| [ Index ] |
PHP Cross Reference of MediaWiki-1.24.0 |
[Summary view] [Print] [Text view]
1 <?php 2 /** 3 * HTML sanitizer for %MediaWiki. 4 * 5 * Copyright © 2002-2005 Brion Vibber <[email protected]> et al 6 * https://www.mediawiki.org/ 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 2 of the License, or 11 * (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License along 19 * with this program; if not, write to the Free Software Foundation, Inc., 20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. 21 * http://www.gnu.org/copyleft/gpl.html 22 * 23 * @file 24 * @ingroup Parser 25 */ 26 27 /** 28 * HTML sanitizer for MediaWiki 29 * @ingroup Parser 30 */ 31 class Sanitizer { 32 /** 33 * Regular expression to match various types of character references in 34 * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences 35 */ 36 const CHAR_REFS_REGEX = 37 '/&([A-Za-z0-9\x80-\xff]+); 38 |&\#([0-9]+); 39 |&\#[xX]([0-9A-Fa-f]+); 40 |(&)/x'; 41 42 /** 43 * Blacklist for evil uris like javascript: 44 * WARNING: DO NOT use this in any place that actually requires blacklisting 45 * for security reasons. There are NUMEROUS[1] ways to bypass blacklisting, the 46 * only way to be secure from javascript: uri based xss vectors is to whitelist 47 * things that you know are safe and deny everything else. 48 * [1]: http://ha.ckers.org/xss.html 49 */ 50 const EVIL_URI_PATTERN = '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i'; 51 const XMLNS_ATTRIBUTE_PATTERN = "/^xmlns:[:A-Z_a-z-.0-9]+$/"; 52 53 /** 54 * List of all named character entities defined in HTML 4.01 55 * http://www.w3.org/TR/html4/sgml/entities.html 56 * As well as ' which is only defined starting in XHTML1. 57 */ 58 private static $htmlEntities = array( 59 'Aacute' => 193, 60 'aacute' => 225, 61 'Acirc' => 194, 62 'acirc' => 226, 63 'acute' => 180, 64 'AElig' => 198, 65 'aelig' => 230, 66 'Agrave' => 192, 67 'agrave' => 224, 68 'alefsym' => 8501, 69 'Alpha' => 913, 70 'alpha' => 945, 71 'amp' => 38, 72 'and' => 8743, 73 'ang' => 8736, 74 'apos' => 39, // New in XHTML & HTML 5; avoid in output for compatibility with IE. 75 'Aring' => 197, 76 'aring' => 229, 77 'asymp' => 8776, 78 'Atilde' => 195, 79 'atilde' => 227, 80 'Auml' => 196, 81 'auml' => 228, 82 'bdquo' => 8222, 83 'Beta' => 914, 84 'beta' => 946, 85 'brvbar' => 166, 86 'bull' => 8226, 87 'cap' => 8745, 88 'Ccedil' => 199, 89 'ccedil' => 231, 90 'cedil' => 184, 91 'cent' => 162, 92 'Chi' => 935, 93 'chi' => 967, 94 'circ' => 710, 95 'clubs' => 9827, 96 'cong' => 8773, 97 'copy' => 169, 98 'crarr' => 8629, 99 'cup' => 8746, 100 'curren' => 164, 101 'dagger' => 8224, 102 'Dagger' => 8225, 103 'darr' => 8595, 104 'dArr' => 8659, 105 'deg' => 176, 106 'Delta' => 916, 107 'delta' => 948, 108 'diams' => 9830, 109 'divide' => 247, 110 'Eacute' => 201, 111 'eacute' => 233, 112 'Ecirc' => 202, 113 'ecirc' => 234, 114 'Egrave' => 200, 115 'egrave' => 232, 116 'empty' => 8709, 117 'emsp' => 8195, 118 'ensp' => 8194, 119 'Epsilon' => 917, 120 'epsilon' => 949, 121 'equiv' => 8801, 122 'Eta' => 919, 123 'eta' => 951, 124 'ETH' => 208, 125 'eth' => 240, 126 'Euml' => 203, 127 'euml' => 235, 128 'euro' => 8364, 129 'exist' => 8707, 130 'fnof' => 402, 131 'forall' => 8704, 132 'frac12' => 189, 133 'frac14' => 188, 134 'frac34' => 190, 135 'frasl' => 8260, 136 'Gamma' => 915, 137 'gamma' => 947, 138 'ge' => 8805, 139 'gt' => 62, 140 'harr' => 8596, 141 'hArr' => 8660, 142 'hearts' => 9829, 143 'hellip' => 8230, 144 'Iacute' => 205, 145 'iacute' => 237, 146 'Icirc' => 206, 147 'icirc' => 238, 148 'iexcl' => 161, 149 'Igrave' => 204, 150 'igrave' => 236, 151 'image' => 8465, 152 'infin' => 8734, 153 'int' => 8747, 154 'Iota' => 921, 155 'iota' => 953, 156 'iquest' => 191, 157 'isin' => 8712, 158 'Iuml' => 207, 159 'iuml' => 239, 160 'Kappa' => 922, 161 'kappa' => 954, 162 'Lambda' => 923, 163 'lambda' => 955, 164 'lang' => 9001, 165 'laquo' => 171, 166 'larr' => 8592, 167 'lArr' => 8656, 168 'lceil' => 8968, 169 'ldquo' => 8220, 170 'le' => 8804, 171 'lfloor' => 8970, 172 'lowast' => 8727, 173 'loz' => 9674, 174 'lrm' => 8206, 175 'lsaquo' => 8249, 176 'lsquo' => 8216, 177 'lt' => 60, 178 'macr' => 175, 179 'mdash' => 8212, 180 'micro' => 181, 181 'middot' => 183, 182 'minus' => 8722, 183 'Mu' => 924, 184 'mu' => 956, 185 'nabla' => 8711, 186 'nbsp' => 160, 187 'ndash' => 8211, 188 'ne' => 8800, 189 'ni' => 8715, 190 'not' => 172, 191 'notin' => 8713, 192 'nsub' => 8836, 193 'Ntilde' => 209, 194 'ntilde' => 241, 195 'Nu' => 925, 196 'nu' => 957, 197 'Oacute' => 211, 198 'oacute' => 243, 199 'Ocirc' => 212, 200 'ocirc' => 244, 201 'OElig' => 338, 202 'oelig' => 339, 203 'Ograve' => 210, 204 'ograve' => 242, 205 'oline' => 8254, 206 'Omega' => 937, 207 'omega' => 969, 208 'Omicron' => 927, 209 'omicron' => 959, 210 'oplus' => 8853, 211 'or' => 8744, 212 'ordf' => 170, 213 'ordm' => 186, 214 'Oslash' => 216, 215 'oslash' => 248, 216 'Otilde' => 213, 217 'otilde' => 245, 218 'otimes' => 8855, 219 'Ouml' => 214, 220 'ouml' => 246, 221 'para' => 182, 222 'part' => 8706, 223 'permil' => 8240, 224 'perp' => 8869, 225 'Phi' => 934, 226 'phi' => 966, 227 'Pi' => 928, 228 'pi' => 960, 229 'piv' => 982, 230 'plusmn' => 177, 231 'pound' => 163, 232 'prime' => 8242, 233 'Prime' => 8243, 234 'prod' => 8719, 235 'prop' => 8733, 236 'Psi' => 936, 237 'psi' => 968, 238 'quot' => 34, 239 'radic' => 8730, 240 'rang' => 9002, 241 'raquo' => 187, 242 'rarr' => 8594, 243 'rArr' => 8658, 244 'rceil' => 8969, 245 'rdquo' => 8221, 246 'real' => 8476, 247 'reg' => 174, 248 'rfloor' => 8971, 249 'Rho' => 929, 250 'rho' => 961, 251 'rlm' => 8207, 252 'rsaquo' => 8250, 253 'rsquo' => 8217, 254 'sbquo' => 8218, 255 'Scaron' => 352, 256 'scaron' => 353, 257 'sdot' => 8901, 258 'sect' => 167, 259 'shy' => 173, 260 'Sigma' => 931, 261 'sigma' => 963, 262 'sigmaf' => 962, 263 'sim' => 8764, 264 'spades' => 9824, 265 'sub' => 8834, 266 'sube' => 8838, 267 'sum' => 8721, 268 'sup' => 8835, 269 'sup1' => 185, 270 'sup2' => 178, 271 'sup3' => 179, 272 'supe' => 8839, 273 'szlig' => 223, 274 'Tau' => 932, 275 'tau' => 964, 276 'there4' => 8756, 277 'Theta' => 920, 278 'theta' => 952, 279 'thetasym' => 977, 280 'thinsp' => 8201, 281 'THORN' => 222, 282 'thorn' => 254, 283 'tilde' => 732, 284 'times' => 215, 285 'trade' => 8482, 286 'Uacute' => 218, 287 'uacute' => 250, 288 'uarr' => 8593, 289 'uArr' => 8657, 290 'Ucirc' => 219, 291 'ucirc' => 251, 292 'Ugrave' => 217, 293 'ugrave' => 249, 294 'uml' => 168, 295 'upsih' => 978, 296 'Upsilon' => 933, 297 'upsilon' => 965, 298 'Uuml' => 220, 299 'uuml' => 252, 300 'weierp' => 8472, 301 'Xi' => 926, 302 'xi' => 958, 303 'Yacute' => 221, 304 'yacute' => 253, 305 'yen' => 165, 306 'Yuml' => 376, 307 'yuml' => 255, 308 'Zeta' => 918, 309 'zeta' => 950, 310 'zwj' => 8205, 311 'zwnj' => 8204 312 ); 313 314 /** 315 * Character entity aliases accepted by MediaWiki 316 */ 317 private static $htmlEntityAliases = array( 318 'רלמ' => 'rlm', 319 'رلم' => 'rlm', 320 ); 321 322 /** 323 * Lazy-initialised attributes regex, see getAttribsRegex() 324 */ 325 private static $attribsRegex; 326 327 /** 328 * Regular expression to match HTML/XML attribute pairs within a tag. 329 * Allows some... latitude. 