Armor against French spaces detection in HTML attributes

This change also solves T13874 in a generic way.

Bug: T5158
Change-Id: Id8cdb887182f346acab2d108836ce201626848af

diff --git a/includes/parser/Parser.php b/includes/parser/Parser.php
index a1b3064..0270828 100644 (file)
--- a/includes/parser/Parser.php
+++ b/includes/parser/Parser.php
@@ -1353,15 +1353,7 @@ class Parser {
                }
 
                # Clean up special characters, only run once, next-to-last before doBlockLevels
-               $fixtags = [
-                       # French spaces, last one Guillemet-left
-                       # only if there is something before the space
-                       '/(.) (?=\\?|:|;|!|%|\\302\\273)/' => '\\1 ',
-                       # french spaces, Guillemet-right
-                       '/(\\302\\253) /' => '\\1 ',
-                       '/ (!\s*important)/' => ' \\1', # Beware of CSS magic word !important, T13874.
-               ];
-               $text = preg_replace( array_keys( $fixtags ), array_values( $fixtags ), $text );
+               $text = Sanitizer::armorFrenchSpaces( $text );
 
                $text = $this->doBlockLevels( $text, $linestart );
 

diff --git a/includes/parser/Sanitizer.php b/includes/parser/Sanitizer.php
index ff543db..89a7c96 100644 (file)
--- a/includes/parser/Sanitizer.php
+++ b/includes/parser/Sanitizer.php
@@ -1141,6 +1141,27 @@ class Sanitizer {
                return $encValue;
        }
 
+       /**
+        * Armor French spaces with a replacement character
+        *
+        * @since 1.32
+        * @param string $text Text to armor
+        * @param string $space Space character for the French spaces, defaults to ' '
+        * @return string Armored text
+        */
+       public static function armorFrenchSpaces( $text, $space = ' ' ) {
+               // Replace $ with \$ and \ with \\
+               $space = preg_replace( '#(?<!\\\\)(\\$|\\\\)#', '\\\\$1', $space );
+               $fixtags = [
+                       # French spaces, last one Guillemet-left
+                       # only if there is something before the space
+                       '/(.) (?=\\?|:|;|!|%|\\302\\273)/' => "\\1$space",
+                       # French spaces, Guillemet-right
+                       '/(\\302\\253) /' => "\\1$space",
+               ];
+               return preg_replace( array_keys( $fixtags ), array_values( $fixtags ), $text );
+       }
+
        /**
         * Encode an attribute value for HTML tags, with extra armoring
         * against further wiki processing.
@@ -1168,6 +1189,9 @@ class Sanitizer {
                        '__'   => '&#95;_',
                ] );
 
+               # Armor against French spaces detection (T5158)
+               $encValue = self::armorFrenchSpaces( $encValue, '&#32;' );
+
                # Stupid hack
                $encValue = preg_replace_callback(
                        '/((?i)' . wfUrlProtocols() . ')/',

diff --git a/tests/parser/parserTests.txt b/tests/parser/parserTests.txt
index afddd78..ce4df85 100644 (file)
--- a/tests/parser/parserTests.txt
+++ b/tests/parser/parserTests.txt
@@ -6589,7 +6589,7 @@ Element attributes with double ! should not be broken up by <th>
 !! html/php
 <table>
 <tr>
-<td><div style="color: red !important;" data-contrived="put this here &#124;&#124;">hi</div>
+<td><div style="color: red&#32;!important;" data-contrived="put this here &#124;&#124;">hi</div>
 </td></tr></table>
 
 !! html/parsoid
@@ -6610,7 +6610,7 @@ parsoid=wt2html
 !! html/php
 <table>
 <tr>
-<td>style="color: red !important;" data-contrived="put this here</td>
+<td>style="color: red&#160;!important;" data-contrived="put this here</td>
 <td>foo
 </td></tr></table>
 
@@ -18685,7 +18685,7 @@ Punctuation: CSS !important (T13874)
 !! wikitext
 <div style="width:50% !important">important</div>
 !! html
-<div style="width:50% !important">important</div>
+<div style="width:50%&#32;!important">important</div>
 
 !!end
 
@@ -18694,7 +18694,7 @@ Punctuation: CSS ! important (T13874; with space after)
 !! wikitext
 <div style="width:50% ! important">important</div>
 !! html
-<div style="width:50% ! important">important</div>
+<div style="width:50%&#32;! important">important</div>
 
 !!end
 
@@ -23954,10 +23954,10 @@ Play a bit with r67090 and T5158
 <div style="width:50%&#160;!important">&nbsp;</div>
 <div style="border : solid;">&nbsp;</div>
 !! html/php
-<div style="width:50% !important">&#160;</div>
+<div style="width:50%&#32;!important">&#160;</div>
 <div style="width:50% !important">&#160;</div>
 <div style="width:50% !important">&#160;</div>
-<div style="border&#160;: solid;">&#160;</div>
+<div style="border&#32;: solid;">&#160;</div>
 
 !! html/parsoid
 <div style="width:50% !important" data-parsoid='{"stx":"html"}'><span typeof="mw:Entity" data-parsoid='{"srcContent":" "}'> </span></div>
@@ -23967,6 +23967,15 @@ Play a bit with r67090 and T5158
 
 !! end
 
+!! test
+T5158: Test for French spaces in attributes
+!! wikitext
+<br style=" clear : both ; " />
+!! html/php
+<p><br style="clear&#32;: both&#32;;" />
+</p>
+!! end
+
 !! test
 HTML5 data attributes
 !! wikitext