includes/Sanitizer.php

   1 <?php
   2 /**
   3  * XHTML sanitizer for MediaWiki
   4  *
   5  * Copyright © 2002-2005 Brion Vibber <brion@pobox.com> et al
   6  * http://www.mediawiki.org/
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along
  19  * with this program; if not, write to the Free Software Foundation, Inc.,
  20  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  21  * http://www.gnu.org/copyleft/gpl.html
  22  *
  23  * @file
  24  * @ingroup Parser
  25  */
  26
  27 /**
  28  * Regular expression to match various types of character references in
  29  * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
  30  */
  31 define( 'MW_CHAR_REFS_REGEX',
  32         '/&([A-Za-z0-9\x80-\xff]+);
  33          |&\#([0-9]+);
  34          |&\#x([0-9A-Za-z]+);
  35          |&\#X([0-9A-Za-z]+);
  36          |(&)/x' );
  37
  38 /**
  39  * Regular expression to match HTML/XML attribute pairs within a tag.
  40  * Allows some... latitude.
  41  * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
  42  */
  43 $attrib_first = '[:A-Z_a-z]';
  44 $attrib = '[:A-Z_a-z-.0-9]';
  45 $space = '[\x09\x0a\x0d\x20]';
  46 define( 'MW_ATTRIBS_REGEX',
  47         "/(?:^|$space)({$attrib_first}{$attrib}*)
  48           ($space*=$space*
  49                 (?:
  50                  # The attribute value: quoted or alone
  51                   \"([^<\"]*)\"
  52                  | '([^<']*)'
  53                  |  ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
  54                  |  (\#[0-9a-fA-F]+) # Technically wrong, but lots of
  55                                                          # colors are specified like this.
  56                                                          # We'll be normalizing it.
  57                 )
  58            )?(?=$space|\$)/sx" );
  59
  60 /**
  61  * Regular expression to match URIs that could trigger script execution
  62  */
  63 define( 'MW_EVIL_URI_PATTERN', '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i' );
  64
  65 /**
  66  * Regular expression to match namespace attributes
  67  */
  68 define( 'MW_XMLNS_ATTRIBUTE_PATTRN', "/^xmlns:$attrib+$/" );
  69
  70 /**
  71  * List of all named character entities defined in HTML 4.01
  72  * http://www.w3.org/TR/html4/sgml/entities.html
  73  * @private
  74  */
  75 global $wgHtmlEntities;
  76 $wgHtmlEntities = array(
  77         'Aacute'   => 193,
  78         'aacute'   => 225,
  79         'Acirc'    => 194,
  80         'acirc'    => 226,
  81         'acute'    => 180,
  82         'AElig'    => 198,
  83         'aelig'    => 230,
  84         'Agrave'   => 192,
  85         'agrave'   => 224,
  86         'alefsym'  => 8501,
  87         'Alpha'    => 913,
  88         'alpha'    => 945,
  89         'amp'      => 38,
  90         'and'      => 8743,
  91         'ang'      => 8736,
  92         'Aring'    => 197,
  93         'aring'    => 229,
  94         'asymp'    => 8776,
  95         'Atilde'   => 195,
  96         'atilde'   => 227,
  97         'Auml'     => 196,
  98         'auml'     => 228,
  99         'bdquo'    => 8222,
 100         'Beta'     => 914,
 101         'beta'     => 946,
 102         'brvbar'   => 166,
 103         'bull'     => 8226,
 104         'cap'      => 8745,
 105         'Ccedil'   => 199,
 106         'ccedil'   => 231,
 107         'cedil'    => 184,
 108         'cent'     => 162,
 109         'Chi'      => 935,
 110         'chi'      => 967,
 111         'circ'     => 710,
 112         'clubs'    => 9827,
 113         'cong'     => 8773,
 114         'copy'     => 169,
 115         'crarr'    => 8629,
 116         'cup'      => 8746,
 117         'curren'   => 164,
 118         'dagger'   => 8224,
 119         'Dagger'   => 8225,
 120         'darr'     => 8595,
 121         'dArr'     => 8659,
 122         'deg'      => 176,
 123         'Delta'    => 916,
 124         'delta'    => 948,
 125         'diams'    => 9830,
 126         'divide'   => 247,
 127         'Eacute'   => 201,
 128         'eacute'   => 233,
 129         'Ecirc'    => 202,
 130         'ecirc'    => 234,
 131         'Egrave'   => 200,
 132         'egrave'   => 232,
 133         'empty'    => 8709,
 134         'emsp'     => 8195,
 135         'ensp'     => 8194,
 136         'Epsilon'  => 917,
 137         'epsilon'  => 949,
 138         'equiv'    => 8801,
 139         'Eta'      => 919,
 140         'eta'      => 951,
 141         'ETH'      => 208,
 142         'eth'      => 240,
 143         'Euml'     => 203,
 144         'euml'     => 235,
 145         'euro'     => 8364,
 146         'exist'    => 8707,
 147         'fnof'     => 402,
 148         'forall'   => 8704,
 149         'frac12'   => 189,
 150         'frac14'   => 188,
 151         'frac34'   => 190,
 152         'frasl'    => 8260,
 153         'Gamma'    => 915,
 154         'gamma'    => 947,
 155         'ge'       => 8805,
 156         'gt'       => 62,
 157         'harr'     => 8596,
 158         'hArr'     => 8660,
 159         'hearts'   => 9829,
 160         'hellip'   => 8230,
 161         'Iacute'   => 205,
 162         'iacute'   => 237,
 163         'Icirc'    => 206,
 164         'icirc'    => 238,
 165         'iexcl'    => 161,
 166         'Igrave'   => 204,
 167         'igrave'   => 236,
 168         'image'    => 8465,
 169         'infin'    => 8734,
 170         'int'      => 8747,
 171         'Iota'     => 921,
 172         'iota'     => 953,
 173         'iquest'   => 191,
 174         'isin'     => 8712,
 175         'Iuml'     => 207,
 176         'iuml'     => 239,
 177         'Kappa'    => 922,
 178         'kappa'    => 954,
 179         'Lambda'   => 923,
 180         'lambda'   => 955,
 181         'lang'     => 9001,
 182         'laquo'    => 171,
 183         'larr'     => 8592,
 184         'lArr'     => 8656,
 185         'lceil'    => 8968,
 186         'ldquo'    => 8220,
 187         'le'       => 8804,
 188         'lfloor'   => 8970,
 189         'lowast'   => 8727,
 190         'loz'      => 9674,
 191         'lrm'      => 8206,
 192         'lsaquo'   => 8249,
 193         'lsquo'    => 8216,
 194         'lt'       => 60,
 195         'macr'     => 175,
 196         'mdash'    => 8212,
 197         'micro'    => 181,
 198         'middot'   => 183,
 199         'minus'    => 8722,
 200         'Mu'       => 924,
 201         'mu'       => 956,
 202         'nabla'    => 8711,
 203         'nbsp'     => 160,
 204         'ndash'    => 8211,
 205         'ne'       => 8800,
 206         'ni'       => 8715,
 207         'not'      => 172,
 208         'notin'    => 8713,
 209         'nsub'     => 8836,
 210         'Ntilde'   => 209,
 211         'ntilde'   => 241,
 212         'Nu'       => 925,
 213         'nu'       => 957,
 214         'Oacute'   => 211,
 215         'oacute'   => 243,
 216         'Ocirc'    => 212,
 217         'ocirc'    => 244,
 218         'OElig'    => 338,
 219         'oelig'    => 339,
 220         'Ograve'   => 210,
 221         'ograve'   => 242,
 222         'oline'    => 8254,
 223         'Omega'    => 937,
 224         'omega'    => 969,
 225         'Omicron'  => 927,
 226         'omicron'  => 959,
 227         'oplus'    => 8853,
 228         'or'       => 8744,
 229         'ordf'     => 170,
 230         'ordm'     => 186,
 231         'Oslash'   => 216,
 232         'oslash'   => 248,
 233         'Otilde'   => 213,
 234         'otilde'   => 245,
 235         'otimes'   => 8855,
 236         'Ouml'     => 214,
 237         'ouml'     => 246,
 238         'para'     => 182,
 239         'part'     => 8706,
 240         'permil'   => 8240,
 241         'perp'     => 8869,
 242         'Phi'      => 934,
 243         'phi'      => 966,
 244         'Pi'       => 928,
 245         'pi'       => 960,
 246         'piv'      => 982,
 247         'plusmn'   => 177,
 248         'pound'    => 163,
 249         'prime'    => 8242,
 250         'Prime'    => 8243,
 251         'prod'     => 8719,
 252         'prop'     => 8733,
 253         'Psi'      => 936,
 254         'psi'      => 968,
 255         'quot'     => 34,
 256         'radic'    => 8730,
 257         'rang'     => 9002,
 258         'raquo'    => 187,
 259         'rarr'     => 8594,
 260         'rArr'     => 8658,
