includes/Sanitizer.php

   1 <?php
   2 /**
   3  * XHTML sanitizer for MediaWiki
   4  *
   5  * Copyright © 2002-2005 Brion Vibber <brion@pobox.com> et al
   6  * http://www.mediawiki.org/
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along
  19  * with this program; if not, write to the Free Software Foundation, Inc.,
  20  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  21  * http://www.gnu.org/copyleft/gpl.html
  22  *
  23  * @file
  24  * @ingroup Parser
  25  */
  26
  27 /**
  28  * Regular expression to match various types of character references in
  29  * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
  30  */
  31 define( 'MW_CHAR_REFS_REGEX',
  32         '/&([A-Za-z0-9\x80-\xff]+);
  33          |&\#([0-9]+);
  34          |&\#x([0-9A-Za-z]+);
  35          |&\#X([0-9A-Za-z]+);
  36          |(&)/x' );
  37
  38 /**
  39  * Regular expression to match HTML/XML attribute pairs within a tag.
  40  * Allows some... latitude.
  41  * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
  42  */
  43 $attrib_first = '[:A-Z_a-z]';
  44 $attrib = '[:A-Z_a-z-.0-9]';
  45 $space = '[\x09\x0a\x0d\x20]';
  46 define( 'MW_ATTRIBS_REGEX',
  47         "/(?:^|$space)({$attrib_first}{$attrib}*)
  48           ($space*=$space*
  49                 (?:
  50                  # The attribute value: quoted or alone
  51                   \"([^<\"]*)\"
  52                  | '([^<']*)'
  53                  |  ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
  54                  |  (\#[0-9a-fA-F]+) # Technically wrong, but lots of
  55                                                          # colors are specified like this.
  56                                                          # We'll be normalizing it.
  57                 )
  58            )?(?=$space|\$)/sx" );
  59
  60 /**
  61  * Regular expression to match URIs that could trigger script execution
  62  */
  63 define( 'MW_EVIL_URI_PATTERN', '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i' );
  64
  65 /**
  66  * Regular expression to match namespace attributes
  67  */
  68 define( 'MW_XMLNS_ATTRIBUTE_PATTRN', "/^xmlns:$attrib+$/" );
  69
  70 /**
  71  * List of all named character entities defined in HTML 4.01
  72  * http://www.w3.org/TR/html4/sgml/entities.html
  73  * @private
  74  */
  75 global $wgHtmlEntities;
  76 $wgHtmlEntities = array(
  77         'Aacute'   => 193,
  78         'aacute'   => 225,
  79         'Acirc'    => 194,
  80         'acirc'    => 226,
  81         'acute'    => 180,
  82         'AElig'    => 198,
  83         'aelig'    => 230,
  84         'Agrave'   => 192,
  85         'agrave'   => 224,
  86         'alefsym'  => 8501,
  87         'Alpha'    => 913,
  88         'alpha'    => 945,
  89         'amp'      => 38,
  90         'and'      => 8743,
  91         'ang'      => 8736,
  92         'Aring'    => 197,
  93         'aring'    => 229,
  94         'asymp'    => 8776,
  95         'Atilde'   => 195,
  96         'atilde'   => 227,
  97         'Auml'     => 196,
  98         'auml'     => 228,
  99         'bdquo'    => 8222,
 100         'Beta'     => 914,
 101         'beta'     => 946,
 102         'brvbar'   => 166,
 103         'bull'     => 8226,
 104         'cap'      => 8745,
 105         'Ccedil'   => 199,
 106         'ccedil'   => 231,
 107         'cedil'    => 184,
 108         'cent'     => 162,
 109         'Chi'      => 935,
 110         'chi'      => 967,
 111         'circ'     => 710,
 112         'clubs'    => 9827,
 113         'cong'     => 8773,
 114         'copy'     => 169,
 115         'crarr'    => 8629,
 116         'cup'      => 8746,
 117         'curren'   => 164,
 118         'dagger'   => 8224,
 119         'Dagger'   => 8225,
 120         'darr'     => 8595,
 121         'dArr'     => 8659,
 122         'deg'      => 176,
 123         'Delta'    => 916,
 124         'delta'    => 948,
 125         'diams'    => 9830,
 126         'divide'   => 247,
 127         'Eacute'   => 201,
 128         'eacute'   => 233,
 129         'Ecirc'    => 202,
 130         'ecirc'    => 234,
 131         'Egrave'   => 200,