330 * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes 331 * @return string 332 */ 333 static function getAttribsRegex() { 334 if ( self::$attribsRegex === null ) { 335 $attribFirst = '[:A-Z_a-z0-9]'; 336 $attrib = '[:A-Z_a-z-.0-9]'; 337 $space = '[\x09\x0a\x0d\x20]'; 338 self::$attribsRegex = 339 "/(?:^|$space)({$attribFirst}{$attrib}*) 340 ($space*=$space* 341 (?: 342 # The attribute value: quoted or alone 343 \"([^<\"]*)\" 344 | '([^<']*)' 345 | ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+) 346 | (\#[0-9a-fA-F]+) # Technically wrong, but lots of 347 # colors are specified like this. 348 # We'll be normalizing it. 349 ) 350 )?(?=$space|\$)/sx"; 351 } 352 return self::$attribsRegex; 353 } 354 355 /** 356 * Cleans up HTML, removes dangerous tags and attributes, and 357 * removes HTML comments 358 * @private 359 * @param string $text 360 * @param callable $processCallback Callback to do any variable or parameter 361 * replacements in HTML attribute values 362 * @param array|bool $args Arguments for the processing callback 363 * @param array $extratags For any extra tags to include 364 * @param array $removetags For any tags (default or extra) to exclude 365 * @return string 366 */ 367 static function removeHTMLtags( $text, $processCallback = null, 368 $args = array(), $extratags = array(), $removetags = array() 369 ) { 370 global $wgUseTidy, $wgAllowMicrodataAttributes, $wgAllowImageTag; 371 372 static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags, 373 $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised; 374 375 wfProfileIn( __METHOD__ ); 376 377 // Base our staticInitialised variable off of the global config state so that if the globals 378 // are changed (like in the screwed up test system) we will re-initialise the settings. 379 $globalContext = implode( '-', compact( 'wgAllowMicrodataAttributes', 'wgAllowImageTag' ) ); 380 if ( !$staticInitialised || $staticInitialised != $globalContext ) { 381 382 $htmlpairsStatic = array( # Tags that must be closed 383 'b', 'bdi', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1', 384 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's', 385 'strike', 'strong', 'tt', 'var', 'div', 'center', 386 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre', 387 'ruby', 'rb', 'rp', 'rt', 'rtc', 'p', 'span', 'abbr', 'dfn', 388 'kbd', 'samp', 'data', 'time', 'mark' 389 ); 390 $htmlsingle = array( 391 'br', 'wbr', 'hr', 'li', 'dt', 'dd' 392 ); 393 $htmlsingleonly = array( # Elements that cannot have close tags 394 'br', 'wbr', 'hr' 395 ); 396 if ( $wgAllowMicrodataAttributes ) { 397 $htmlsingle[] = $htmlsingleonly[] = 'meta'; 398 $htmlsingle[] = $htmlsingleonly[] = 'link'; 399 } 400 $htmlnest = array( # Tags that can be nested--?? 401 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul', 402 'li', 'dl', 'dt', 'dd', 'font', 'big', 'small', 'sub', 'sup', 'span', 403 'var', 'kbd', 'samp', 'em', 'strong', 'q', 'ruby', 'bdo' 404 ); 405 $tabletags = array( # Can only appear inside table, we will close them 406 'td', 'th', 'tr', 407 ); 408 $htmllist = array( # Tags used by list 409 'ul', 'ol', 410 ); 411 $listtags = array( # Tags that can appear in a list 412 'li', 413 ); 414 415 if ( $wgAllowImageTag ) { 416 $htmlsingle[] = 'img'; 417 $htmlsingleonly[] = 'img'; 418 } 419 420 $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) ); 421 $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) ); 422 423 # Convert them all to hashtables for faster lookup 424 $vars = array( 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags', 425 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' ); 426 foreach ( $vars as $var ) { 427 $$var = array_flip( $$var ); 428 } 429 $staticInitialised = $globalContext; 430 } 431 # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays 432 $extratags = array_flip( $extratags ); 433 $removetags = array_flip( $removetags ); 434 $htmlpairs = array_merge( $extratags, $htmlpairsStatic ); 435 $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ), $removetags ); 436 437 # Remove HTML comments 438 $text = Sanitizer::removeHTMLcomments( $text ); 439 $bits = explode( '<', $text ); 440 $text = str_replace( '>', '>', array_shift( $bits ) ); 441 if ( !$wgUseTidy ) { 442 $tagstack = $tablestack = array(); 443 foreach ( $bits as $x ) { 444 $regs = array(); 445 # $slash: Does the current element start with a '/'? 446 # $t: Current element name 447 # $params: String between element name and > 448 # $brace: Ending '>' or '/>' 449 # $rest: Everything until the next element of $bits 450 if ( preg_match( '!^(/?)([^\\s/>]+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) { 451 list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs; 452 } else { 453 $slash = $t = $params = $brace = $rest = null; 454 } 455 456 $badtag = false; 457 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) { 458 # Check our stack 459 if ( $slash && isset( $htmlsingleonly[$t] ) ) { 460 $badtag = true; 461 } elseif ( $slash ) { 462 # Closing a tag... is it the one we just opened? 463 wfSuppressWarnings(); 464 $ot = array_pop( $tagstack ); 465 wfRestoreWarnings(); 466 467 if ( $ot != $t ) { 468 if ( isset( $htmlsingleallowed[$ot] ) ) { 469 # Pop all elements with an optional close tag 470 # and see if we find a match below them 471 $optstack = array(); 472 array_push( $optstack, $ot ); 473 wfSuppressWarnings(); 474 $ot = array_pop( $tagstack ); 475 wfRestoreWarnings(); 476 while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) { 477 array_push( $optstack, $ot ); 478 wfSuppressWarnings(); 479 $ot = array_pop( $tagstack ); 480 wfRestoreWarnings(); 481 } 482 if ( $t != $ot ) { 483 # No match. Push the optional elements back again 484 $badtag = true; 485 wfSuppressWarnings(); 486 $ot = array_pop( $optstack ); 487 wfRestoreWarnings(); 488 while ( $ot ) { 489 array_push( $tagstack, $ot ); 490 wfSuppressWarnings(); 491 $ot = array_pop( $optstack ); 492 wfRestoreWarnings(); 493 } 494 } 495 } else { 496 wfSuppressWarnings(); 497 array_push( $tagstack, $ot ); 498 wfRestoreWarnings(); 499 500 # <li> can be nested in <ul> or <ol>, skip those cases: 501 if ( !isset( $htmllist[$ot] ) || !isset( $listtags[$t] ) ) { 502 $badtag = true; 503 } 504 } 505 } else { 506 if ( $t == 'table' ) { 507 $tagstack = array_pop( $tablestack ); 508 } 509 } 510 $newparams = ''; 511 } else { 512 # Keep track for later 513 if ( isset( $tabletags[$t] ) && 514 !in_array( 'table', $tagstack ) ) { 515 $badtag = true; 516 } elseif ( in_array( $t, $tagstack ) && 517 !isset( $htmlnest[$t] ) ) { 518 $badtag = true; 519 # Is it a self closed htmlpair ? (bug 5487) 520 } elseif ( $brace == '/>' && 521 isset( $htmlpairs[$t] ) ) { 522 $badtag = true; 523 } elseif ( isset( $htmlsingleonly[$t] ) ) { 524 # Hack to force empty tag for unclosable elements 525 $brace = '/>'; 526 } elseif ( isset( $htmlsingle[$t] ) ) { 527 # Hack to not close $htmlsingle tags 528 $brace = null; 529 # Still need to push this optionally-closed tag to 530 # the tag stack so that we can match end tags 531 # instead of marking them as bad. 532 array_push( $tagstack, $t ); 533 } elseif ( isset( $tabletags[$t] ) 534 && in_array( $t, $tagstack ) ) { 535 // New table tag but forgot to close the previous one 536 $text .