Remove support for $wgWellFormedXml=false
authorBrian Wolff <bawolff+wn@gmail.com>
Wed, 20 Apr 2016 17:22:51 +0000 (13:22 -0400)
committerBrian Wolff <bawolff+wn@gmail.com>
Thu, 12 May 2016 21:40:01 +0000 (17:40 -0400)
commitee4d5c6eed3e054dd368c39709d27783c092b3f5
tree5e1f0846483437c46b0e8a534e94ea9267cf1f86
parent50a3e5625a4f10a7c1951de164f15c264bdfdcd3
Remove support for $wgWellFormedXml=false

tl;dr: Having unnessary complexity in security critical code is bad.

* Extra options add extra complexity and maintenance burden
** Thus we should only have one html output mode. well formed = false
     was already vetoed in T52040, so lets go with WellFormed=true.
* Options which are used by very few people tend to get tested less
* Escaping is an area of code where we should be very conservative
* Having escaping rules depend on making assumptions about which
    characters various browsers consider "whitespace" is scary
* $wgWellFormedXml=false has had a negative security impact in the
    past (Usually not directly its fault, but has made other bugs
    more exploitable)
* Saving a couple bytes (even less bytes after gzip taken into
    account) is really not worth it in this context (imho).

Change-Id: I5c922e0980d3f9eb39adb5bb5833e158afda42ed
includes/DefaultSettings.php
includes/Html.php
tests/parser/parserTest.inc
tests/phpunit/includes/HtmlTest.php
tests/phpunit/includes/LinkerTest.php
tests/phpunit/includes/OutputPageTest.php
tests/phpunit/includes/XmlSelectTest.php
tests/phpunit/includes/XmlTest.php
tests/phpunit/includes/content/JsonContentTest.php
tests/phpunit/includes/parser/NewParserTest.php