 132         'egrave'   => 232,
 133         'empty'    => 8709,
 134         'emsp'     => 8195,
 135         'ensp'     => 8194,
 136         'Epsilon'  => 917,
 137         'epsilon'  => 949,
 138         'equiv'    => 8801,
 139         'Eta'      => 919,
 140         'eta'      => 951,
 141         'ETH'      => 208,
 142         'eth'      => 240,
 143         'Euml'     => 203,
 144         'euml'     => 235,
 145         'euro'     => 8364,
 146         'exist'    => 8707,
 147         'fnof'     => 402,
 148         'forall'   => 8704,
 149         'frac12'   => 189,
 150         'frac14'   => 188,
 151         'frac34'   => 190,
 152         'frasl'    => 8260,
 153         'Gamma'    => 915,
 154         'gamma'    => 947,
 155         'ge'       => 8805,
 156         'gt'       => 62,
 157         'harr'     => 8596,
 158         'hArr'     => 8660,
 159         'hearts'   => 9829,
 160         'hellip'   => 8230,
 161         'Iacute'   => 205,
 162         'iacute'   => 237,
 163         'Icirc'    => 206,
 164         'icirc'    => 238,
 165         'iexcl'    => 161,
 166         'Igrave'   => 204,
 167         'igrave'   => 236,
 168         'image'    => 8465,
 169         'infin'    => 8734,
 170         'int'      => 8747,
 171         'Iota'     => 921,
 172         'iota'     => 953,
 173         'iquest'   => 191,
 174         'isin'     => 8712,
 175         'Iuml'     => 207,
 176         'iuml'     => 239,
 177         'Kappa'    => 922,
 178         'kappa'    => 954,
 179         'Lambda'   => 923,
 180         'lambda'   => 955,
 181         'lang'     => 9001,
 182         'laquo'    => 171,
 183         'larr'     => 8592,
 184         'lArr'     => 8656,
 185         'lceil'    => 8968,
 186         'ldquo'    => 8220,
 187         'le'       => 8804,
 188         'lfloor'   => 8970,
 189         'lowast'   => 8727,
 190         'loz'      => 9674,
 191         'lrm'      => 8206,
 192         'lsaquo'   => 8249,
 193         'lsquo'    => 8216,
 194         'lt'       => 60,
 195         'macr'     => 175,
 196         'mdash'    => 8212,
 197         'micro'    => 181,
 198         'middot'   => 183,
 199         'minus'    => 8722,
 200         'Mu'       => 924,
 201         'mu'       => 956,
 202         'nabla'    => 8711,
 203         'nbsp'     => 160,
 204         'ndash'    => 8211,
 205         'ne'       => 8800,
 206         'ni'       => 8715,
 207         'not'      => 172,
 208         'notin'    => 8713,
 209         'nsub'     => 8836,
 210         'Ntilde'   => 209,
 211         'ntilde'   => 241,
 212         'Nu'       => 925,
 213         'nu'       => 957,
 214         'Oacute'   => 211,
 215         'oacute'   => 243,
 216         'Ocirc'    => 212,
 217         'ocirc'    => 244,
 218         'OElig'    => 338,
 219         'oelig'    => 339,
 220         'Ograve'   => 210,
 221         'ograve'   => 242,
 222         'oline'    => 8254,
 223         'Omega'    => 937,
 224         'omega'    => 969,
 225         'Omicron'  => 927,
 226         'omicron'  => 959,
 227         'oplus'    => 8853,
 228         'or'       => 8744,
 229         'ordf'     => 170,
 230         'ordm'     => 186,
 231         'Oslash'   => 216,
 232         'oslash'   => 248,
 233         'Otilde'   => 213,
 234         'otilde'   => 245,
 235         'otimes'   => 8855,
 236         'Ouml'     => 214,
 237         'ouml'     => 246,
 238         'para'     => 182,
 239         'part'     => 8706,
 240         'permil'   => 8240,
 241         'perp'     => 8869,
 242         'Phi'      => 934,
 243         'phi'      => 966,
 244         'Pi'       => 928,
 245         'pi'       => 960,
 246         'piv'      => 982,
 247         'plusmn'   => 177,
 248         'pound'    => 163,
 249         'prime'    => 8242,
 250         'Prime'    => 8243,
 251         'prod'     => 8719,
 252         'prop'     => 8733,
 253         'Psi'      => 936,
 254         'psi'      => 968,
 255         'quot'     => 34,
 256         'radic'    => 8730,
 257         'rang'     => 9002,
 258         'raquo'    => 187,
 259         'rarr'     => 8594,
 260         'rArr'     => 8658,
