022                         '%' => '.'
1023                 );
1024
1025                 $id = urlencode( Sanitizer::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
1026                 $id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
1027
1028                 if ( !preg_match( '/^[a-zA-Z]/', $id )
1029                 && !in_array( 'noninitial', $options ) )  {
1030                         // Initial character must be a letter!
1031                         $id = "x$id";
1032                 }
1033                 return $id;
1034         }
1035
1036         /**
1037          * Given a value, escape it so that it can be used as a CSS class and
1038          * return it.
1039          *
1040          * @todo For extra validity, input should be validated UTF-8.
1041          *
1042          * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
1043          *
1044          * @param $class String
1045          * @return String
1046          */
1047         static function escapeClass( $class ) {
1048                 // Convert ugly stuff to underscores and kill underscores in ugly places
1049                 return rtrim(preg_replace(
1050                         array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
1051                         '_',
1052                         $class ), '_');
1053         }
1054
1055         /**
1056          * Given HTML input, escape with htmlspecialchars but un-escape entites.
1057          * This allows (generally harmless) entities like &#160; to survive.
1058          *
1059          * @param $html String to escape
1060          * @return String: escaped input
1061          */
1062         static function escapeHtmlAllowEntities( $html ) {
1063                 $html = Sanitizer::decodeCharReferences( $html );
1064                 # It seems wise to escape ' as well as ", as a matter of course.  Can't
1065                 # hurt.
1066                 $html = htmlspecialchars( $html, ENT_QUOTES );
1067                 return $html;
1068         }
1069
1070         /**
1071          * Regex replace callback for armoring links against further processing.
1072          * @param $matches Array
1073          * @return string
1074          */
1075         private static function armorLinksCallback( $matches ) {
1076                 return str_replace( ':', '&#58;', $matches[1] );
1077         }
1078
1079         /**
1080          * Return an associative array of attribute names and values from
1081          * a partial tag string. Attribute names are forces to lowercase,
1082          * character references are decoded to UTF-8 text.
1083          *
1084          * @param $text String
1085          * @return Array
1086          */
1087         public static function decodeTagAttributes( $text ) {
1088                 if( trim( $text ) == '' ) {
1089                         return array();
1090                 }
1091
1092                 $attribs = array();
1093                 $pairs = array();
1094                 if( !preg_match_all(
1095                         MW_ATTRIBS_REGEX,
1096                         $text,
1097                         $pairs,
1098                         PREG_SET_ORDER ) ) {
1099                         return $attribs;
1100                 }
1101
1102                 foreach( $pairs as $set ) {
1103                         $attribute = strtolower( $set[1] );
1104                         $value = Sanitizer::getTagAttributeCallback( $set );
1105
1106                         // Normalize whitespace
1107                         $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1108                         $value = trim( $value );
1109
1110                         // Decode character references
1111                         $attribs[$attribute] = Sanitizer::decodeCharReferences( $value );
1112                 }
1113                 return $attribs;
1114         }
1115
1116         /**
1117          * Pick the appropriate attribute value from a match set from the
1118          * MW_ATTRIBS_REGEX matches.
1119          *
1120          * @param $set Array
1121          * @return String
1122          */
1123         private static function getTagAttributeCallback( $set ) {
1124                 if( isset( $set[6] ) ) {
1125                         # Illegal #XXXXXX color with no quotes.
1126                         return $set[6];
1127                 } elseif( isset( $set[5] ) ) {
1128                         # No quotes.
1129                         return $set[5];
1130                 } elseif( isset( $set[4] ) ) {
1131                         # Single-quoted
1132                         return $set[4];
1133                 } elseif( isset( $set[3] ) ) {
1134                         # Double-quoted
1135                         return $set[3];
1136                 } elseif( !isset( $set[2] ) ) {
1137                         # In XHTML, attributes must have a value.
1138                         # For 'reduced' form, return explicitly the attribute name here.
1139                         return $set[1];
1140                 } else {
1141                         throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1142                 }
1143         }
1144
1145         /**
1146          * Normalize whitespace and character references in an XML source-
1147          * encoded text for an attribute value.
1148          *
1149          * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
1150          * but note that we're not returning the value, but are returning
1151          * XML source fragments that will be slapped into output.