 261         'rceil'    => 8969,
 262         'rdquo'    => 8221,
 263         'real'     => 8476,
 264         'reg'      => 174,
 265         'rfloor'   => 8971,
 266         'Rho'      => 929,
 267         'rho'      => 961,
 268         'rlm'      => 8207,
 269         'rsaquo'   => 8250,
 270         'rsquo'    => 8217,
 271         'sbquo'    => 8218,
 272         'Scaron'   => 352,
 273         'scaron'   => 353,
 274         'sdot'     => 8901,
 275         'sect'     => 167,
 276         'shy'      => 173,
 277         'Sigma'    => 931,
 278         'sigma'    => 963,
 279         'sigmaf'   => 962,
 280         'sim'      => 8764,
 281         'spades'   => 9824,
 282         'sub'      => 8834,
 283         'sube'     => 8838,
 284         'sum'      => 8721,
 285         'sup'      => 8835,
 286         'sup1'     => 185,
 287         'sup2'     => 178,
 288         'sup3'     => 179,
 289         'supe'     => 8839,
 290         'szlig'    => 223,
 291         'Tau'      => 932,
 292         'tau'      => 964,
 293         'there4'   => 8756,
 294         'Theta'    => 920,
 295         'theta'    => 952,
 296         'thetasym' => 977,
 297         'thinsp'   => 8201,
 298         'THORN'    => 222,
 299         'thorn'    => 254,
 300         'tilde'    => 732,
 301         'times'    => 215,
 302         'trade'    => 8482,
 303         'Uacute'   => 218,
 304         'uacute'   => 250,
 305         'uarr'     => 8593,
 306         'uArr'     => 8657,
 307         'Ucirc'    => 219,
 308         'ucirc'    => 251,
 309         'Ugrave'   => 217,
 310         'ugrave'   => 249,
 311         'uml'      => 168,
 312         'upsih'    => 978,
 313         'Upsilon'  => 933,
 314         'upsilon'  => 965,
 315         'Uuml'     => 220,
 316         'uuml'     => 252,
 317         'weierp'   => 8472,
 318         'Xi'       => 926,
 319         'xi'       => 958,
 320         'Yacute'   => 221,
 321         'yacute'   => 253,
 322         'yen'      => 165,
 323         'Yuml'     => 376,
 324         'yuml'     => 255,
 325         'Zeta'     => 918,
 326         'zeta'     => 950,
 327         'zwj'      => 8205,
 328         'zwnj'     => 8204 );
 329
 330 /**
 331  * Character entity aliases accepted by MediaWiki
 332  */
 333 global $wgHtmlEntityAliases;
 334 $wgHtmlEntityAliases = array(
 335         'רלמ' => 'rlm',
 336         'رلم' => 'rlm',
 337 );
 338
 339
 340 /**
 341  * XHTML sanitizer for MediaWiki
 342  * @ingroup Parser
 343  */
 344 class Sanitizer {
 345         /**
 346          * Cleans up HTML, removes dangerous tags and attributes, and
 347          * removes HTML comments
 348          * @private
 349          * @param $text String
 350          * @param $processCallback Callback to do any variable or parameter replacements in HTML attribute values
 351          * @param $args Array for the processing callback
 352          * @param $extratags Array for any extra tags to include
 353          * @param $removetags Array for any tags (default or extra) to exclude
 354          * @return string
 355          */
 356         static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array(), $removetags = array() ) {
 357                 global $wgUseTidy;
 358
 359                 static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
 360                         $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
 361
 362                 wfProfileIn( __METHOD__ );
 363
 364                 if ( !$staticInitialised ) {
 365
 366                         $htmlpairsStatic = array( # Tags that must be closed
 367                                 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
 368                                 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
 369                                 'strike', 'strong', 'tt', 'var', 'div', 'center',
 370                                 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
 371                                 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u', 'abbr', 'dfn'
 372                         );
 373                         $htmlsingle = array(
 374                                 'br', 'hr', 'li', 'dt', 'dd'
 375                         );
 376                         $htmlsingleonly = array( # Elements that cannot have close tags
 377                                 'br', 'hr'
 378                         );
 379                         $htmlnest = array( # Tags that can be nested--??
 380                                 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
 381                                 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
 382                         );
 383                         $tabletags = array( # Can only appear inside table, we will close them
 384                                 'td', 'th', 'tr',
 385                         );
 386                         $htmllist = array( # Tags used by list
 387                                 'ul','ol',
 388                         );
 389                         $listtags = array( # Tags that can appear in a list
 390                                 'li',
 391                         );
 392
 393                         global $wgAllowImageTag;
 394                         if ( $wgAllowImageTag ) {
 395                                 $htmlsingle[] = 'img';
 396                                 $htmlsingleonly[] = 'img';
 397                         }
 398
 399                         $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
 400                         $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
 401
 402                         # Convert them all to hashtables for faster lookup
 403                         $vars = array( 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
 404                                 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' );
 405                         foreach ( $vars as $var ) {
 406                                 $$var = array_flip( $$var );
 407                         }
 408                         $staticInitialised = true;
 409                 }
 410                 # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
 411                 $extratags = array_flip( $extratags );
 412                 $removetags = array_flip( $removetags );
 413                 $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
 414                 $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ) , $removetags );
 415
 416                 # Remove HTML comments
 417                 $text = Sanitizer::removeHTMLcomments( $text );
 418                 $bits = explode( '<', $text );
 419                 $text = str_replace( '>', '&gt;', array_shift( $bits ) );
 420                 if ( !$wgUseTidy ) {
 421                         $tagstack = $tablestack = array();
 422                         foreach ( $bits as $x ) {
 423                                 $regs = array();
 424                                 # $slash: Does the current element start with a '/'?
 425                                 # $t: Current element name
 426                                 # $params: String between element name and >
 427                                 # $brace: Ending '>' or '/>'
 428                                 # $rest: Everything until the next element of $bits
 429                                 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
 430                                         list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
 431                                 } else {
 432                                         $slash = $t = $params = $brace = $rest = null;
 433                                 }
 434
 435                                 $badtag = false;
 436                                 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
 437                                         # Check our stack
 438                                         if ( $slash && isset( $htmlsingleonly[$t] ) ) {
 439                                                 $badtag = true;
 440                                         } elseif ( $slash ) {
 441                                                 # Closing a tag... is it the one we just opened?