= "</$t>"; 537 } else { 538 if ( $t == 'table' ) { 539 array_push( $tablestack, $tagstack ); 540 $tagstack = array(); 541 } 542 array_push( $tagstack, $t ); 543 } 544 545 # Replace any variables or template parameters with 546 # plaintext results. 547 if ( is_callable( $processCallback ) ) { 548 call_user_func_array( $processCallback, array( &$params, $args ) ); 549 } 550 551 if ( !Sanitizer::validateTag( $params, $t ) ) { 552 $badtag = true; 553 } 554 555 # Strip non-approved attributes from the tag 556 $newparams = Sanitizer::fixTagAttributes( $params, $t ); 557 } 558 if ( !$badtag ) { 559 $rest = str_replace( '>', '>', $rest ); 560 $close = ( $brace == '/>' && !$slash ) ? ' /' : ''; 561 $text .= "<$slash$t$newparams$close>$rest"; 562 continue; 563 } 564 } 565 $text .= '<' . str_replace( '>', '>', $x ); 566 } 567 # Close off any remaining tags 568 while ( is_array( $tagstack ) && ( $t = array_pop( $tagstack ) ) ) { 569 $text .= "</$t>\n"; 570 if ( $t == 'table' ) { 571 $tagstack = array_pop( $tablestack ); 572 } 573 } 574 } else { 575 # this might be possible using tidy itself 576 foreach ( $bits as $x ) { 577 preg_match( 578 '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/', 579 $x, 580 $regs 581 ); 582 583 wfSuppressWarnings(); 584 list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs; 585 wfRestoreWarnings(); 586 587 $badtag = false; 588 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) { 589 if ( is_callable( $processCallback ) ) { 590 call_user_func_array( $processCallback, array( &$params, $args ) ); 591 } 592 593 if ( !Sanitizer::validateTag( $params, $t ) ) { 594 $badtag = true; 595 } 596 597 $newparams = Sanitizer::fixTagAttributes( $params, $t ); 598 if ( !$badtag ) { 599 $rest = str_replace( '>', '>', $rest ); 600 $text .= "<$slash$t$newparams$brace$rest"; 601 continue; 602 } 603 } 604 $text .= '<' . str_replace( '>', '>', $x ); 605 } 606 } 607 wfProfileOut( __METHOD__ ); 608 return $text; 609 } 610 611 /** 612 * Remove '<!--', '-->', and everything between. 613 * To avoid leaving blank lines, when a comment is both preceded 614 * and followed by a newline (ignoring spaces), trim leading and 615 * trailing spaces and one of the newlines. 616 * 617 * @private 618 * @param string $text 619 * @return string 620 */ 621 static function removeHTMLcomments( $text ) { 622 wfProfileIn( __METHOD__ ); 623 while ( ( $start = strpos( $text, '<!--' ) ) !== false ) { 624 $end = strpos( $text, '-->', $start + 4 ); 625 if ( $end === false ) { 626 # Unterminated comment; bail out 627 break; 628 } 629 630 $end += 3; 631 632 # Trim space and newline if the comment is both 633 # preceded and followed by a newline 634 $spaceStart = max( $start - 1, 0 ); 635 $spaceLen = $end - $spaceStart; 636 while ( substr( $text, $spaceStart, 1 ) === ' ' && $spaceStart > 0 ) { 637 $spaceStart--; 638 $spaceLen++; 639 } 640 while ( substr( $text, $spaceStart + $spaceLen, 1 ) === ' ' ) { 641 $spaceLen++; 642 } 643 if ( substr( $text, $spaceStart, 1 ) === "\n" 644 && substr( $text, $spaceStart + $spaceLen, 1 ) === "\n" ) { 645 # Remove the comment, leading and trailing 646 # spaces, and leave only one newline. 647 $text = substr_replace( $text, "\n", $spaceStart, $spaceLen + 1 ); 648 } else { 649 # Remove just the comment. 650 $text = substr_replace( $text, '', $start, $end - $start ); 651 } 652 } 653 wfProfileOut( __METHOD__ ); 654 return $text; 655 } 656 657 /** 658 * Takes attribute names and values for a tag and the tag name and 659 * validates that the tag is allowed to be present. 660 * This DOES NOT validate the attributes, nor does it validate the 661 * tags themselves. This method only handles the special circumstances 662 * where we may want to allow a tag within content but ONLY when it has 663 * specific attributes set. 664 * 665 * @param string $params 666 * @param string $element 667 * @return bool 668 */ 669 static function validateTag( $params, $element ) { 670 $params = Sanitizer::decodeTagAttributes( $params ); 671 672 if ( $element == 'meta' || $element == 'link' ) { 673 if ( !isset( $params['itemprop'] ) ) { 674 // <meta> and <link> must have an itemprop="" otherwise they are not valid or safe in content 675 return false; 676 } 677 if ( $element == 'meta' && !isset( $params['content'] ) ) { 678 // <meta> must have a content="" for the itemprop 679 return false; 680 } 681 if ( $element == 'link' && !isset( $params['href'] ) ) { 682 // <link> must have an associated href="" 683 return false; 684 } 685 } 686 687 return true; 688 } 689 690 /** 691 * Take an array of attribute names and values and normalize or discard 692 * illegal values for the given element type. 693 * 694 * - Discards attributes not on a whitelist for the given element 695 * - Unsafe style attributes are discarded 696 * - Invalid id attributes are re-encoded 697 * 698 * @param array $attribs 699 * @param string $element 700 * @return array 701 * 702 * @todo Check for legal values where the DTD limits things. 703 * @todo Check for unique id attribute :P 704 */ 705 static function validateTagAttributes( $attribs, $element ) { 706 return Sanitizer::validateAttributes( $attribs, 707 Sanitizer::attributeWhitelist( $element ) ); 708 } 709 710 /** 711 * Take an array of attribute names and values and normalize or discard 712 * illegal values for the given whitelist. 713 * 714 * - Discards attributes not the given whitelist 715 * - Unsafe style attributes are discarded 716 * - Invalid id attributes are re-encoded 717 * 718 * @param array $attribs 719 * @param array $whitelist List of allowed attribute names 720 * @return array 721 * 722 * @todo Check for legal values where the DTD limits things. 723 * @todo Check for unique id attribute :P 724 */ 725 static function validateAttributes( $attribs, $whitelist ) { 726 global $wgAllowRdfaAttributes, $wgAllowMicrodataAttributes; 727 728 $whitelist = array_flip( $whitelist ); 729 $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/'; 730 731 $out = array(); 732 foreach ( $attribs as $attribute => $value ) { 733 #allow XML namespace declaration if RDFa is enabled 734 if ( $wgAllowRdfaAttributes && preg_match( self::XMLNS_ATTRIBUTE_PATTERN, $attribute ) ) { 735 if ( !preg_match( self::EVIL_URI_PATTERN, $value ) ) { 736 $out[$attribute] = $value; 737 } 738 739 continue; 740 } 741 742 # Allow any attribute beginning with "data-" 743 if ( !preg_match( '/^data-/i', $attribute ) && !isset( $whitelist[$attribute] ) ) { 744 continue; 745 } 746 747 # Strip javascript "expression" from stylesheets. 748 # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp 749 if ( $attribute == 'style' ) { 750 $value = Sanitizer::checkCss( $value ); 751 } 752 753 if ( $attribute === 'id' ) { 754 $value = Sanitizer::escapeId( $value, 'noninitial' ); 755 } 756 757 # WAI-ARIA 758 # http://www.w3.org/TR/wai-aria/ 759 # http://www.whatwg.org/html/elements.html#wai-aria 760 # For now we only support role="presentation" until we work out what roles should be 761 # usable by content and we ensure that our code explicitly rejects patterns that 762 # violate HTML5's ARIA restrictions. 763 if ( $attribute === 'role' && $value !