1152          *
1153          * @param $text String
1154          * @return String
1155          */
1156         private static function normalizeAttributeValue( $text ) {
1157                 return str_replace( '"', '&quot;',
1158                         self::normalizeWhitespace(
1159                                 Sanitizer::normalizeCharReferences( $text ) ) );
1160         }
1161
1162         private static function normalizeWhitespace( $text ) {
1163                 return preg_replace(
1164                         '/\r\n|[\x20\x0d\x0a\x09]/',
1165                         ' ',
1166                         $text );
1167         }
1168
1169         /**
1170          * Normalizes whitespace in a section name, such as might be returned
1171          * by Parser::stripSectionName(), for use in the id's that are used for
1172          * section links.
1173          *
1174          * @param $section String
1175          * @return String
1176          */
1177         static function normalizeSectionNameWhitespace( $section ) {
1178                 return trim( preg_replace( '/[ _]+/', ' ', $section ) );
1179         }
1180
1181         /**
1182          * Ensure that any entities and character references are legal
1183          * for XML and XHTML specifically. Any stray bits will be
1184          * &amp;-escaped to result in a valid text fragment.
1185          *
1186          * a. any named char refs must be known in XHTML
1187          * b. any numeric char refs must be legal chars, not invalid or forbidden
1188          * c. use &#x, not &#X
1189          * d. fix or reject non-valid attributes
1190          *
1191          * @param $text String
1192          * @return String
1193          * @private
1194          */
1195         static function normalizeCharReferences( $text ) {
1196                 return preg_replace_callback(
1197                         MW_CHAR_REFS_REGEX,
1198                         array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
1199                         $text );
1200         }
1201         /**
1202          * @param $matches String
1203          * @return String
1204          */
1205         static function normalizeCharReferencesCallback( $matches ) {
1206                 $ret = null;
1207                 if( $matches[1] != '' ) {
1208                         $ret = Sanitizer::normalizeEntity( $matches[1] );
1209                 } elseif( $matches[2] != '' ) {
1210                         $ret = Sanitizer::decCharReference( $matches[2] );
1211                 } elseif( $matches[3] != ''  ) {
1212                         $ret = Sanitizer::hexCharReference( $matches[3] );
1213                 } elseif( $matches[4] != '' ) {
1214                         $ret = Sanitizer::hexCharReference( $matches[4] );
1215                 }
1216                 if( is_null( $ret ) ) {
1217                         return htmlspecialchars( $matches[0] );
1218                 } else {
1219                         return $ret;
1220                 }
1221         }
1222
1223         /**
1224          * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1225          * return the named entity reference as is. If the entity is a
1226          * MediaWiki-specific alias, returns the HTML equivalent. Otherwise,
1227          * returns HTML-escaped text of pseudo-entity source (eg &amp;foo;)
1228          *
1229          * @param $name String
1230          * @return String
1231          */
1232         static function normalizeEntity( $name ) {
1233                 global $wgHtmlEntities, $wgHtmlEntityAliases;
1234                 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1235                         return "&{$wgHtmlEntityAliases[$name]};";
1236                 } elseif( isset( $wgHtmlEntities[$name] ) ) {
1237                         return "&$name;";
1238                 } else {
1239                         return "&amp;$name;";
1240                 }
1241         }
1242
1243         static function decCharReference( $codepoint ) {
1244                 $point = intval( $codepoint );
1245                 if( Sanitizer::validateCodepoint( $point ) ) {
1246                         return sprintf( '&#%d;', $point );
1247                 } else {
1248                         return null;
1249                 }
1250         }
1251
1252         static function hexCharReference( $codepoint ) {
1253                 $point = hexdec( $codepoint );
1254                 if( Sanitizer::validateCodepoint( $point ) ) {
1255                         return sprintf( '&#x%x;', $point );
1256                 } else {
1257                         return null;
1258                 }
1259         }
1260
1261         /**
1262          * Returns true if a given Unicode codepoint is a valid character in XML.
1263          * @param $codepoint Integer
1264          * @return Boolean
1265          */
1266         private static function validateCodepoint( $codepoint ) {
1267                 return ($codepoint ==    0x09)
1268                         || ($codepoint ==    0x0a)
1269                         || ($codepoint ==    0x0d)
1270                         || ($codepoint >=    0x20 && $codepoint <=   0xd7ff)
1271                         || ($codepoint >=  0xe000 && $codepoint <=   0xfffd)
1272                         || ($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
1273         }
1274
1275         /**
1276          * Decode any character references, numeric or named entities,
1277          * in the text and return a UTF-8 string.