 442                                                 $ot = @array_pop( $tagstack );
 443                                                 if ( $ot != $t ) {
 444                                                         if ( isset( $htmlsingleallowed[$ot] ) ) {
 445                                                                 # Pop all elements with an optional close tag
 446                                                                 # and see if we find a match below them
 447                                                                 $optstack = array();
 448                                                                 array_push( $optstack, $ot );
 449                                                                 $ot = @array_pop( $tagstack );
 450                                                                 while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
 451                                                                         array_push( $optstack, $ot );
 452                                                                         $ot = @array_pop( $tagstack );
 453                                                                 }
 454                                                                 if ( $t != $ot ) {
 455                                                                         # No match. Push the optional elements back again
 456                                                                         $badtag = true;
 457                                                                         while ( $ot = @array_pop( $optstack ) ) {
 458                                                                                 array_push( $tagstack, $ot );
 459                                                                         }
 460                                                                 }
 461                                                         } else {
 462                                                                 @array_push( $tagstack, $ot );
 463                                                                 # <li> can be nested in <ul> or <ol>, skip those cases:
 464                                                                 if ( !isset( $htmllist[$ot] ) || !isset( $listtags[$t] ) ) {
 465                                                                         $badtag = true;
 466                                                                 }
 467                                                         }
 468                                                 } else {
 469                                                         if ( $t == 'table' ) {
 470                                                                 $tagstack = array_pop( $tablestack );
 471                                                         }
 472                                                 }
 473                                                 $newparams = '';
 474                                         } else {
 475                                                 # Keep track for later
 476                                                 if ( isset( $tabletags[$t] ) &&
 477                                                 !in_array( 'table', $tagstack ) ) {
 478                                                         $badtag = true;
 479                                                 } elseif ( in_array( $t, $tagstack ) &&
 480                                                 !isset( $htmlnest [$t ] ) ) {
 481                                                         $badtag = true;
 482                                                 # Is it a self closed htmlpair ? (bug 5487)
 483                                                 } elseif ( $brace == '/>' &&
 484                                                 isset( $htmlpairs[$t] ) ) {
 485                                                         $badtag = true;
 486                                                 } elseif ( isset( $htmlsingleonly[$t] ) ) {
 487                                                         # Hack to force empty tag for uncloseable elements
 488                                                         $brace = '/>';
 489                                                 } elseif ( isset( $htmlsingle[$t] ) ) {
 490                                                         # Hack to not close $htmlsingle tags
 491                                                         $brace = null;
 492                                                 } elseif ( isset( $tabletags[$t] )
 493                                                 && in_array( $t, $tagstack ) ) {
 494                                                         // New table tag but forgot to close the previous one
 495                                                         $text .= "</$t>";
 496                                                 } else {
 497                                                         if ( $t == 'table' ) {
 498                                                                 array_push( $tablestack, $tagstack );
 499                                                                 $tagstack = array();
 500                                                         }
 501                                                         array_push( $tagstack, $t );
 502                                                 }
 503
 504                                                 # Replace any variables or template parameters with
 505                                                 # plaintext results.
 506                                                 if( is_callable( $processCallback ) ) {
 507                                                         call_user_func_array( $processCallback, array( &$params, $args ) );
 508                                                 }
 509
 510                                                 # Strip non-approved attributes from the tag
 511                                                 $newparams = Sanitizer::fixTagAttributes( $params, $t );
 512                                         }
 513                                         if ( !$badtag ) {
 514                                                 $rest = str_replace( '>', '&gt;', $rest );
 515                                                 $close = ( $brace == '/>' && !$slash ) ? ' /' : '';
 516                                                 $text .= "<$slash$t$newparams$close>$rest";
 517                                                 continue;
 518                                         }
 519                                 }
 520                                 $text .= '&lt;' . str_replace( '>', '&gt;', $x);
 521                         }
 522                         # Close off any remaining tags
 523                         while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
 524                                 $text .= "</$t>\n";
 525                                 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
 526                         }
 527                 } else {
 528                         # this might be possible using tidy itself
 529                         foreach ( $bits as $x ) {
 530                                 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
 531                                 $x, $regs );
 532                                 @list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
 533                                 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
 534                                         if( is_callable( $processCallback ) ) {
 535                                                 call_user_func_array( $processCallback, array( &$params, $args ) );
 536                                         }
 537                                         $newparams = Sanitizer::fixTagAttributes( $params, $t );
 538                                         $rest = str_replace( '>', '&gt;', $rest );
 539                                         $text .= "<$slash$t$newparams$brace$rest";
 540                                 } else {
 541                                         $text .= '&lt;' . str_replace( '>', '&gt;', $x);
 542                                 }
 543                         }
 544                 }
 545                 wfProfileOut( __METHOD__ );
 546                 return $text;
 547         }
 548
 549         /**
 550          * Remove '<!--', '-->', and everything between.
 551          * To avoid leaving blank lines, when a comment is both preceded
 552          * and followed by a newline (ignoring spaces), trim leading and
 553          * trailing spaces and one of the newlines.
 554          *
 555          * @private
 556          * @param $text String
 557          * @return string
 558          */
 559         static function removeHTMLcomments( $text ) {
 560                 wfProfileIn( __METHOD__ );
 561                 while (($start = strpos($text, '<!--')) !== false) {
 562                         $end = strpos($text, '-->', $start + 4);
 563                         if ($end === false) {
 564                                 # Unterminated comment; bail out
 565                                 break;
 566                         }
 567
 568                         $end += 3;
 569
 570                         # Trim space and newline if the comment is both
 571                         # preceded and followed by a newline
 572                         $spaceStart = max($start - 1, 0);
 573                         $spaceLen = $end - $spaceStart;
 574                         while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
 575                                 $spaceStart--;
 576                                 $spaceLen++;
 577                         }
 578                         while (substr($text, $spaceStart + $spaceLen, 1) === ' ')
 579                                 $spaceLen++;
 580                         if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart + $spaceLen, 1) === "\n") {
 581                                 # Remove the comment, leading and trailing
 582                                 # spaces, and leave only one newline.
 583                                 $text = substr_replace($text, "\n", $spaceStart, $spaceLen + 1);
 584                         }
 585                         else {
 586                                 # Remove just the comment.
 587                                 $text = substr_replace($text, '', $start, $end - $start);
 588                         }
 589                 }
 590                 wfProfileOut( __METHOD__ );
 591                 return $text;
 592         }
 593
 594         /**
 595          * Take an array of attribute names and values and normalize or discard
 596          * illegal values for the given element type.
 597          *
 598          * - Discards attributes not on a whitelist for the given element
 599          * - Unsafe style attributes are discarded
 600          * - Invalid id attributes are reencoded
 601          *
 602          * @param $attribs Array
 603          * @param $element String
 604          * @return Array
 605          *
 606          * @todo Check for legal values where the DTD limits things.
 607          * @todo Check for unique id attribute :P
 608          */
 609         static function validateTagAttributes( $attribs, $element ) {
 610                 return Sanitizer::validateAttributes( $attribs,
 611                         Sanitizer::attributeWhitelist( $element ) );
 612         }
 613
 614         /**
 615          * Take an array of attribute names and values and normalize or discard
 616          * illegal values for the given whitelist.
 617          *
 618          * - Discards attributes not the given whitelist
 619          * - Unsafe style attributes are discarded
 620          * - Invalid id attributes are reencoded
 621          *
 622          * @param $attribs Array
 623          * @param $whitelist Array: list of allowed attribute names
 624          * @return Array
 625          *
 626          * @todo Check for legal values where the DTD limits things.
