Support WAI-ARIA's role="presentation" inside of WikiText.

- role="presentation" is the standard way to mark some element as presentational for assistive technologies, etc...
  Such as presentational tables. Something we have a lot of and need the ability to mark as presentational.
- Other ARIA roles need more thought so for now they are not supported.

Change-Id: I426ea04a8bc48181a71a308753525f3964201748

diff --git a/RELEASE-NOTES-1.21 b/RELEASE-NOTES-1.21
index d1976dd..12cef87 100644 (file)
--- a/RELEASE-NOTES-1.21
+++ b/RELEASE-NOTES-1.21
@@ -96,6 +96,9 @@ production.
 * (bug 43915) New maintenance script deleteEqualMessages.php.
 * New collation uppercase-sv, which is like uppercase, but adapted
   to Swedish sort order.
+* WikiText now permits the use of WAI-ARIA's role="presentation" inside of
+  html elements and tables. This allows presentational markup, especially
+  tables. To be marked up as such.
 
 === Bug fixes in 1.21 ===
 * (bug 40353) SpecialDoubleRedirect should support interwiki redirects.

diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index b50eca8..c2d34b0 100644 (file)
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -736,6 +736,16 @@ class Sanitizer {
                                $value = Sanitizer::escapeId( $value, 'noninitial' );
                        }
 
+                       # WAI-ARIA
+                       # http://www.w3.org/TR/wai-aria/
+                       # http://www.whatwg.org/specs/web-apps/current-work/multipage/elements.html#wai-aria
+                       # For now we only support role="presentation" until we work out what roles should be
+                       # usable by content and we ensure that our code explicitly rejects patterns that
+                       # violate HTML5's ARIA restrictions.
+                       if ( $attribute === 'role' && $value !== 'presentation' ) {
+                               continue;
+                       }
+
                        //RDFa and microdata properties allow URLs, URIs and/or CURIs. check them for sanity
                        if ( $attribute === 'rel' || $attribute === 'rev' ||
                                $attribute === 'about' || $attribute === 'property' || $attribute === 'resource' || #RDFa
@@ -1416,7 +1426,18 @@ class Sanitizer {
                        return $whitelist;
                }
 
-               $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );
+               $common = array(
+                       # HTML
+                       'id',
+                       'class',
+                       'style',
+                       'lang',
+                       'dir',
+                       'title',
+
+                       # WAI-ARIA
+                       'role',
+               );
 
                if ( $wgAllowRdfaAttributes ) {
                        #RDFa attributes as specified in section 9 of http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014

diff --git a/tests/phpunit/includes/SanitizerTest.php b/tests/phpunit/includes/SanitizerTest.php
index 2d039d9..402e6b7 100644 (file)
--- a/tests/phpunit/includes/SanitizerTest.php
+++ b/tests/phpunit/includes/SanitizerTest.php
@@ -225,4 +225,26 @@ class SanitizerTest extends MediaWikiTestCase {
                        array( '/* insecure input */', 'background-image: -moz-image-set("asdf.png" 1x, "asdf.png" 2x);'),
                );
        }
+
+       /**
+        * Test for support or lack of support for specific attributes in the attribute whitelist.
+        */
+       function provideAttributeSupport() {
+               /** array( <attributes>, <expected>, <message> ) */
+               return array(
+                       array( 'div', ' role="presentation"', ' role="presentation"', 'Support for WAI-ARIA\'s role="presentation".' ),
+                       array( 'div', ' role="main"', '', "Other WAI-ARIA roles are currently not supported." ),
+               );
+       }
+
+       /**
+        * @dataProvider provideAttributeSupport
+        */
+       function testAttributeSupport( $tag, $attributes, $expected, $message ) {
+               $this->assertEquals( $expected,
+                       Sanitizer::fixTagAttributes( $attributes, $tag ),
+                       $message
+               );
+       }
+
 }