 261         'rceil'    => 8969,
 262         'rdquo'    => 8221,
 263         'real'     => 8476,
 264         'reg'      => 174,
 265         'rfloor'   => 8971,
 266         'Rho'      => 929,
 267         'rho'      => 961,
 268         'rlm'      => 8207,
 269         'rsaquo'   => 8250,
 270         'rsquo'    => 8217,
 271         'sbquo'    => 8218,
 272         'Scaron'   => 352,
 273         'scaron'   => 353,
 274         'sdot'     => 8901,
 275         'sect'     => 167,
 276         'shy'      => 173,
 277         'Sigma'    => 931,
 278         'sigma'    => 963,
 279         'sigmaf'   => 962,
 280         'sim'      => 8764,
 281         'spades'   => 9824,
 282         'sub'      => 8834,
 283         'sube'     => 8838,
 284         'sum'      => 8721,
 285         'sup'      => 8835,
 286         'sup1'     => 185,
 287         'sup2'     => 178,
 288         'sup3'     => 179,
 289         'supe'     => 8839,
 290         'szlig'    => 223,
 291         'Tau'      => 932,
 292         'tau'      => 964,
 293         'there4'   => 8756,
 294         'Theta'    => 920,
 295         'theta'    => 952,
 296         'thetasym' => 977,
 297         'thinsp'   => 8201,
 298         'THORN'    => 222,
 299         'thorn'    => 254,
 300         'tilde'    => 732,
 301         'times'    => 215,
 302         'trade'    => 8482,
 303         'Uacute'   => 218,
 304         'uacute'   => 250,
 305         'uarr'     => 8593,
 306         'uArr'     => 8657,
 307         'Ucirc'    => 219,
 308         'ucirc'    => 251,
 309         'Ugrave'   => 217,
 310         'ugrave'   => 249,
 311         'uml'      => 168,
 312         'upsih'    => 978,
 313         'Upsilon'  => 933,
 314         'upsilon'  => 965,
 315         'Uuml'     => 220,
 316         'uuml'     => 252,
 317         'weierp'   => 8472,
 318         'Xi'       => 926,
 319         'xi'       => 958,
 320         'Yacute'   => 221,
 321         'yacute'   => 253,
 322         'yen'      => 165,
 323         'Yuml'     => 376,
 324         'yuml'     => 255,
 325         'Zeta'     => 918,
 326         'zeta'     => 950,
 327         'zwj'      => 8205,
 328         'zwnj'     => 8204 );
 329
 330 /**
 331  * Character entity aliases accepted by MediaWiki
 332  */
 333 global $wgHtmlEntityAliases;
 334 $wgHtmlEntityAliases = array(
 335         'רלמ' => 'rlm',
 336         'رلم' => 'rlm',
 337 );
 338
 339
 340 /**
 341  * XHTML sanitizer for MediaWiki
 342  * @ingroup Parser
 343  */
 344 class Sanitizer {
 345         /**
 346          * Cleans up HTML, removes dangerous tags and attributes, and
 347          * removes HTML comments
 348          * @private
 349          * @param $text String
 350          * @param $processCallback Callback to do any variable or parameter replacements in HTML attribute values
 351          * @param $args Array for the processing callback
 352          * @param $extratags Array for any extra tags to include
 353          * @param $removetags Array for any tags (default or extra) to exclude
 354          * @return string
 355          */
 356         static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array(), $removetags = array() ) {
 357                 global $wgUseTidy;
 358
 359                 static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
 360                         $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
 361
 362                 wfProfileIn( __METHOD__ );
 363
 364                 if ( !$staticInitialised ) {
 365
 366                         $htmlpairsStatic = array( # Tags that must be closed
 367                                 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
 368                                 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
 369                                 'strike', 'strong', 'tt', 'var', 'div', 'center',
 370                                 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
 371                                 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u', 'abbr', 'dfn',
 372                                 'kbd', 'samp'
 373                         );