 627          * @todo Check for unique id attribute :P
 628          */
 629         static function validateAttributes( $attribs, $whitelist ) {
 630                 global $wgAllowRdfaAttributes, $wgAllowMicrodataAttributes, $wgHtml5;
 631
 632                 $whitelist = array_flip( $whitelist );
 633                 $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
 634
 635                 $out = array();
 636                 foreach( $attribs as $attribute => $value ) {
 637                         #allow XML namespace declaration if RDFa is enabled
 638                         if ( $wgAllowRdfaAttributes && preg_match( MW_XMLNS_ATTRIBUTE_PATTRN, $attribute ) ) {
 639                                 if ( !preg_match( MW_EVIL_URI_PATTERN, $value ) ) {
 640                                         $out[$attribute] = $value;
 641                                 }
 642
 643                                 continue;
 644                         }
 645
 646                         # Allow any attribute beginning with "data-", if in HTML5 mode
 647                         if ( !($wgHtml5 && preg_match( '/^data-/i', $attribute )) && !isset( $whitelist[$attribute] ) ) {
 648                                 continue;
 649                         }
 650
 651                         # Strip javascript "expression" from stylesheets.
 652                         # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
 653                         if( $attribute == 'style' ) {
 654                                 $value = Sanitizer::checkCss( $value );
 655                         }
 656
 657                         if ( $attribute === 'id' ) {
 658                                 $value = Sanitizer::escapeId( $value, 'noninitial' );
 659                         }
 660
 661                         //RDFa and microdata properties allow URLs, URIs and/or CURIs. check them for sanity
 662                         if ( $attribute === 'rel' || $attribute === 'rev' ||
 663                                 $attribute === 'about' || $attribute === 'property' || $attribute === 'resource' || #RDFa
 664                                 $attribute === 'datatype' || $attribute === 'typeof' ||                             #RDFa
 665                                 $attribute === 'itemid' || $attribute === 'itemprop' || $attribute === 'itemref' || #HTML5 microdata
 666                                 $attribute === 'itemscope' || $attribute === 'itemtype' ) {                         #HTML5 microdata
 667
 668                                 //Paranoia. Allow "simple" values but suppress javascript
 669                                 if ( preg_match( MW_EVIL_URI_PATTERN, $value ) ) {
 670                                         continue;
 671                                 }
 672                         }
 673
 674                         # NOTE: even though elements using href/src are not allowed directly, supply
 675                         #       validation code that can be used by tag hook handlers, etc
 676                         if ( $attribute === 'href' || $attribute === 'src' ) {
 677                                 if ( !preg_match( $hrefExp, $value ) ) {
 678                                         continue; //drop any href or src attributes not using an allowed protocol.
 679                                                   //NOTE: this also drops all relative URLs
 680                                 }
 681                         }
 682
 683                         // If this attribute was previously set, override it.
 684                         // Output should only have one attribute of each name.
 685                         $out[$attribute] = $value;
 686                 }
 687
 688                 if ( $wgAllowMicrodataAttributes ) {
 689                         # There are some complicated validity constraints we need to
 690                         # enforce here.  First of all, we don't want to allow non-standard
 691                         # itemtypes.
 692                         $allowedTypes = array(
 693                                 'http://microformats.org/profile/hcard',
 694                                 'http://microformats.org/profile/hcalendar#vevent',
 695                                 'http://n.whatwg.org/work',
 696                         );
 697                         if ( isset( $out['itemtype'] ) && !in_array( $out['itemtype'],
 698                         $allowedTypes ) ) {
 699                                 # Kill everything
 700                                 unset( $out['itemscope'] );
 701                         }
 702                         # itemtype, itemid, itemref don't make sense without itemscope
 703                         if ( !array_key_exists( 'itemscope', $out ) ) {
 704                                 unset( $out['itemtype'] );
 705                                 unset( $out['itemid'] );
 706                                 unset( $out['itemref'] );
 707                         }
 708                         # TODO: Strip itemprop if we aren't descendants of an itemscope.
 709                 }
 710                 return $out;
 711         }
 712
 713         /**
 714          * Merge two sets of HTML attributes.  Conflicting items in the second set
 715          * will override those in the first, except for 'class' attributes which
 716          * will be combined (if they're both strings).
 717          *
 718          * @todo implement merging for other attributes such as style
 719          * @param $a Array
 720          * @param $b Array
 721          * @return array
 722          */
 723         static function mergeAttributes( $a, $b ) {
 724                 $out = array_merge( $a, $b );
 725                 if( isset( $a['class'] ) && isset( $b['class'] )
 726                 && is_string( $a['class'] ) && is_string( $b['class'] )
 727                 && $a['class'] !== $b['class'] ) {
 728                         $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
 729                                 -1, PREG_SPLIT_NO_EMPTY );
 730                         $out['class'] = implode( ' ', array_unique( $classes ) );
 731                 }
 732                 return $out;
 733         }
 734
 735         /**
 736          * Pick apart some CSS and check it for forbidden or unsafe structures.
 737          * Returns a sanitized string, or false if it was just too evil.
 738          *
 739          * Currently URL references, 'expression', 'tps' are forbidden.
 740          *
 741          * @param $value String
 742          * @return Mixed
 743          */
 744         static function checkCss( $value ) {
 745                 $value = Sanitizer::decodeCharReferences( $value );
 746
 747                 // Remove any comments; IE gets token splitting wrong
 748                 $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value );
 749
 750                 // Decode escape sequences and line continuation
 751                 // See the grammar in the CSS 2 spec, appendix D.
 752                 static $decodeRegex, $reencodeTable;
 753                 if ( !$decodeRegex ) {
 754                         $space = '[\\x20\\t\\r\\n\\f]';
 755                         $nl = '(?:\\n|\\r\\n|\\r|\\f)';
 756                         $backslash = '\\\\';
 757                         $decodeRegex = "/ $backslash
 758                                 (?:
 759                                         ($nl) |  # 1. Line continuation
 760                                         ([0-9A-Fa-f]{1,6})$space? |  # 2. character number
 761                                         (.) | # 3. backslash cancelling special meaning
 762                                         () | # 4. backslash at end of string
 763                                 )/xu";
 764                 }
 765                 $value = preg_replace_callback( $decodeRegex,
 766                         array( __CLASS__, 'cssDecodeCallback' ), $value );
 767
 768                 // Reject problematic keywords and control characters
 769                 if ( preg_match( '/[\000-\010\016-\037\177]/', $value ) ) {
 770                         return '/* invalid control char */';
 771                 } elseif ( preg_match( '! expression | filter\s*: | accelerator\s*: | url\s*\( !ix', $value ) ) {
 772                         return '/* insecure input */';
 773                 }
 774                 return $value;
 775         }
 776
 777         static function cssDecodeCallback( $matches ) {
 778                 if ( $matches[1] !== '' ) {
 779                         // Line continuation
 780                         return '';
 781                 } elseif ( $matches[2] !== '' ) {
 782                         $char = codepointToUtf8( hexdec( $matches[2] ) );
 783                 } elseif ( $matches[3] !== '' ) {
 784                         $char = $matches[3];
 785                 } else {
 786                         $char = '\\';
 787                 }
 788                 if ( $char == "\n" || $char == '"' || $char == "'" || $char == '\\' ) {
 789                         // These characters need to be escaped in strings
 790                         // Clean up the escape sequence to avoid parsing errors by clients
 791                         return '\\' . dechex( ord( $char ) ) . ' ';
 792                 } else {
 793                         // Decode unnecessary escape
 794                         return $char;
 795                 }
 796         }
 797
 798         /**
 799         * Take an associative array of attribute name/value pairs
 800         * and generate a css style representing all the style-related
 801         * attributes. If there already a style attribute in the array,
 802         * it is also included in the value returned.