1278          *
1279          * @param $text String
1280          * @return String
1281          */
1282         public static function decodeCharReferences( $text ) {
1283                 return preg_replace_callback(
1284                         MW_CHAR_REFS_REGEX,
1285                         array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1286                         $text );
1287         }
1288
1289         /**
1290          * Decode any character references, numeric or named entities,
1291          * in the next and normalize the resulting string. (bug 14952)
1292          *
1293          * This is useful for page titles, not for text to be displayed,
1294          * MediaWiki allows HTML entities to escape normalization as a feature.
1295          *
1296          * @param $text String (already normalized, containing entities)
1297          * @return String (still normalized, without entities)
1298          */
1299         public static function decodeCharReferencesAndNormalize( $text ) {
1300                 global $wgContLang;
1301                 $text = preg_replace_callback(
1302                         MW_CHAR_REFS_REGEX,
1303                         array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1304                         $text, /* limit */ -1, $count );
1305
1306                 if ( $count ) {
1307                         return $wgContLang->normalize( $text );
1308                 } else {
1309                         return $text;
1310                 }
1311         }
1312
1313         /**
1314          * @param $matches String
1315          * @return String
1316          */
1317         static function decodeCharReferencesCallback( $matches ) {
1318                 if( $matches[1] != '' ) {
1319                         return Sanitizer::decodeEntity( $matches[1] );
1320                 } elseif( $matches[2] != '' ) {
1321                         return  Sanitizer::decodeChar( intval( $matches[2] ) );
1322                 } elseif( $matches[3] != ''  ) {
1323                         return  Sanitizer::decodeChar( hexdec( $matches[3] ) );
1324                 } elseif( $matches[4] != '' ) {
1325                         return  Sanitizer::decodeChar( hexdec( $matches[4] ) );
1326                 }
1327                 # Last case should be an ampersand by itself
1328                 return $matches[0];
1329         }
1330
1331         /**
1332          * Return UTF-8 string for a codepoint if that is a valid
1333          * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
1334          * @param $codepoint Integer
1335          * @return String
1336          * @private
1337          */
1338         static function decodeChar( $codepoint ) {
1339                 if( Sanitizer::validateCodepoint( $codepoint ) ) {
1340                         return codepointToUtf8( $codepoint );
1341                 } else {
1342                         return UTF8_REPLACEMENT;
1343                 }
1344         }
1345
1346         /**
1347          * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1348          * return the UTF-8 encoding of that character. Otherwise, returns
1349          * pseudo-entity source (eg &foo;)
1350          *
1351          * @param $name Strings
1352          * @return String
1353          */
1354         static function decodeEntity( $name ) {
1355                 global $wgHtmlEntities, $wgHtmlEntityAliases;
1356                 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1357                         $name = $wgHtmlEntityAliases[$name];
1358                 }
1359                 if( isset( $wgHtmlEntities[$name] ) ) {
1360                         return codepointToUtf8( $wgHtmlEntities[$name] );
1361                 } else {
1362                         return "&$name;";
1363                 }
1364         }
1365
1366         /**
1367          * Fetch the whitelist of acceptable attributes for a given element name.
1368          *
1369          * @param $element String
1370          * @return Array
1371          */
1372         static function attributeWhitelist( $element ) {
1373                 static $list;
1374                 if( !isset( $list ) ) {
1375                         $list = Sanitizer::setupAttributeWhitelist();
1376                 }
1377                 return isset( $list[$element] )
1378                         ? $list[$element]
1379                         : array();
1380         }
1381
1382         /**
1383          * Foreach array key (an allowed HTML element), return an array
1384          * of allowed attributes
1385          * @return Array
1386          */
1387         static function setupAttributeWhitelist() {
1388                 global $wgAllowRdfaAttributes, $wgHtml5, $wgAllowMicrodataAttributes;
1389
1390                 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );
1391
1392                 if ( $wgAllowRdfaAttributes ) {
1393                         #RDFa attributes as specified in section 9 of http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1394                         $common = array_merge( $common, array(
1395                             'about', 'property', 'resource', 'datatype', 'typeof',
1396                         ) );
1397                 }
1398
1399                 if ( $wgHtml5 && $wgAllowMicrodataAttributes ) {
1400                         # add HTML5 microdata tages as pecified by http://www.whatwg.org/specs/web-apps/current-work/multipage/microdata.html#the-microdata-model
1401                         $common = array_merge( $common, array(
1402                             'itemid', 'itemprop', 'itemref', 'itemscope', 'itemtype'
1403                         ) );
1404                 }
1405
1406                 $block = array_merge( $common, array( 'align' ) );
1407                 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1408                 $tablecell = array( 'abbr',
1409                                     'axis',
1410                                     'headers',
1411                                     'scope',
1412                                     'rowspan',
1413                                     'colspan',
1414                                     'nowrap', # deprecated
1415                                     'width',  # deprecated
1416                                     'height', # deprecated
1417                                     'bgcolor' # deprecated
1418                                     );
1419
1420                 # Numbers refer to sections in HTML 4.01 standard describing the element.