== 'presentation' ) { 764 continue; 765 } 766 767 // RDFa and microdata properties allow URLs, URIs and/or CURIs. 768 // Check them for sanity. 769 if ( $attribute === 'rel' || $attribute === 'rev' 770 # RDFa 771 || $attribute === 'about' || $attribute === 'property' 772 || $attribute === 'resource' || $attribute === 'datatype' 773 || $attribute === 'typeof' 774 # HTML5 microdata 775 || $attribute === 'itemid' || $attribute === 'itemprop' 776 || $attribute === 'itemref' || $attribute === 'itemscope' 777 || $attribute === 'itemtype' 778 ) { 779 //Paranoia. Allow "simple" values but suppress javascript 780 if ( preg_match( self::EVIL_URI_PATTERN, $value ) ) { 781 continue; 782 } 783 } 784 785 # NOTE: even though elements using href/src are not allowed directly, supply 786 # validation code that can be used by tag hook handlers, etc 787 if ( $attribute === 'href' || $attribute === 'src' ) { 788 if ( !preg_match( $hrefExp, $value ) ) { 789 continue; //drop any href or src attributes not using an allowed protocol. 790 // NOTE: this also drops all relative URLs 791 } 792 } 793 794 // If this attribute was previously set, override it. 795 // Output should only have one attribute of each name. 796 $out[$attribute] = $value; 797 } 798 799 if ( $wgAllowMicrodataAttributes ) { 800 # itemtype, itemid, itemref don't make sense without itemscope 801 if ( !array_key_exists( 'itemscope', $out ) ) { 802 unset( $out['itemtype'] ); 803 unset( $out['itemid'] ); 804 unset( $out['itemref'] ); 805 } 806 # TODO: Strip itemprop if we aren't descendants of an itemscope or pointed to by an itemref. 807 } 808 return $out; 809 } 810 811 /** 812 * Merge two sets of HTML attributes. Conflicting items in the second set 813 * will override those in the first, except for 'class' attributes which 814 * will be combined (if they're both strings). 815 * 816 * @todo implement merging for other attributes such as style 817 * @param array $a 818 * @param array $b 819 * @return array 820 */ 821 static function mergeAttributes( $a, $b ) { 822 $out = array_merge( $a, $b ); 823 if ( isset( $a['class'] ) && isset( $b['class'] ) 824 && is_string( $a['class'] ) && is_string( $b['class'] ) 825 && $a['class'] !== $b['class'] 826 ) { 827 $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}", 828 -1, PREG_SPLIT_NO_EMPTY ); 829 $out['class'] = implode( ' ', array_unique( $classes ) ); 830 } 831 return $out; 832 } 833 834 /** 835 * Normalize CSS into a format we can easily search for hostile input 836 * - decode character references 837 * - decode escape sequences 838 * - convert characters that IE6 interprets into ascii 839 * - remove comments, unless the entire value is one single comment 840 * @param string $value the css string 841 * @return string normalized css 842 */ 843 public static function normalizeCss( $value ) { 844 845 // Decode character references like { 846 $value = Sanitizer::decodeCharReferences( $value ); 847 848 // Decode escape sequences and line continuation 849 // See the grammar in the CSS 2 spec, appendix D. 850 // This has to be done AFTER decoding character references. 851 // This means it isn't possible for this function to return 852 // unsanitized escape sequences. It is possible to manufacture 853 // input that contains character references that decode to 854 // escape sequences that decode to character references, but 855 // it's OK for the return value to contain character references 856 // because the caller is supposed to escape those anyway. 857 static $decodeRegex; 858 if ( !$decodeRegex ) { 859 $space = '[\\x20\\t\\r\\n\\f]'; 860 $nl = '(?:\\n|\\r\\n|\\r|\\f)'; 861 $backslash = '\\\\'; 862 $decodeRegex = "/ $backslash 863 (?: 864 ($nl) | # 1. Line continuation 865 ([0-9A-Fa-f]{1,6})$space? | # 2. character number 866 (.) | # 3. backslash cancelling special meaning 867 () | # 4. backslash at end of string 868 )/xu"; 869 } 870 $value = preg_replace_callback( $decodeRegex, 871 array( __CLASS__, 'cssDecodeCallback' ), $value ); 872 873 // Normalize Halfwidth and Fullwidth Unicode block that IE6 might treat as ascii 874 $value = preg_replace_callback( 875 '/[！-［］-ｚ]/u', // U+FF01 to U+FF5A, excluding U+FF3C (bug 58088) 876 function ( $matches ) { 877 $cp = utf8ToCodepoint( $matches[0] ); 878 if ( $cp === false ) { 879 return ''; 880 } 881 return chr( $cp - 65248 ); // ASCII range \x21-\x7A 882 }, 883 $value 884 ); 885 886 // Convert more characters IE6 might treat as ascii 887 // U+0280, U+0274, U+207F, U+029F, U+026A, U+207D, U+208D 888 $value = str_replace( 889 array( 'ʀ', 'ɴ', 'ⁿ', 'ʟ', 'ɪ', '⁽', '₍' ), 890 array( 'r', 'n', 'n', 'l', 'i', '(', '(' ), 891 $value 892 ); 893 894 // Let the value through if it's nothing but a single comment, to 895 // allow other functions which may reject it to pass some error 896 // message through. 897 if ( !preg_match( '! ^ \s* /\* [^*\\/]* \*/ \s* $ !x', $value ) ) { 898 // Remove any comments; IE gets token splitting wrong 899 // This must be done AFTER decoding character references and 900 // escape sequences, because those steps can introduce comments 901 // This step cannot introduce character references or escape 902 // sequences, because it replaces comments with spaces rather 903 // than removing them completely. 904 $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value ); 905 906 // Remove anything after a comment-start token, to guard against 907 // incorrect client implementations. 908 $commentPos = strpos( $value, '/*' ); 909 if ( $commentPos !== false ) { 910 $value = substr( $value, 0, $commentPos ); 911 } 912 } 913 914 // S followed by repeat, iteration, or prolonged sound marks, 915 // which IE will treat as "ss" 916 $value = preg_replace( 917 '/s(?: 918 \xE3\x80\xB1 | # U+3031 919 \xE3\x82\x9D | # U+309D 920 \xE3\x83\xBC | # U+30FC 921 \xE3\x83\xBD | # U+30FD 922 \xEF\xB9\xBC | # U+FE7C 923 \xEF\xB9\xBD | # U+FE7D 924 \xEF\xBD\xB0 # U+FF70 925 )/ix', 926 'ss', 927 $value 928 ); 929 930 return $value; 931 } 932 933 934 /** 935 * Pick apart some CSS and check it for forbidden or unsafe structures. 936 * Returns a sanitized string. This sanitized string will have 937 * character references and escape sequences decoded and comments 938 * stripped (unless it is itself one valid comment, in which case the value 939 * will be passed through). If the input is just too evil, only a comment 940 * complaining about evilness will be returned. 941 * 942 * Currently URL references, 'expression', 'tps' are forbidden. 943 * 944 * NOTE: Despite the fact that character references are decoded, the 945 * returned string may contain character references given certain 946 * clever input strings. These character references must 947 * be escaped before the return value is embedded in HTML. 948 * 949 * @param string $value 950 * @return string 951 */ 952 static function checkCss( $value ) { 953 $value = self::normalizeCss( $value ); 954 955 // Reject problematic keywords and control characters 956 if ( preg_match( '/[\000-\010\013\016-\037\177]/', $value ) ) { 957 return '/* invalid control char */'; 958 } elseif ( preg_match( 959 '! expression 960 | filter\s*: 961 | accelerator\s*: 962 | -o-link\s*: 963 | -o-link-source\s*: 964 | -o-replace\s*: 965 | url\s*\( 966 | image\s*\( 967 | image-set\s*\( 968 !ix', $value ) ) { 969 return '/* insecure input */'; 970 } 971 return $value; 972 } 973 974 /** 975 * @param array $matches 976 * @return string 977 */ 978 static function cssDecodeCallback( $matches ) { 979 if ( $matches[1] !