 803         */
 804         static function styleFromAttributes( $attributes ) {
 805                 $styles = array();
 806
 807                 foreach ( $attributes as $attribute => $value ) {
 808                         if ( $attribute == 'bgcolor' ) {
 809                                 $styles[] = "background-color: $value";
 810                         } else if ( $attribute == 'border' ) {
 811                                 $styles[] = "border-width: $value";
 812                         } else if ( $attribute == 'align' ) {
 813                                 $styles[] = "text-align: $value";
 814                         } else if ( $attribute == 'valign' ) {
 815                                 $styles[] = "vertical-align: $value";
 816                         } else if ( $attribute == 'width' ) {
 817                                 if ( preg_match( '/\d+/', $value ) === false ) {
 818                                       $value .= 'px';
 819                                 }
 820
 821                                 $styles[] = "width: $value";
 822                         } else if ( $attribute == 'height' ) {
 823                                 if ( preg_match( '/\d+/', $value ) === false ) {
 824                                       $value .= 'px';
 825                                 }
 826
 827                                 $styles[] = "height: $value";
 828                         } else if ( $attribute == 'nowrap' ) {
 829                                 if ( $value ) {
 830                                         $styles[] = "white-space: nowrap";
 831                                 }
 832                         }
 833                 }
 834
 835                 if ( isset( $attributes[ 'style' ] ) ) {
 836                         $styles[] = $attributes[ 'style' ];
 837                 }
 838
 839                 if ( !$styles ) return '';
 840                 else return implode( '; ', $styles );
 841         }
 842
 843         /**
 844          * Take a tag soup fragment listing an HTML element's attributes
 845          * and normalize it to well-formed XML, discarding unwanted attributes.
 846          * Output is safe for further wikitext processing, with escaping of
 847          * values that could trigger problems.
 848          *
 849          * - Normalizes attribute names to lowercase
 850          * - Discards attributes not on a whitelist for the given element
 851          * - Turns broken or invalid entities into plaintext
 852          * - Double-quotes all attribute values
 853          * - Attributes without values are given the name as attribute
 854          * - Double attributes are discarded
 855          * - Unsafe style attributes are discarded
 856          * - Prepends space if there are attributes.
 857          *
 858          * @param $text String
 859          * @param $element String
 860          * @param $defaults Array (optional) associative array of default attributes to splice in.
 861          *                      class and style attributes are combined. Otherwise, values from
 862          *                      $attributes take precedence over values from $defaults.
 863          * @return String
 864          */
 865         static function fixTagAttributes( $text, $element, $defaults = null ) {
 866                 if( trim( $text ) == '' ) {
 867                         return '';
 868                 }
 869
 870                 $decoded = Sanitizer::decodeTagAttributes( $text );
 871                 $stripped = Sanitizer::validateTagAttributes( $decoded, $element );
 872                 $attribs = Sanitizer::collapseTagAttributes( $stripped, $defaults );
 873
 874                 return $attribs;
 875         }
 876
 877         /**
 878          * Take an associative array or attribute name/value pairs
 879          * and collapses it to well-formed XML.
 880          * Does not filter attributes.
 881          * Output is safe for further wikitext processing, with escaping of
 882          * values that could trigger problems.
 883          *
 884          * - Double-quotes all attribute values
 885          * - Prepends space if there are attributes.
 886          *
 887          * @param $attributes Array is an associative array of attribute name/value pairs.
 888          *                      Assumed to be sanitized already.
 889          * @param $defaults Array (optional) associative array of default attributes to splice in.
 890          *                      class and style attributes are combined. Otherwise, values from
 891          *                      $attributes take precedence over values from $defaults.
 892          * @return String
 893          */
 894         static function collapseTagAttributes( $attributes, $defaults = null ) {
 895                 if ( $defaults ) {
 896                         foreach( $defaults as $attribute => $value ) {
 897                                 if ( isset( $attributes[ $attribute ] ) ) {
 898                                         if ( $attribute == 'class' ) {
 899                                                 $value .= ' '. $attributes[ $attribute ];
 900                                         } else if ( $attribute == 'style' ) {
 901                                                 $value .= '; ' . $attributes[ $attribute ];
 902                                         } else {
 903                                                 continue;
 904                                         }
 905                                 }
 906
 907                                 $attributes[ $attribute ] = $value;
 908                         }
 909                 }
 910
 911                 $chunks = array();
 912
 913                 foreach( $attributes as $attribute => $value ) {
 914                         $encAttribute = htmlspecialchars( $attribute );
 915                         $encValue = Sanitizer::safeEncodeAttribute( $value );
 916
 917                         $chunks[] = "$encAttribute=\"$encValue\"";
 918                 }
 919                 return count( $chunks ) ? ' ' . implode( ' ', $chunks ) : '';
 920         }
 921
 922         /**
 923          * Encode an attribute value for HTML output.
 924          * @param $text String
 925          * @return HTML-encoded text fragment
 926          */
 927         static function encodeAttribute( $text ) {
 928                 $encValue = htmlspecialchars( $text, ENT_QUOTES );
 929
 930                 // Whitespace is normalized during attribute decoding,
 931                 // so if we've been passed non-spaces we must encode them
 932                 // ahead of time or they won't be preserved.
 933                 $encValue = strtr( $encValue, array(
 934                         "\n" => '&#10;',
 935                         "\r" => '&#13;',
 936                         "\t" => '&#9;',
 937                 ) );
 938
 939                 return $encValue;
 940         }
 941
 942         /**
 943          * Encode an attribute value for HTML tags, with extra armoring
 944          * against further wiki processing.
 945          * @param $text String
 946          * @return HTML-encoded text fragment
 947          */
 948         static function safeEncodeAttribute( $text ) {
 949                 $encValue = Sanitizer::encodeAttribute( $text );
 950
 951                 # Templates and links may be expanded in later parsing,
 952                 # creating invalid or dangerous output. Suppress this.
 953                 $encValue = strtr( $encValue, array(
 954                         '<'    => '&lt;',   // This should never happen,
 955                         '>'    => '&gt;',   // we've received invalid input
 956                         '"'    => '&quot;', // which should have been escaped.
 957                         '{'    => '&#123;',
 958                         '['    => '&#91;',
 959                         "''"   => '&#39;&#39;',
 960                         'ISBN' => '&#73;SBN',
 961                         'RFC'  => '&#82;FC',
 962                         'PMID' => '&#80;MID',
 963                         '|'    => '&#124;',
 964                         '__'   => '&#95;_',
 965                 ) );
 966
 967                 # Stupid hack
 968                 $encValue = preg_replace_callback(
 969                         '/(' . wfUrlProtocols() . ')/',
 970                         array( 'Sanitizer', 'armorLinksCallback' ),
 971                         $encValue );
 972                 return $encValue;
 973         }
 974
 975         /**
 976          * Given a value, escape it so that it can be used in an id attribute and
 977          * return it.  This will use HTML5 validation if $wgExperimentalHtmlIds is
 978          * true, allowing anything but ASCII whitespace.  Otherwise it will use
 979          * HTML 4 rules, which means a narrow subset of ASCII, with bad characters
 980          * escaped with lots of dots.
 981          *
 982          * To ensure we don't have to bother escaping anything, we also strip ', ",
 983          * & even if $wgExperimentalIds is true.  TODO: Is this the best tactic?
 984          * We also strip # because it upsets IE6.