 374                         $htmlsingle = array(
 375                                 'br', 'hr', 'li', 'dt', 'dd'
 376                         );
 377                         $htmlsingleonly = array( # Elements that cannot have close tags
 378                                 'br', 'hr'
 379                         );
 380                         $htmlnest = array( # Tags that can be nested--??
 381                                 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
 382                                 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
 383                         );
 384                         $tabletags = array( # Can only appear inside table, we will close them
 385                                 'td', 'th', 'tr',
 386                         );
 387                         $htmllist = array( # Tags used by list
 388                                 'ul','ol',
 389                         );
 390                         $listtags = array( # Tags that can appear in a list
 391                                 'li',
 392                         );
 393
 394                         global $wgAllowImageTag;
 395                         if ( $wgAllowImageTag ) {
 396                                 $htmlsingle[] = 'img';
 397                                 $htmlsingleonly[] = 'img';
 398                         }
 399
 400                         $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
 401                         $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
 402
 403                         # Convert them all to hashtables for faster lookup
 404                         $vars = array( 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
 405                                 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' );
 406                         foreach ( $vars as $var ) {
 407                                 $$var = array_flip( $$var );
 408                         }
 409                         $staticInitialised = true;
 410                 }
 411                 # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
 412                 $extratags = array_flip( $extratags );
 413                 $removetags = array_flip( $removetags );
 414                 $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
 415                 $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ) , $removetags );
 416
 417                 # Remove HTML comments
 418                 $text = Sanitizer::removeHTMLcomments( $text );
 419                 $bits = explode( '<', $text );
 420                 $text = str_replace( '>', '&gt;', array_shift( $bits ) );
 421                 if ( !$wgUseTidy ) {
 422                         $tagstack = $tablestack = array();
 423                         foreach ( $bits as $x ) {
 424                                 $regs = array();
 425                                 # $slash: Does the current element start with a '/'?
 426                                 # $t: Current element name
 427                                 # $params: String between element name and >
 428                                 # $brace: Ending '>' or '/>'
 429                                 # $rest: Everything until the next element of $bits
 430                                 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
 431                                         list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
 432                                 } else {
 433                                         $slash = $t = $params = $brace = $rest = null;
 434                                 }
 435
 436                                 $badtag = false;
 437                                 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
 438                                         # Check our stack
 439                                         if ( $slash && isset( $htmlsingleonly[$t] ) ) {
 440                                                 $badtag = true;
 441                                         } elseif ( $slash ) {
 442                                                 # Closing a tag... is it the one we just opened?