== '' ) { 980 // Line continuation 981 return ''; 982 } elseif ( $matches[2] !== '' ) { 983 $char = codepointToUtf8( hexdec( $matches[2] ) ); 984 } elseif ( $matches[3] !== '' ) { 985 $char = $matches[3]; 986 } else { 987 $char = '\\'; 988 } 989 if ( $char == "\n" || $char == '"' || $char == "'" || $char == '\\' ) { 990 // These characters need to be escaped in strings 991 // Clean up the escape sequence to avoid parsing errors by clients 992 return '\\' . dechex( ord( $char ) ) . ' '; 993 } else { 994 // Decode unnecessary escape 995 return $char; 996 } 997 } 998 999 /** 1000 * Take a tag soup fragment listing an HTML element's attributes 1001 * and normalize it to well-formed XML, discarding unwanted attributes. 1002 * Output is safe for further wikitext processing, with escaping of 1003 * values that could trigger problems. 1004 * 1005 * - Normalizes attribute names to lowercase 1006 * - Discards attributes not on a whitelist for the given element 1007 * - Turns broken or invalid entities into plaintext 1008 * - Double-quotes all attribute values 1009 * - Attributes without values are given the name as attribute 1010 * - Double attributes are discarded 1011 * - Unsafe style attributes are discarded 1012 * - Prepends space if there are attributes. 1013 * 1014 * @param string $text 1015 * @param string $element 1016 * @return string 1017 */ 1018 static function fixTagAttributes( $text, $element ) { 1019 if ( trim( $text ) == '' ) { 1020 return ''; 1021 } 1022 1023 $decoded = Sanitizer::decodeTagAttributes( $text ); 1024 $stripped = Sanitizer::validateTagAttributes( $decoded, $element ); 1025 1026 return Sanitizer::safeEncodeTagAttributes( $stripped ); 1027 } 1028 1029 /** 1030 * Encode an attribute value for HTML output. 1031 * @param string $text 1032 * @return string HTML-encoded text fragment 1033 */ 1034 static function encodeAttribute( $text ) { 1035 $encValue = htmlspecialchars( $text, ENT_QUOTES ); 1036 1037 // Whitespace is normalized during attribute decoding, 1038 // so if we've been passed non-spaces we must encode them 1039 // ahead of time or they won't be preserved. 1040 $encValue = strtr( $encValue, array( 1041 "\n" => ' ', 1042 "\r" => ' ', 1043 "\t" => '	', 1044 ) ); 1045 1046 return $encValue; 1047 } 1048 1049 /** 1050 * Encode an attribute value for HTML tags, with extra armoring 1051 * against further wiki processing. 1052 * @param string $text 1053 * @return string HTML-encoded text fragment 1054 */ 1055 static function safeEncodeAttribute( $text ) { 1056 $encValue = Sanitizer::encodeAttribute( $text ); 1057 1058 # Templates and links may be expanded in later parsing, 1059 # creating invalid or dangerous output. Suppress this. 1060 $encValue = strtr( $encValue, array( 1061 '<' => '<', // This should never happen, 1062 '>' => '>', // we've received invalid input 1063 '"' => '"', // which should have been escaped. 1064 '{' => '{', 1065 '[' => '[', 1066 "''" => '''', 1067 'ISBN' => 'ISBN', 1068 'RFC' => 'RFC', 1069 'PMID' => 'PMID', 1070 '|' => '|', 1071 '__' => '__', 1072 ) ); 1073 1074 # Stupid hack 1075 $encValue = preg_replace_callback( 1076 '/((?i)' . wfUrlProtocols() . ')/', 1077 array( 'Sanitizer', 'armorLinksCallback' ), 1078 $encValue ); 1079 return $encValue; 1080 } 1081 1082 /** 1083 * Given a value, escape it so that it can be used in an id attribute and 1084 * return it. This will use HTML5 validation if $wgExperimentalHtmlIds is 1085 * true, allowing anything but ASCII whitespace. Otherwise it will use 1086 * HTML 4 rules, which means a narrow subset of ASCII, with bad characters 1087 * escaped with lots of dots. 1088 * 1089 * To ensure we don't have to bother escaping anything, we also strip ', ", 1090 * & even if $wgExperimentalIds is true. TODO: Is this the best tactic? 1091 * We also strip # because it upsets IE, and % because it could be 1092 * ambiguous if it's part of something that looks like a percent escape 1093 * (which don't work reliably in fragments cross-browser). 1094 * 1095 * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters 1096 * in the id and name attributes 1097 * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with 1098 * the id attribute 1099 * @see http://www.whatwg.org/html/elements.html#the-id-attribute 1100 * HTML5 definition of id attribute 1101 * 1102 * @param string $id Id to escape 1103 * @param string|array $options String or array of strings (default is array()): 1104 * 'noninitial': This is a non-initial fragment of an id, not a full id, 1105 * so don't pay attention if the first character isn't valid at the 1106 * beginning of an id. Only matters if $wgExperimentalHtmlIds is 1107 * false. 1108 * 'legacy': Behave the way the old HTML 4-based ID escaping worked even 1109 * if $wgExperimentalHtmlIds is used, so we can generate extra 1110 * anchors and links won't break. 1111 * @return string 1112 */ 1113 static function escapeId( $id, $options = array() ) { 1114 global $wgExperimentalHtmlIds; 1115 $options = (array)$options; 1116 1117 $id = Sanitizer::decodeCharReferences( $id ); 1118 1119 if ( $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) { 1120 $id = preg_replace( '/[ \t\n\r\f_\'"&#%]+/', '_', $id ); 1121 $id = trim( $id, '_' ); 1122 if ( $id === '' ) { 1123 # Must have been all whitespace to start with. 1124 return '_'; 1125 } else { 1126 return $id; 1127 } 1128 } 1129 1130 # HTML4-style escaping 1131 static $replace = array( 1132 '%3A' => ':', 1133 '%' => '.' 1134 ); 1135 1136 $id = urlencode( strtr( $id, ' ', '_' ) ); 1137 $id = str_replace( array_keys( $replace ), array_values( $replace ), $id ); 1138 1139 if ( !preg_match( '/^[a-zA-Z]/', $id ) 1140 && !in_array( 'noninitial', $options ) ) { 1141 // Initial character must be a letter! 1142 $id = "x$id"; 1143 } 1144 return $id; 1145 } 1146 1147 /** 1148 * Given a value, escape it so that it can be used as a CSS class and 1149 * return it. 1150 * 1151 * @todo For extra validity, input should be validated UTF-8. 1152 * 1153 * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format 1154 * 1155 * @param string $class 1156 * @return string 1157 */ 1158 static function escapeClass( $class ) { 1159 // Convert ugly stuff to underscores and kill underscores in ugly places 1160 return rtrim( preg_replace( 1161 array( '/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/', '/_+/' ), 1162 '_', 1163 $class ), '_' ); 1164 } 1165 1166 /** 1167 * Given HTML input, escape with htmlspecialchars but un-escape entities. 1168 * This allows (generally harmless) entities like   to survive. 1169 * 1170 * @param string $html HTML to escape 1171 * @return string Escaped input 1172 */ 1173 static function escapeHtmlAllowEntities( $html ) { 1174 $html = Sanitizer::decodeCharReferences( $html ); 1175 # It seems wise to escape ' as well as ", as a matter of course. Can't 1176 # hurt. 1177 $html = htmlspecialchars( $html, ENT_QUOTES ); 1178 return $html; 1179 } 1180 1181 /** 1182 * Regex replace callback for armoring links against further processing. 