 985          *
 986          * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters
 987          *                                                          in the id and
 988          *                                                          name attributes
 989          * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
 990          * @see http://www.whatwg.org/specs/web-apps/current-work/multipage/elements.html#the-id-attribute
 991          *   HTML5 definition of id attribute
 992          *
 993          * @param $id String: id to escape
 994          * @param $options Mixed: string or array of strings (default is array()):
 995          *   'noninitial': This is a non-initial fragment of an id, not a full id,
 996          *       so don't pay attention if the first character isn't valid at the
 997          *       beginning of an id.  Only matters if $wgExperimentalHtmlIds is
 998          *       false.
 999          *   'legacy': Behave the way the old HTML 4-based ID escaping worked even
1000          *       if $wgExperimentalHtmlIds is used, so we can generate extra
1001          *       anchors and links won't break.
1002          * @return String
1003          */
1004         static function escapeId( $id, $options = array() ) {
1005                 global $wgHtml5, $wgExperimentalHtmlIds;
1006                 $options = (array)$options;
1007
1008                 if ( $wgHtml5 && $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) {
1009                         $id = Sanitizer::decodeCharReferences( $id );
1010                         $id = preg_replace( '/[ \t\n\r\f_\'"&#]+/', '_', $id );
1011                         $id = trim( $id, '_' );
1012                         if ( $id === '' ) {
1013                                 # Must have been all whitespace to start with.
1014                                 return '_';
1015                         } else {
1016                                 return $id;
1017                         }
1018                 }
1019
1020                 # HTML4-style escaping
1021                 static $replace = array(
1022                         '%3A' => ':',
1023                         '%' => '.'
1024                 );
1025
1026                 $id = urlencode( Sanitizer::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
1027                 $id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
1028
1029                 if ( !preg_match( '/^[a-zA-Z]/', $id )
1030                 && !in_array( 'noninitial', $options ) )  {
1031                         // Initial character must be a letter!
1032                         $id = "x$id";
1033                 }
1034                 return $id;
1035         }
1036
1037         /**
1038          * Given a value, escape it so that it can be used as a CSS class and
1039          * return it.
1040          *
1041          * @todo For extra validity, input should be validated UTF-8.
1042          *
1043          * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
1044          *
1045          * @param $class String
1046          * @return String
1047          */
1048         static function escapeClass( $class ) {
1049                 // Convert ugly stuff to underscores and kill underscores in ugly places
1050                 return rtrim(preg_replace(
1051                         array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
1052                         '_',
1053                         $class ), '_');
1054         }
1055
1056         /**
1057          * Given HTML input, escape with htmlspecialchars but un-escape entites.
1058          * This allows (generally harmless) entities like &#160; to survive.
1059          *
1060          * @param $html String to escape
1061          * @return String: escaped input
1062          */
1063         static function escapeHtmlAllowEntities( $html ) {
1064                 $html = Sanitizer::decodeCharReferences( $html );
1065                 # It seems wise to escape ' as well as ", as a matter of course.  Can't
1066                 # hurt.
1067                 $html = htmlspecialchars( $html, ENT_QUOTES );
1068                 return $html;
1069         }
1070
1071         /**
1072          * Regex replace callback for armoring links against further processing.
1073          * @param $matches Array
1074          * @return string
1075          */
1076         private static function armorLinksCallback( $matches ) {
1077                 return str_replace( ':', '&#58;', $matches[1] );
1078         }
1079
1080         /**
1081          * Return an associative array of attribute names and values from
1082          * a partial tag string. Attribute names are forces to lowercase,
1083          * character references are decoded to UTF-8 text.
1084          *
1085          * @param $text String
1086          * @return Array
1087          */
1088         public static function decodeTagAttributes( $text ) {
1089                 if( trim( $text ) == '' ) {
1090                         return array();
1091                 }
1092
1093                 $attribs = array();
1094                 $pairs = array();
1095                 if( !preg_match_all(
1096                         MW_ATTRIBS_REGEX,
1097                         $text,
1098                         $pairs,
1099                         PREG_SET_ORDER ) ) {
1100                         return $attribs;
1101                 }
1102
1103                 foreach( $pairs as $set ) {
1104                         $attribute = strtolower( $set[1] );
1105                         $value = Sanitizer::getTagAttributeCallback( $set );
1106
1107                         // Normalize whitespace
1108                         $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1109                         $value = trim( $value );
1110
1111                         // Decode character references
1112                         $attribs[$attribute] = Sanitizer::decodeCharReferences( $value );
1113                 }
1114                 return $attribs;
1115         }
1116
1117         /**
1118          * Pick the appropriate attribute value from a match set from the
1119          * MW_ATTRIBS_REGEX matches.
1120          *
1121          * @param $set Array
1122          * @return String
1123          */
1124         private static function getTagAttributeCallback( $set ) {
1125                 if( isset( $set[6] ) ) {
1126                         # Illegal #XXXXXX color with no quotes.
1127                         return $set[6];
1128                 } elseif( isset( $set[5] ) ) {
1129                         # No quotes.
1130                         return $set[5];
1131                 } elseif( isset( $set[4] ) ) {
1132                         # Single-quoted
1133                         return $set[4];
1134                 } elseif( isset( $set[3] ) ) {
1135                         # Double-quoted
1136                         return $set[3];
1137                 } elseif( !isset( $set[2] ) ) {
1138                         # In XHTML, attributes must have a value.
1139                         # For 'reduced' form, return explicitly the attribute name here.
1140                         return $set[1];
1141                 } else {
1142                         throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1143                 }
1144         }
1145
1146         /**
1147          * Normalize whitespace and character references in an XML source-
1148          * encoded text for an attribute value.
1149          *
1150          * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
1151          * but note that we're not returning the value, but are returning
1152          * XML source fragments that will be slapped into output.
1153          *
1154          * @param $text String
1155          * @return String
1156          */
1157         private static function normalizeAttributeValue( $text ) {
1158                 return str_replace( '"', '&quot;',
1159                         self::normalizeWhitespace(
1160                                 Sanitizer::normalizeCharReferences( $text ) ) );
1161         }
1162
1163         private static function normalizeWhitespace( $text ) {
1164                 return preg_replace(
1165                         '/\r\n|[\x20\x0d\x0a\x09]/',
1166                         ' ',
1167                         $text );
1168         }
1169
1170         /**
1171          * Normalizes whitespace in a section name, such as might be returned
1172          * by Parser::stripSectionName(), for use in the id's that are used for
1173          * section links.
1174          *
1175          * @param $section String
1176          * @return String
1177          */
1178         static function normalizeSectionNameWhitespace( $section ) {
1179                 return trim( preg_replace( '/[ _]+/', ' ', $section ) );
1180         }
1181
1182         /**
1183          * Ensure that any entities and character references are legal
1184          * for XML and XHTML specifically. Any stray bits will be
1185          * &amp;-escaped to result in a valid text fragment.