1421                 # See: http://www.w3.org/TR/html4/
1422                 $whitelist = array (
1423                         # 7.5.4
1424                         'div'        => $block,
1425                         'center'     => $common, # deprecated
1426                         'span'       => $block, # ??
1427
1428                         # 7.5.5
1429                         'h1'         => $block,
1430                         'h2'         => $block,
1431                         'h3'         => $block,
1432                         'h4'         => $block,
1433                         'h5'         => $block,
1434                         'h6'         => $block,
1435
1436                         # 7.5.6
1437                         # address
1438
1439                         # 8.2.4
1440                         # bdo
1441
1442                         # 9.2.1
1443                         'em'         => $common,
1444                         'strong'     => $common,
1445                         'cite'       => $common,
1446                         'dfn'        => $common,
1447                         'code'       => $common,
1448                         # samp
1449                         # kbd
1450                         'var'        => $common,
1451                         'abbr'       => $common,
1452                         # acronym
1453
1454                         # 9.2.2
1455                         'blockquote' => array_merge( $common, array( 'cite' ) ),
1456                         # q
1457
1458                         # 9.2.3
1459                         'sub'        => $common,
1460                         'sup'        => $common,
1461
1462                         # 9.3.1
1463                         'p'          => $block,
1464
1465                         # 9.3.2
1466                         'br'         => array( 'id', 'class', 'title', 'style', 'clear' ),
1467
1468                         # 9.3.4
1469                         'pre'        => array_merge( $common, array( 'width' ) ),
1470
1471                         # 9.4
1472                         'ins'        => array_merge( $common, array( 'cite', 'datetime' ) ),
1473                         'del'        => array_merge( $common, array( 'cite', 'datetime' ) ),
1474
1475                         # 10.2
1476                         'ul'         => array_merge( $common, array( 'type' ) ),
1477                         'ol'         => array_merge( $common, array( 'type', 'start' ) ),
1478                         'li'         => array_merge( $common, array( 'type', 'value' ) ),
1479
1480                         # 10.3
1481                         'dl'         => $common,
1482                         'dd'         => $common,
1483                         'dt'         => $common,
1484
1485                         # 11.2.1
1486                         'table'      => array_merge( $common,
1487                                                                 array( 'summary', 'width', 'border', 'frame',
1488                                                                                 'rules', 'cellspacing', 'cellpadding',
1489                                                                                 'align', 'bgcolor',
1490                                                                 ) ),
1491
1492                         # 11.2.2
1493                         'caption'    => array_merge( $common, array( 'align' ) ),
1494
1495                         # 11.2.3
1496                         'thead'      => array_merge( $common, $tablealign ),
1497                         'tfoot'      => array_merge( $common, $tablealign ),
1498                         'tbody'      => array_merge( $common, $tablealign ),
1499
1500                         # 11.2.4
1501                         'colgroup'   => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1502                         'col'        => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1503
1504                         # 11.2.5
1505                         'tr'         => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1506
1507                         # 11.2.6
1508                         'td'         => array_merge( $common, $tablecell, $tablealign ),
1509                         'th'         => array_merge( $common, $tablecell, $tablealign ),
1510
1511                         # 12.2 # NOTE: <a> is not allowed directly, but the attrib whitelist is used from the Parser object
1512                         'a'          => array_merge( $common, array( 'href', 'rel', 'rev' ) ), # rel/rev esp. for RDFa
1513
1514                         # 13.2
1515                         # Not usually allowed, but may be used for extension-style hooks
1516                         # such as <math> when it is rasterized, or if $wgAllowImageTag is
1517                         # true
1518                         'img'        => array_merge( $common, array( 'alt', 'src', 'width', 'height' ) ),
1519
1520                         # 15.2.1
1521                         'tt'         => $common,
1522                         'b'          => $common,
1523                         'i'          => $common,
1524                         'big'        => $common,
1525                         'small'      => $common,
1526                         'strike'     => $common,
1527                         's'          => $common,
1528                         'u'          => $common,
1529
1530                         # 15.2.2
1531                         'font'       => array_merge( $common, array( 'size', 'color', 'face' ) ),
1532                         # basefont
1533
1534                         # 15.3
1535                         'hr'         => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1536
1537                         # XHTML Ruby annotation text module, simple ruby only.