1183 * @param array $matches 1184 * @return string 1185 */ 1186 private static function armorLinksCallback( $matches ) { 1187 return str_replace( ':', ':', $matches[1] ); 1188 } 1189 1190 /** 1191 * Return an associative array of attribute names and values from 1192 * a partial tag string. Attribute names are forces to lowercase, 1193 * character references are decoded to UTF-8 text. 1194 * 1195 * @param string $text 1196 * @return array 1197 */ 1198 public static function decodeTagAttributes( $text ) { 1199 if ( trim( $text ) == '' ) { 1200 return array(); 1201 } 1202 1203 $attribs = array(); 1204 $pairs = array(); 1205 if ( !preg_match_all( 1206 self::getAttribsRegex(), 1207 $text, 1208 $pairs, 1209 PREG_SET_ORDER ) ) { 1210 return $attribs; 1211 } 1212 1213 foreach ( $pairs as $set ) { 1214 $attribute = strtolower( $set[1] ); 1215 $value = Sanitizer::getTagAttributeCallback( $set ); 1216 1217 // Normalize whitespace 1218 $value = preg_replace( '/[\t\r\n ]+/', ' ', $value ); 1219 $value = trim( $value ); 1220 1221 // Decode character references 1222 $attribs[$attribute] = Sanitizer::decodeCharReferences( $value ); 1223 } 1224 return $attribs; 1225 } 1226 1227 /** 1228 * Build a partial tag string from an associative array of attribute 1229 * names and values as returned by decodeTagAttributes. 1230 * 1231 * @param array $assoc_array 1232 * @return string 1233 */ 1234 public static function safeEncodeTagAttributes( $assoc_array ) { 1235 $attribs = array(); 1236 foreach ( $assoc_array as $attribute => $value ) { 1237 $encAttribute = htmlspecialchars( $attribute ); 1238 $encValue = Sanitizer::safeEncodeAttribute( $value ); 1239 1240 $attribs[] = "$encAttribute=\"$encValue\""; 1241 } 1242 return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : ''; 1243 } 1244 1245 /** 1246 * Pick the appropriate attribute value from a match set from the 1247 * attribs regex matches. 1248 * 1249 * @param array $set 1250 * @throws MWException When tag conditions are not met. 1251 * @return string 1252 */ 1253 private static function getTagAttributeCallback( $set ) { 1254 if ( isset( $set[6] ) ) { 1255 # Illegal #XXXXXX color with no quotes. 1256 return $set[6]; 1257 } elseif ( isset( $set[5] ) ) { 1258 # No quotes. 1259 return $set[5]; 1260 } elseif ( isset( $set[4] ) ) { 1261 # Single-quoted 1262 return $set[4]; 1263 } elseif ( isset( $set[3] ) ) { 1264 # Double-quoted 1265 return $set[3]; 1266 } elseif ( !isset( $set[2] ) ) { 1267 # In XHTML, attributes must have a value. 1268 # For 'reduced' form, return explicitly the attribute name here. 1269 return $set[1]; 1270 } else { 1271 throw new MWException( "Tag conditions not met. This should never happen and is a bug." ); 1272 } 1273 } 1274 1275 /** 1276 * Normalize whitespace and character references in an XML source- 1277 * encoded text for an attribute value. 1278 * 1279 * See http://www.w3.org/TR/REC-xml/#AVNormalize for background, 1280 * but note that we're not returning the value, but are returning 1281 * XML source fragments that will be slapped into output. 1282 * 1283 * @param string $text 1284 * @return string 1285 * @todo Remove, unused? 1286 */ 1287 private static function normalizeAttributeValue( $text ) { 1288 return str_replace( '"', '"', 1289 self::normalizeWhitespace( 1290 Sanitizer::normalizeCharReferences( $text ) ) ); 1291 } 1292 1293 /** 1294 * @param string $text 1295 * @return string 1296 */ 1297 private static function normalizeWhitespace( $text ) { 1298 return preg_replace( 1299 '/\r\n|[\x20\x0d\x0a\x09]/', 1300 ' ', 1301 $text ); 1302 } 1303 1304 /** 1305 * Normalizes whitespace in a section name, such as might be returned 1306 * by Parser::stripSectionName(), for use in the id's that are used for 1307 * section links. 1308 * 1309 * @param string $section 1310 * @return string 1311 */ 1312 static function normalizeSectionNameWhitespace( $section ) { 1313 return trim( preg_replace( '/[ _]+/', ' ', $section ) ); 1314 } 1315 1316 /** 1317 * Ensure that any entities and character references are legal 1318 * for XML and XHTML specifically. Any stray bits will be 1319 * &-escaped to result in a valid text fragment. 1320 * 1321 * a. named char refs can only be < > & ", others are 1322 * numericized (this way we're well-formed even without a DTD) 1323 * b. any numeric char refs must be legal chars, not invalid or forbidden 1324 * c. use lower cased "&#x", not "&#X" 1325 * d. fix or reject non-valid attributes 1326 * 1327 * @param string $text 1328 * @return string 1329 * @private 1330 */ 1331 static function normalizeCharReferences( $text ) { 1332 return preg_replace_callback( 1333 self::CHAR_REFS_REGEX, 1334 array( 'Sanitizer', 'normalizeCharReferencesCallback' ), 1335 $text ); 1336 } 1337 1338 /** 1339 * @param string $matches 1340 * @return string 1341 */ 1342 static function normalizeCharReferencesCallback( $matches ) { 1343 $ret = null; 1344 if ( $matches[1] != '' ) { 1345 $ret = Sanitizer::normalizeEntity( $matches[1] ); 1346 } elseif ( $matches[2] != '' ) { 1347 $ret = Sanitizer::decCharReference( $matches[2] ); 1348 } elseif ( $matches[3] != '' ) { 1349 $ret = Sanitizer::hexCharReference( $matches[3] ); 1350 } 1351 if ( is_null( $ret ) ) { 1352 return htmlspecialchars( $matches[0] ); 1353 } else { 1354 return $ret; 1355 } 1356 } 1357 1358 /** 1359 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, 1360 * return the equivalent numeric entity reference (except for the core < 1361 * > & "). If the entity is a MediaWiki-specific alias, returns 1362 * the HTML equivalent. Otherwise, returns HTML-escaped text of 1363 * pseudo-entity source (eg &foo;) 1364 * 1365 * @param string $name 1366 * @return string 1367 */ 1368 static function normalizeEntity( $name ) { 1369 if ( isset( self::$htmlEntityAliases[$name] ) ) { 1370 return '&' . self::$htmlEntityAliases[$name] . ';'; 1371 } elseif ( in_array( $name, 1372 array( 'lt', 'gt', 'amp', 'quot' ) ) ) { 1373 return "&$name;"; 1374 } elseif ( isset( self::$htmlEntities[$name] ) ) { 1375 return '&#' . self::$htmlEntities[$name] . ';'; 1376 } else { 1377 return "&$name;"; 1378 } 1379 } 1380 1381 /** 1382 * @param int $codepoint 1383 * @return null|string 1384 */ 1385 static function decCharReference( $codepoint ) { 1386 $point = intval( $codepoint ); 1387 if ( Sanitizer::validateCodepoint( $point ) ) { 1388 return sprintf( '&#%d;', $point ); 1389 } else { 1390 return null; 1391 } 1392 } 1393 1394 /** 1395 * @param int $codepoint 1396 * @return null|string 1397 */ 1398 static function hexCharReference( $codepoint ) { 1399 $point = hexdec( $codepoint ); 1400 if ( Sanitizer::validateCodepoint( $point ) ) { 1401 return sprintf( '&#x%x;', $point ); 1402 } else { 1403 return null; 1404 } 1405 } 1406 1407 /** 1408 * Returns true if a given Unicode codepoint is a valid character in XML. 1409 * @param int $codepoint 1410 * @return bool 1411 */ 1412 private static function validateCodepoint( $codepoint ) { 1413 return $codepoint == 0x09 1414 || $codepoint == 0x0a 1415 || $codepoint == 0x0d 1416 || ( $codepoint >= 0x20 && $codepoint <= 0xd7ff ) 1417 || ( $codepoint >= 0xe000 && $codepoint <= 0xfffd ) 1418 || ( $codepoint >= 0x10000 && $codepoint <= 0x10ffff ); 1419 } 1420 1421 /** 1422 * Decode any character references, numeric or named entities, 1423 * in the text and return a UTF-8 string. 