1186          *
1187          * a. any named char refs must be known in XHTML
1188          * b. any numeric char refs must be legal chars, not invalid or forbidden
1189          * c. use &#x, not &#X
1190          * d. fix or reject non-valid attributes
1191          *
1192          * @param $text String
1193          * @return String
1194          * @private
1195          */
1196         static function normalizeCharReferences( $text ) {
1197                 return preg_replace_callback(
1198                         MW_CHAR_REFS_REGEX,
1199                         array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
1200                         $text );
1201         }
1202         /**
1203          * @param $matches String
1204          * @return String
1205          */
1206         static function normalizeCharReferencesCallback( $matches ) {
1207                 $ret = null;
1208                 if( $matches[1] != '' ) {
1209                         $ret = Sanitizer::normalizeEntity( $matches[1] );
1210                 } elseif( $matches[2] != '' ) {
1211                         $ret = Sanitizer::decCharReference( $matches[2] );
1212                 } elseif( $matches[3] != ''  ) {
1213                         $ret = Sanitizer::hexCharReference( $matches[3] );
1214                 } elseif( $matches[4] != '' ) {
1215                         $ret = Sanitizer::hexCharReference( $matches[4] );
1216                 }
1217                 if( is_null( $ret ) ) {
1218                         return htmlspecialchars( $matches[0] );
1219                 } else {
1220                         return $ret;
1221                 }
1222         }
1223
1224         /**
1225          * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1226          * return the named entity reference as is. If the entity is a
1227          * MediaWiki-specific alias, returns the HTML equivalent. Otherwise,
1228          * returns HTML-escaped text of pseudo-entity source (eg &amp;foo;)
1229          *
1230          * @param $name String
1231          * @return String
1232          */
1233         static function normalizeEntity( $name ) {
1234                 global $wgHtmlEntities, $wgHtmlEntityAliases;
1235                 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1236                         return "&{$wgHtmlEntityAliases[$name]};";
1237                 } elseif( isset( $wgHtmlEntities[$name] ) ) {
1238                         return "&$name;";
1239                 } else {
1240                         return "&amp;$name;";
1241                 }
1242         }
1243
1244         static function decCharReference( $codepoint ) {
1245                 $point = intval( $codepoint );
1246                 if( Sanitizer::validateCodepoint( $point ) ) {
1247                         return sprintf( '&#%d;', $point );
1248                 } else {
1249                         return null;
1250                 }
1251         }
1252
1253         static function hexCharReference( $codepoint ) {
1254                 $point = hexdec( $codepoint );
1255                 if( Sanitizer::validateCodepoint( $point ) ) {
1256                         return sprintf( '&#x%x;', $point );
1257                 } else {
1258                         return null;
1259                 }
1260         }
1261
1262         /**
1263          * Returns true if a given Unicode codepoint is a valid character in XML.
1264          * @param $codepoint Integer
1265          * @return Boolean
1266          */
1267         private static function validateCodepoint( $codepoint ) {
1268                 return ($codepoint ==    0x09)
1269                         || ($codepoint ==    0x0a)
1270                         || ($codepoint ==    0x0d)
1271                         || ($codepoint >=    0x20 && $codepoint <=   0xd7ff)
1272                         || ($codepoint >=  0xe000 && $codepoint <=   0xfffd)
1273                         || ($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
1274         }
1275
1276         /**
1277          * Decode any character references, numeric or named entities,
1278          * in the text and return a UTF-8 string.
1279          *
1280          * @param $text String
1281          * @return String
1282          */
1283         public static function decodeCharReferences( $text ) {
1284                 return preg_replace_callback(
1285                         MW_CHAR_REFS_REGEX,
1286                         array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1287                         $text );
1288         }
1289
1290         /**
1291          * Decode any character references, numeric or named entities,
1292          * in the next and normalize the resulting string. (bug 14952)
1293          *
1294          * This is useful for page titles, not for text to be displayed,
1295          * MediaWiki allows HTML entities to escape normalization as a feature.
1296          *
1297          * @param $text String (already normalized, containing entities)
1298          * @return String (still normalized, without entities)
1299          */
1300         public static function decodeCharReferencesAndNormalize( $text ) {
1301                 global $wgContLang;
1302                 $text = preg_replace_callback(
1303                         MW_CHAR_REFS_REGEX,
1304                         array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1305                         $text, /* limit */ -1, $count );
1306
1307                 if ( $count ) {
1308                         return $wgContLang->normalize( $text );
1309                 } else {
1310                         return $text;
1311                 }
1312         }
1313
1314         /**
1315          * @param $matches String
1316          * @return String
1317          */
1318         static function decodeCharReferencesCallback( $matches ) {
1319                 if( $matches[1] != '' ) {
1320                         return Sanitizer::decodeEntity( $matches[1] );
1321                 } elseif( $matches[2] != '' ) {
1322                         return  Sanitizer::decodeChar( intval( $matches[2] ) );
1323                 } elseif( $matches[3] != ''  ) {
1324                         return  Sanitizer::decodeChar( hexdec( $matches[3] ) );
1325                 } elseif( $matches[4] != '' ) {
1326                         return  Sanitizer::decodeChar( hexdec( $matches[4] ) );
1327                 }
1328                 # Last case should be an ampersand by itself
1329                 return $matches[0];
1330         }
1331
1332         /**
1333          * Return UTF-8 string for a codepoint if that is a valid
1334          * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
1335          * @param $codepoint Integer
1336          * @return String
1337          * @private
1338          */
1339         static function decodeChar( $codepoint ) {
1340                 if( Sanitizer::validateCodepoint( $codepoint ) ) {
1341                         return codepointToUtf8( $codepoint );
1342                 } else {
1343                         return UTF8_REPLACEMENT;
1344                 }
1345         }
1346
1347         /**
1348          * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1349          * return the UTF-8 encoding of that character. Otherwise, returns
1350          * pseudo-entity source (eg &foo;)
1351          *
1352          * @param $name Strings
1353          * @return String
1354          */
1355         static function decodeEntity( $name ) {
1356                 global $wgHtmlEntities, $wgHtmlEntityAliases;
1357                 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1358                         $name = $wgHtmlEntityAliases[$name];
1359                 }
1360                 if( isset( $wgHtmlEntities[$name] ) ) {
1361                         return codepointToUtf8( $wgHtmlEntities[$name] );
1362                 } else {
1363                         return "&$name;";
1364                 }
1365         }
1366
1367         /**
1368          * Fetch the whitelist of acceptable attributes for a given element name.
1369          *
1370          * @param $element String
1371          * @return Array
1372          */
1373         static function attributeWhitelist( $element ) {
1374                 static $list;
1375                 if( !isset( $list ) ) {
1376                         $list = Sanitizer::setupAttributeWhitelist();
1377                 }
1378                 return isset( $list[$element] )
1379                         ? $list[$element]
1380                         : array();
1381         }
1382
1383         /**
1384          * Foreach array key (an allowed HTML element), return an array
1385          * of allowed attributes
1386          * @return Array
1387          */
1388         static function setupAttributeWhitelist() {
1389                 global $wgAllowRdfaAttributes, $wgHtml5, $wgAllowMicrodataAttributes;
1390
1391                 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );
1392
1393                 if ( $wgAllowRdfaAttributes ) {
1394                         #RDFa attributes as specified in section 9 of http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1395                         $common = array_merge( $common, array(
1396                             'about', 'property', 'resource', 'datatype', 'typeof',
1397                         ) );
1398                 }
1399
1400                 if ( $wgHtml5 && $wgAllowMicrodataAttributes ) {
1401                         # add HTML5 microdata tages as pecified by http://www.whatwg.org/specs/web-apps/current-work/multipage/microdata.html#the-microdata-model
1402                         $common = array_merge( $common, array(
1403                             'itemid', 'itemprop', 'itemref', 'itemscope', 'itemtype'
1404                         ) );
1405                 }
1406
1407                 $block = array_merge( $common, array( 'align' ) );
1408                 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1409                 $tablecell = array( 'abbr',
1410                                     'axis',
1411                                     'headers',
1412                                     'scope',
1413                                     'rowspan',
1414                                     'colspan',
1415                                     'nowrap', # deprecated
1416                                     'width',  # deprecated
1417                                     'height', # deprecated
1418                                     'bgcolor' # deprecated
1419                                     );
1420
1421                 # Numbers refer to sections in HTML 4.01 standard describing the element.
