Merge "Reserve data-mw and data-parsoid attribute prefix for trusted values"

[lhc/web/wiklou.git] / includes / Sanitizer.php

diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index f88dd05..b1b5da2 100644 (file)
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -476,7 +476,8 @@ class Sanitizer {
                                }
 
                                $badtag = false;
-                               if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
+                               $t = strtolower( $t );
+                               if ( isset( $htmlelements[$t] ) ) {
                                        # Check our stack
                                        if ( $slash && isset( $htmlsingleonly[$t] ) ) {
                                                $badtag = true;
@@ -596,7 +597,8 @@ class Sanitizer {
                                        list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
 
                                        $badtag = false;
-                                       if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
+                                       $t = strtolower( $t );
+                                       if ( isset( $htmlelements[$t] ) ) {
                                                if ( is_callable( $processCallback ) ) {
                                                        call_user_func_array( $processCallback, array( &$params, $args ) );
                                                }
@@ -748,7 +750,15 @@ class Sanitizer {
                        }
 
                        # Allow any attribute beginning with "data-"
-                       if ( !preg_match( '/^data-(?!ooui)/i', $attribute ) && !isset( $whitelist[$attribute] ) ) {
+                       # However:
+                       # * data-ooui is reserved for ooui
+                       # * data-mw and data-parsoid are reserved for parsoid
+                       # * data-mw-<ext name here> is reserved for extensions (or core) if
+                       #   they need to communicate some data to the client and want to be
+                       #   sure that it isn't coming from an untrusted user.
+                       if ( !preg_match( '/^data-(?!ooui|mw|parsoid)/i', $attribute )
+                               && !isset( $whitelist[$attribute] )
+                       ) {
                                continue;
                        }
 
@@ -1629,7 +1639,7 @@ class Sanitizer {
 
                        # 10.2
                        'ul'         => array_merge( $common, array( 'type' ) ),
-                       'ol'         => array_merge( $common, array( 'type', 'start' ) ),
+                       'ol'         => array_merge( $common, array( 'type', 'start', 'reversed' ) ),
                        'li'         => array_merge( $common, array( 'type', 'value' ) ),
 
                        # 10.3