Parser: Remove style and script tags' content from TOC

We don't want to display the stylesheet as part of the TOC entry if
someone uses TemplateStyles in a heading.

Bug: T198618
Change-Id: I2f7316daaba0cce662b6a4702ab87322e6783655

diff --git a/includes/parser/Parser.php b/includes/parser/Parser.php
index fd5ccb8..12d899b 100644 (file)
--- a/includes/parser/Parser.php
+++ b/includes/parser/Parser.php
@@ -4216,6 +4216,13 @@ class Parser {
                        # Avoid insertion of weird stuff like <math> by expanding the relevant sections
                        $safeHeadline = $this->mStripState->unstripBoth( $safeHeadline );
 
+                       # Remove any <style> or <script> tags (T198618)
+                       $safeHeadline = preg_replace(
+                               '#<(style|script)(?: [^>]*[^>/])?>.*?</\1>#is',
+                               '',
+                               $safeHeadline
+                       );
+
                        # Strip out HTML (first regex removes any tag not allowed)
                        # Allowed tags are:
                        # * <sup> and <sub> (T10393)

diff --git a/tests/parser/parserTests.txt b/tests/parser/parserTests.txt
index e2da662..b151002 100644 (file)
--- a/tests/parser/parserTests.txt
+++ b/tests/parser/parserTests.txt
@@ -24710,6 +24710,27 @@ __TOC__
 <h2 id="test_test_test" data-parsoid='{}'><s>test</s> test <strike>test</strike></h2>
 !! end
 
+!! test
+T198618: style element in ToC
+!! options
+styletag=1
+!! wikitext
+__TOC__
+==<style>.foo {}</style>Style<style>.bar {}</style>==
+!! html/php
+<div id="toc" class="toc"><input type="checkbox" role="button" id="toctogglecheckbox" class="toctogglecheckbox" style="display:none"/><div class="toctitle" lang="en" dir="ltr"><h2>Contents</h2><span class="toctogglespan"><label class="toctogglelabel" for="toctogglecheckbox"></label></span></div>
+<ul>
+<li class="toclevel-1 tocsection-1"><a href="#Style"><span class="tocnumber">1</span> <span class="toctext">Style</span></a></li>
+</ul>
+</div>
+
+<h2><span class="mw-headline" id="Style"><style>.foo {}</style>Style<style>.bar {}</style></span><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/index.php?title=Parser_test&amp;action=edit&amp;section=1" title="Edit section: Style">edit</a><span class="mw-editsection-bracket">]</span></span></h2>
+
+!! html/parsoid
+<meta property="mw:PageProp/toc" data-parsoid='{}'/>
+<h2 id="Style" data-parsoid='{}'><style>.foo {}</style>Style<style>.bar {}</style></h2>
+!! end
+
 !! test
 Empty <p> tag in TOC, removed by Sanitizer (T92892)
 !! wikitext