1422                 # See: http://www.w3.org/TR/html4/
1423                 $whitelist = array (
1424                         # 7.5.4
1425                         'div'        => $block,
1426                         'center'     => $common, # deprecated
1427                         'span'       => $block, # ??
1428
1429                         # 7.5.5
1430                         'h1'         => $block,
1431                         'h2'         => $block,
1432                         'h3'         => $block,
1433                         'h4'         => $block,
1434                         'h5'         => $block,
1435                         'h6'         => $block,
1436
1437                         # 7.5.6
1438                         # address
1439
1440                         # 8.2.4
1441                         # bdo
1442
1443                         # 9.2.1
1444                         'em'         => $common,
1445                         'strong'     => $common,
1446                         'cite'       => $common,
1447                         'dfn'        => $common,
1448                         'code'       => $common,
1449                         # samp
1450                         # kbd
1451                         'var'        => $common,
1452                         'abbr'       => $common,
1453                         # acronym
1454
1455                         # 9.2.2
1456                         'blockquote' => array_merge( $common, array( 'cite' ) ),
1457                         # q
1458
1459                         # 9.2.3
1460                         'sub'        => $common,
1461                         'sup'        => $common,
1462
1463                         # 9.3.1
1464                         'p'          => $block,
1465
1466                         # 9.3.2
1467                         'br'         => array( 'id', 'class', 'title', 'style', 'clear' ),
1468
1469                         # 9.3.4
1470                         'pre'        => array_merge( $common, array( 'width' ) ),
1471
1472                         # 9.4
1473                         'ins'        => array_merge( $common, array( 'cite', 'datetime' ) ),
1474                         'del'        => array_merge( $common, array( 'cite', 'datetime' ) ),
1475
1476                         # 10.2
1477                         'ul'         => array_merge( $common, array( 'type' ) ),
1478                         'ol'         => array_merge( $common, array( 'type', 'start' ) ),
1479                         'li'         => array_merge( $common, array( 'type', 'value' ) ),
1480
1481                         # 10.3
1482                         'dl'         => $common,
1483                         'dd'         => $common,
1484                         'dt'         => $common,
1485
1486                         # 11.2.1
1487                         'table'      => array_merge( $common,
1488                                                                 array( 'summary', 'width', 'border', 'frame',
1489                                                                                 'rules', 'cellspacing', 'cellpadding',
1490                                                                                 'align', 'bgcolor',
1491                                                                 ) ),
1492
1493                         # 11.2.2
1494                         'caption'    => array_merge( $common, array( 'align' ) ),
1495
1496                         # 11.2.3
1497                         'thead'      => array_merge( $common, $tablealign ),
1498                         'tfoot'      => array_merge( $common, $tablealign ),
1499                         'tbody'      => array_merge( $common, $tablealign ),
1500
1501                         # 11.2.4
1502                         'colgroup'   => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1503                         'col'        => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1504
1505                         # 11.2.5
1506                         'tr'         => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1507
1508                         # 11.2.6
1509                         'td'         => array_merge( $common, $tablecell, $tablealign ),
1510                         'th'         => array_merge( $common, $tablecell, $tablealign ),
1511
1512                         # 12.2 # NOTE: <a> is not allowed directly, but the attrib whitelist is used from the Parser object
1513                         'a'          => array_merge( $common, array( 'href', 'rel', 'rev' ) ), # rel/rev esp. for RDFa
1514
1515                         # 13.2
1516                         # Not usually allowed, but may be used for extension-style hooks
1517                         # such as <math> when it is rasterized, or if $wgAllowImageTag is
1518                         # true
1519                         'img'        => array_merge( $common, array( 'alt', 'src', 'width', 'height' ) ),
1520
1521                         # 15.2.1
1522                         'tt'         => $common,
1523                         'b'          => $common,
1524                         'i'          => $common,
1525                         'big'        => $common,
1526                         'small'      => $common,
1527                         'strike'     => $common,
1528                         's'          => $common,
1529                         'u'          => $common,
1530
1531                         # 15.2.2
1532                         'font'       => array_merge( $common, array( 'size', 'color', 'face' ) ),
1533                         # basefont
1534
1535                         # 15.3
1536                         'hr'         => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1537
1538                         # XHTML Ruby annotation text module, simple ruby only.
1539                         # http://www.w3c.org/TR/ruby/
1540                         'ruby'       => $common,
1541                         # rbc
1542                         # rtc
1543                         'rb'         => $common,
1544                         'rt'         => $common, #array_merge( $common, array( 'rbspan' ) ),
1545                         'rp'         => $common,
1546
1547                         # MathML root element, where used for extensions
1548                         # 'title' may not be 100% valid here; it's XHTML
1549                         # http://www.w3.org/TR/REC-MathML/
1550                         'math'       => array( 'class', 'style', 'id', 'title' ),
1551                         );
1552                 return $whitelist;
1553         }
1554
1555         /**
1556          * Take a fragment of (potentially invalid) HTML and return
1557          * a version with any tags removed, encoded as plain text.
1558          *
1559          * Warning: this return value must be further escaped for literal
1560          * inclusion in HTML output as of 1.10!
1561          *
1562          * @param $text String: HTML fragment
1563          * @return String
1564          */
1565         static function stripAllTags( $text ) {
1566                 # Actual <tags>
1567                 $text = StringUtils::delimiterReplace( '<', '>', '', $text );
1568
1569                 # Normalize &entities and whitespace
1570                 $text = self::decodeCharReferences( $text );
1571                 $text = self::normalizeWhitespace( $text );
1572
1573                 return $text;
1574         }
1575
1576         /**
1577          * Hack up a private DOCTYPE with HTML's standard entity declarations.
1578          * PHP 4 seemed to know these if you gave it an HTML doctype, but
1579          * PHP 5.1 doesn't.
1580          *
1581          * Use for passing XHTML fragments to PHP's XML parsing functions
1582          *
1583          * @return String
1584          */
1585         static function hackDocType() {
1586                 global $wgHtmlEntities;
1587                 $out = "<!DOCTYPE html [\n";
1588                 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1589                         $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1590                 }
1591                 $out .= "]>\n";
1592                 return $out;
1593         }
1594
1595         static function cleanUrl( $url ) {
1596                 # Normalize any HTML entities in input. They will be
1597                 # re-escaped by makeExternalLink().
1598                 $url = Sanitizer::decodeCharReferences( $url );
1599
1600                 # Escape any control characters introduced by the above step
1601                 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F\|]/e', "urlencode('\\0')", $url );
1602
1603                 # Validate hostname portion
1604                 $matches = array();
1605                 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1606                         list( /* $whole */, $protocol, $host, $rest ) = $matches;
1607
1608                         // Characters that will be ignored in IDNs.
1609                         // http://tools.ietf.org/html/3454#section-3.1
1610                         // Strip them before further processing so blacklists and such work.
1611                         $strip = "/
1612                                 \\s|          # general whitespace
1613                                 \xc2\xad|     # 00ad SOFT HYPHEN
1614                                 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1615                                 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1616                                 \xe2\x81\xa0| # 2060 WORD JOINER
1617                                 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1618                                 \xcd\x8f|     # 034f COMBINING GRAPHEME JOINER
1619                                 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1620                                 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1621                                 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1622                                 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1623                                 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1624                                 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1625                                 /xuD";
1626
1627                         $host = preg_replace( $strip, '', $host );
1628
1629                         // @todo Fixme: validate hostnames here
1630
1631                         return $protocol . $host . $rest;
1632                 } else {
1633                         return $url;
1634                 }
1635         }
1636
1637 }