1538                         # http://www.w3c.org/TR/ruby/
1539                         'ruby'       => $common,
1540                         # rbc
1541                         # rtc
1542                         'rb'         => $common,
1543                         'rt'         => $common, #array_merge( $common, array( 'rbspan' ) ),
1544                         'rp'         => $common,
1545
1546                         # MathML root element, where used for extensions
1547                         # 'title' may not be 100% valid here; it's XHTML
1548                         # http://www.w3.org/TR/REC-MathML/
1549                         'math'       => array( 'class', 'style', 'id', 'title' ),
1550                         );
1551                 return $whitelist;
1552         }
1553
1554         /**
1555          * Take a fragment of (potentially invalid) HTML and return
1556          * a version with any tags removed, encoded as plain text.
1557          *
1558          * Warning: this return value must be further escaped for literal
1559          * inclusion in HTML output as of 1.10!
1560          *
1561          * @param $text String: HTML fragment
1562          * @return String
1563          */
1564         static function stripAllTags( $text ) {
1565                 # Actual <tags>
1566                 $text = StringUtils::delimiterReplace( '<', '>', '', $text );
1567
1568                 # Normalize &entities and whitespace
1569                 $text = self::decodeCharReferences( $text );
1570                 $text = self::normalizeWhitespace( $text );
1571
1572                 return $text;
1573         }
1574
1575         /**
1576          * Hack up a private DOCTYPE with HTML's standard entity declarations.
1577          * PHP 4 seemed to know these if you gave it an HTML doctype, but
1578          * PHP 5.1 doesn't.
1579          *
1580          * Use for passing XHTML fragments to PHP's XML parsing functions
1581          *
1582          * @return String
1583          */
1584         static function hackDocType() {
1585                 global $wgHtmlEntities;
1586                 $out = "<!DOCTYPE html [\n";
1587                 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1588                         $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1589                 }
1590                 $out .= "]>\n";
1591                 return $out;
1592         }
1593
1594         static function cleanUrl( $url ) {
1595                 # Normalize any HTML entities in input. They will be
1596                 # re-escaped by makeExternalLink().
1597                 $url = Sanitizer::decodeCharReferences( $url );
1598
1599                 # Escape any control characters introduced by the above step
1600                 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F\|]/e', "urlencode('\\0')", $url );
1601
1602                 # Validate hostname portion
1603                 $matches = array();
1604                 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1605                         list( /* $whole */, $protocol, $host, $rest ) = $matches;
1606
1607                         // Characters that will be ignored in IDNs.
1608                         // http://tools.ietf.org/html/3454#section-3.1
1609                         // Strip them before further processing so blacklists and such work.
1610                         $strip = "/
1611                                 \\s|          # general whitespace
1612                                 \xc2\xad|     # 00ad SOFT HYPHEN
1613                                 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1614                                 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1615                                 \xe2\x81\xa0| # 2060 WORD JOINER
1616                                 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1617                                 \xcd\x8f|     # 034f COMBINING GRAPHEME JOINER
1618                                 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1619                                 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1620                                 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1621                                 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1622                                 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1623                                 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1624                                 /xuD";
1625
1626                         $host = preg_replace( $strip, '', $host );
1627
1628                         // @todo Fixme: validate hostnames here
1629
1630                         return $protocol . $host . $rest;
1631                 } else {
1632                         return $url;
1633                 }
1634         }
1635
1636 }