1424 * 1425 * @param string $text 1426 * @return string 1427 */ 1428 public static function decodeCharReferences( $text ) { 1429 return preg_replace_callback( 1430 self::CHAR_REFS_REGEX, 1431 array( 'Sanitizer', 'decodeCharReferencesCallback' ), 1432 $text ); 1433 } 1434 1435 /** 1436 * Decode any character references, numeric or named entities, 1437 * in the next and normalize the resulting string. (bug 14952) 1438 * 1439 * This is useful for page titles, not for text to be displayed, 1440 * MediaWiki allows HTML entities to escape normalization as a feature. 1441 * 1442 * @param string $text Already normalized, containing entities 1443 * @return string Still normalized, without entities 1444 */ 1445 public static function decodeCharReferencesAndNormalize( $text ) { 1446 global $wgContLang; 1447 $text = preg_replace_callback( 1448 self::CHAR_REFS_REGEX, 1449 array( 'Sanitizer', 'decodeCharReferencesCallback' ), 1450 $text, /* limit */ -1, $count ); 1451 1452 if ( $count ) { 1453 return $wgContLang->normalize( $text ); 1454 } else { 1455 return $text; 1456 } 1457 } 1458 1459 /** 1460 * @param string $matches 1461 * @return string 1462 */ 1463 static function decodeCharReferencesCallback( $matches ) { 1464 if ( $matches[1] != '' ) { 1465 return Sanitizer::decodeEntity( $matches[1] ); 1466 } elseif ( $matches[2] != '' ) { 1467 return Sanitizer::decodeChar( intval( $matches[2] ) ); 1468 } elseif ( $matches[3] != '' ) { 1469 return Sanitizer::decodeChar( hexdec( $matches[3] ) ); 1470 } 1471 # Last case should be an ampersand by itself 1472 return $matches[0]; 1473 } 1474 1475 /** 1476 * Return UTF-8 string for a codepoint if that is a valid 1477 * character reference, otherwise U+FFFD REPLACEMENT CHARACTER. 1478 * @param int $codepoint 1479 * @return string 1480 * @private 1481 */ 1482 static function decodeChar( $codepoint ) { 1483 if ( Sanitizer::validateCodepoint( $codepoint ) ) { 1484 return codepointToUtf8( $codepoint ); 1485 } else { 1486 return UTF8_REPLACEMENT; 1487 } 1488 } 1489 1490 /** 1491 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD, 1492 * return the UTF-8 encoding of that character. Otherwise, returns 1493 * pseudo-entity source (eg "&foo;") 1494 * 1495 * @param string $name 1496 * @return string 1497 */ 1498 static function decodeEntity( $name ) { 1499 if ( isset( self::$htmlEntityAliases[$name] ) ) { 1500 $name = self::$htmlEntityAliases[$name]; 1501 } 1502 if ( isset( self::$htmlEntities[$name] ) ) { 1503 return codepointToUtf8( self::$htmlEntities[$name] ); 1504 } else { 1505 return "&$name;"; 1506 } 1507 } 1508 1509 /** 1510 * Fetch the whitelist of acceptable attributes for a given element name. 1511 * 1512 * @param string $element 1513 * @return array 1514 */ 1515 static function attributeWhitelist( $element ) { 1516 $list = Sanitizer::setupAttributeWhitelist(); 1517 return isset( $list[$element] ) 1518 ? $list[$element] 1519 : array(); 1520 } 1521 1522 /** 1523 * Foreach array key (an allowed HTML element), return an array 1524 * of allowed attributes 1525 * @return array 1526 */ 1527 static function setupAttributeWhitelist() { 1528 global $wgAllowRdfaAttributes, $wgAllowMicrodataAttributes; 1529 static $whitelist, $staticInitialised; 1530 1531 $globalContext = implode( '-', compact( 'wgAllowRdfaAttributes', 'wgAllowMicrodataAttributes' ) ); 1532 1533 if ( $whitelist !== null && $staticInitialised == $globalContext ) { 1534 return $whitelist; 1535 } 1536 1537 $common = array( 1538 # HTML 1539 'id', 1540 'class', 1541 'style', 1542 'lang', 1543 'dir', 1544 'title', 1545 1546 # WAI-ARIA 1547 'role', 1548 ); 1549 1550 if ( $wgAllowRdfaAttributes ) { 1551 # RDFa attributes as specified in section 9 of 1552 # http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014 1553 $common = array_merge( $common, array( 1554 'about', 'property', 'resource', 'datatype', 'typeof', 1555 ) ); 1556 } 1557 1558 if ( $wgAllowMicrodataAttributes ) { 1559 # add HTML5 microdata tags as specified by 1560 # http://www.whatwg.org/html/microdata.html#the-microdata-model 1561 $common = array_merge( $common, array( 1562 'itemid', 'itemprop', 'itemref', 'itemscope', 'itemtype' 1563 ) ); 1564 } 1565 1566 $block = array_merge( $common, array( 'align' ) ); 1567 $tablealign = array( 'align', 'valign' ); 1568 $tablecell = array( 1569 'abbr', 1570 'axis', 1571 'headers', 1572 'scope', 1573 'rowspan', 1574 'colspan', 1575 'nowrap', # deprecated 1576 'width', # deprecated 1577 'height', # deprecated 1578 'bgcolor', # deprecated 1579 ); 1580 1581 # Numbers refer to sections in HTML 4.01 standard describing the element. 1582 # See: http://www.w3.org/TR/html4/ 1583 $whitelist = array( 1584 # 7.5.4 1585 'div' => $block, 1586 'center' => $common, # deprecated 1587 'span' => $common, 1588 1589 # 7.5.5 1590 'h1' => $block, 1591 'h2' => $block, 1592 'h3' => $block, 1593 'h4' => $block, 1594 'h5' => $block, 1595 'h6' => $block, 1596 1597 # 7.5.6 1598 # address 1599 1600 # 8.2.4 1601 'bdo' => $common, 1602 1603 # 9.2.1 1604 'em' => $common, 1605 'strong' => $common, 1606 'cite' => $common, 1607 'dfn' => $common, 1608 'code' => $common, 1609 'samp' => $common, 1610 'kbd' => $common, 1611 'var' => $common, 1612 'abbr' => $common, 1613 # acronym 1614 1615 # 9.2.2 1616 'blockquote' => array_merge( $common, array( 'cite' ) ), 1617 'q' => array_merge( $common, array( 'cite' ) ), 1618 1619 # 9.2.3 1620 'sub' => $common, 1621 'sup' => $common, 1622 1623 # 9.3.1 1624 'p' => $block, 1625 1626 # 9.3.2 1627 'br' => array_merge( $common, array( 'clear' ) ), 1628 1629 # http://www.whatwg.org/html/text-level-semantics.html#the-wbr-element 1630 'wbr' => $common, 1631 1632 # 9.3.4 1633 'pre' => array_merge( $common, array( 'width' ) ), 1634 1635 # 9.4 1636 'ins' => array_merge( $common, array( 'cite', 'datetime' ) ), 1637 'del' => array_merge( $common, array( 'cite', 'datetime' ) ), 1638 1639 # 10.2 1640 'ul' => array_merge( $common, array( 'type' ) ), 1641 'ol' => array_merge( $common, array( 'type', 'start' ) ), 1642 'li' => array_merge( $common, array( 'type', 'value' ) ), 1643 1644 # 10.3 1645 'dl' => $common, 1646 'dd' => $common, 1647 'dt' => $common, 1648 1649 # 11.2.1 1650 'table' => array_merge( $common, 1651 array( 'summary', 'width', 'border', 'frame', 1652 'rules', 'cellspacing', 'cellpadding', 1653 'align', 'bgcolor', 1654 ) ), 1655 1656 # 11.2.2 1657 'caption' => $block, 1658 1659 # 11.2.3 1660 'thead' => $common, 1661 'tfoot' => $common, 1662 'tbody' => $common, 1663 1664 # 11.2.4 1665 'colgroup' => array_merge( $common, array( 'span' ) ), 1666 'col' => array_merge( $common, array( 'span' ) ), 1667 1668 # 11.2.5 1669 'tr' => array_merge( $common, array( 'bgcolor' ), $tablealign ), 1670 1671 # 11.2.6 1672 'td' => array_merge( $common, $tablecell, $tablealign ), 1673 'th' => array_merge( $common, $tablecell, $tablealign ), 1674 1675 # 12.2 1676 # NOTE: <a> is not allowed directly, but the attrib 1677 # whitelist is used from the Parser object 1678 'a' => array_merge( $common, array( 'href', 'rel', 'rev' ) ), # rel/rev esp. for RDFa 1679 1680 # 13.2 1681 # Not usually allowed, but may be used for extension-style hooks 1682 # such as <math> when it is rasterized, or if $wgAllowImageTag is 1683 # true 1684 'img' => array_merge( $common, array( 'alt', 'src', 'width', 'height' ) ), 1685 1686 # 15.2.1 1687 'tt' => $common, 1688 'b' => $common, 1689 'i' => $common, 1690 'big' => $common, 1691 'small' => $common, 1692 'strike' => $common, 1693 's' => $common, 1694 'u' => $common, 1695 1696 # 15.2.2 1697 'font' => array_merge( $common, array( 'size', 'color', 'face' ) ), 1698 # basefont 1699 1700 # 15.3 1701 'hr' => array_merge( $common, array( 'width' ) ), 1702 1703 # HTML Ruby annotation text module, simple ruby only. 1704 # http://www.whatwg.org/html/text-level-semantics.html#the-ruby-element 1705 'ruby' => $common, 1706 # rbc 1707 'rb' => $common, 1708 'rp' => $common, 1709 'rt' => $common, #array_merge( $common, array( 'rbspan' ) ), 1710 'rtc' => $common, 1711 1712 # MathML root element, where used for extensions 1713 # 'title' may not be 100% valid here; it's XHTML 1714 # http://www.w3.org/TR/REC-MathML/ 1715 'math' => array( 'class', 'style', 'id', 'title' ), 1716 1717 # HTML 5 section 4.6 1718 'bdi' => $common, 1719 1720 # HTML5 elements, defined by: 1721 # http://www.whatwg.org/html/ 1722 'data' => array_merge( $common, array( 'value' ) ), 1723 'time' => array_merge( $common, array( 'datetime' ) ), 1724 'mark' => $common, 1725 1726 // meta and link are only permitted by removeHTMLtags when Microdata 1727 // is enabled so we don't bother adding a conditional to hide these 1728 // Also meta and link are only valid in WikiText as Microdata elements 1729 // (ie: validateTag rejects tags missing the attributes needed for Microdata) 1730 // So we don't bother including $common attributes that have no purpose. 1731 'meta' => array( 'itemprop', 'content' ), 1732 'link' => array( 'itemprop', 'href' ), 1733 ); 1734 1735 $staticInitialised = $globalContext; 1736 1737 return $whitelist; 1738 } 1739 1740 /** 1741 * Take a fragment of (potentially invalid) HTML and return 1742 * a version with any tags removed, encoded as plain text. 1743 * 1744 * Warning: this return value must be further escaped for literal 1745 * inclusion in HTML output as of 1.10! 1746 * 1747 * @param string $text HTML fragment 1748 * @return string 1749 */ 1750 static function stripAllTags( $text ) { 1751 # Actual <tags> 1752 $text = StringUtils::delimiterReplace( '<', '>', '', $text ); 1753 1754 # Normalize &entities and whitespace 1755 $text = self::decodeCharReferences( $text ); 1756 $text = self::normalizeWhitespace( $text ); 1757 1758 return $text; 1759 } 1760 1761 /** 1762 * Hack up a private DOCTYPE with HTML's standard entity declarations. 1763 * PHP 4 seemed to know these if you gave it an HTML doctype, but 1764 * PHP 5.1 doesn't. 1765 * 1766 * Use for passing XHTML fragments to PHP's XML parsing functions 1767 * 1768 * @return string 1769 */ 1770 static function hackDocType() { 1771 $out = "<!DOCTYPE html [\n"; 1772 foreach ( self::$htmlEntities as $entity => $codepoint ) { 1773 $out .= "<!ENTITY $entity \"&#$codepoint;\">"; 1774 } 1775 $out .= "]>\n"; 1776 return $out; 1777 } 1778 1779 /** 1780 * @param string $url 1781 * @return mixed|string 1782 */ 1783 static function cleanUrl( $url ) { 1784 # Normalize any HTML entities in input. They will be 1785 # re-escaped by makeExternalLink(). 1786 $url = Sanitizer::decodeCharReferences( $url ); 1787 1788 # Escape any control characters introduced by the above step 1789 $url = preg_replace_callback( '/[\][<>"\\x00-\\x20\\x7F\|]/', 1790 array( __CLASS__, 'cleanUrlCallback' ), $url ); 1791 1792 # Validate hostname portion 1793 $matches = array(); 1794 if ( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) { 1795 list( /* $whole */, $protocol, $host, $rest ) = $matches; 1796 1797 // Characters that will be ignored in IDNs. 1798 // http://tools.ietf.org/html/3454#section-3.1 1799 // Strip them before further processing so blacklists and such work. 1800 $strip = "/ 1801 \\s| # general whitespace 1802 \xc2\xad| # 00ad SOFT HYPHEN 1803 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN 1804 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE 1805 \xe2\x81\xa0| # 2060 WORD JOINER 1806 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE 1807 \xcd\x8f| # 034f COMBINING GRAPHEME JOINER 1808 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE 1809 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO 1810 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE 1811 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER 1812 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER 1813 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe0f VARIATION SELECTOR-1-16 1814 /xuD"; 1815 1816 $host = preg_replace( $strip, '', $host ); 1817 1818 // @todo FIXME: Validate hostnames here 1819 1820 return $protocol . $host . $rest; 1821 } else { 1822 return $url; 1823 } 1824 } 1825 1826 /** 1827 * @param array $matches 1828 * @return string 1829 */ 1830 static function cleanUrlCallback( $matches ) { 1831 return urlencode( $matches[0] ); 1832 } 1833 1834 /** 1835 * Does a string look like an e-mail address? 1836 * 1837 * This validates an email address using an HTML5 specification found at: 1838 * http://www.whatwg.org/html/states-of-the-type-attribute.html#valid-e-mail-address 1839 * Which as of 2011-01-24 says: 1840 * 1841 * A valid e-mail address is a string that matches the ABNF production 1842 * 1*( atext / "." ) "@" ldh-str *( "." ldh-str ) where atext is defined 1843 * in RFC 5322 section 3.2.3, and ldh-str is defined in RFC 1034 section 1844 * 3.5. 1845 * 1846 * This function is an implementation of the specification as requested in 1847 * bug 22449. 1848 * 1849 * Client-side forms will use the same standard validation rules via JS or 1850 * HTML 5 validation; additional restrictions can be enforced server-side 1851 * by extensions via the 'isValidEmailAddr' hook. 1852 * 1853 * Note that this validation doesn't 100% match RFC 2822, but is believed 1854 * to be liberal enough for wide use. Some invalid addresses will still 1855 * pass validation here. 1856 * 1857 * @since 1.18 1858 * 1859 * @param string $addr E-mail address 1860 * @return bool 1861 */ 1862 public static function validateEmail( $addr ) { 1863 $result = null; 1864 if ( !wfRunHooks( 'isValidEmailAddr', array( $addr, &$result ) ) ) { 1865 return $result; 1866 } 1867 1868 // Please note strings below are enclosed in brackets [], this make the 1869 // hyphen "-" a range indicator. Hence it is double backslashed below. 1870 // See bug 26948 1871 $rfc5322_atext = "a-z0-9!#$%&'*+\\-\/=?^_`{|}~"; 1872 $rfc1034_ldh_str = "a-z0-9\\-"; 1873 1874 $html5_email_regexp = "/ 1875 ^ # start of string 1876 [$rfc5322_atext\\.]+ # user part which is liberal :p 1877 @ # 'apostrophe' 1878 [$rfc1034_ldh_str]+ # First domain part 1879 (\\.[$rfc1034_ldh_str]+)* # Following part prefixed with a dot 1880 $ # End of string 1881 /ix"; // case Insensitive, eXtended 1882 1883 return (bool)preg_match( $html5_email_regexp, $addr ); 1884 } 1885 }
title
Description
Body
title
Description
Body
title
Description
Body
title
Body
| Generated: Fri Nov 28 14:03:12 2014 | Cross-referenced by PHPXref 0.7.1 |