 443                                                 $ot = @array_pop( $tagstack );
 444                                                 if ( $ot != $t ) {
 445                                                         if ( isset( $htmlsingleallowed[$ot] ) ) {
 446                                                                 # Pop all elements with an optional close tag
 447                                                                 # and see if we find a match below them
 448                                                                 $optstack = array();
 449                                                                 array_push( $optstack, $ot );
 450                                                                 $ot = @array_pop( $tagstack );
 451                                                                 while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
 452                                                                         array_push( $optstack, $ot );
 453                                                                         $ot = @array_pop( $tagstack );
 454                                                                 }
 455                                                                 if ( $t != $ot ) {
 456                                                                         # No match. Push the optional elements back again
 457                                                                         $badtag = true;
 458                                                                         while ( $ot = @array_pop( $optstack ) ) {
 459                                                                                 array_push( $tagstack, $ot );
 460                                                                         }
 461                                                                 }
 462                                                         } else {
 463                                                                 @array_push( $tagstack, $ot );
 464                                                                 # <li> can be nested in <ul> or <ol>, skip those cases:
 465                                                                 if ( !isset( $htmllist[$ot] ) || !isset( $listtags[$t] ) ) {
 466                                                                         $badtag = true;
 467                                                                 }
 468                                                         }
 469                                                 } else {
 470                                                         if ( $t == 'table' ) {
 471                                                                 $tagstack = array_pop( $tablestack );
 472                                                         }
 473                                                 }
 474                                                 $newparams = '';
 475                                         } else {
 476                                                 # Keep track for later
 477                                                 if ( isset( $tabletags[$t] ) &&
 478                                                 !in_array( 'table', $tagstack ) ) {
 479                                                         $badtag = true;
 480                                                 } elseif ( in_array( $t, $tagstack ) &&
 481                                                 !isset( $htmlnest [$t ] ) ) {
 482                                                         $badtag = true;
 483                                                 # Is it a self closed htmlpair ? (bug 5487)
 484                                                 } elseif ( $brace == '/>' &&
 485                                                 isset( $htmlpairs[$t] ) ) {
 486                                                         $badtag = true;
 487                                                 } elseif ( isset( $htmlsingleonly[$t] ) ) {
 488                                                         # Hack to force empty tag for uncloseable elements
 489                                                         $brace = '/>';
 490                                                 } elseif ( isset( $htmlsingle[$t] ) ) {
 491                                                         # Hack to not close $htmlsingle tags
 492                                                         $brace = null;
 493                                                 } elseif ( isset( $tabletags[$t] )
 494                                                 && in_array( $t, $tagstack ) ) {
 495                                                         // New table tag but forgot to close the previous one
 496                                                         $text .= "</$t>";
 497                                                 } else {
 498                                                         if ( $t == 'table' ) {
 499                                                                 array_push( $tablestack, $tagstack );
 500                                                                 $tagstack = array();
 501                                                         }
 502                                                         array_push( $tagstack, $t );
 503                                                 }
 504
 505                                                 # Replace any variables or template parameters with
 506                                                 # plaintext results.
 507                                                 if( is_callable( $processCallback ) ) {
 508                                                         call_user_func_array( $processCallback, array( &$params, $args ) );
 509                                                 }
 510
 511                                                 # Strip non-approved attributes from the tag
 512                                                 $newparams = Sanitizer::fixTagAttributes( $params, $t );
 513                                         }
 514                                         if ( !$badtag ) {
 515                                                 $rest = str_replace( '>', '&gt;', $rest );
 516                                                 $close = ( $brace == '/>' && !$slash ) ? ' /' : '';
 517                                                 $text .= "<$slash$t$newparams$close>$rest";
 518                                                 continue;
 519                                         }
 520                                 }
 521                                 $text .= '&lt;' . str_replace( '>', '&gt;', $x);
 522                         }
 523                         # Close off any remaining tags
 524                         while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
 525                                 $text .= "</$t>\n";
 526                                 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
 527                         }
 528                 } else {
 529                         # this might be possible using tidy itself
 530                         foreach ( $bits as $x ) {
 531                                 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
 532                                 $x, $regs );
 533                                 @list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
 534                                 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
 535                                         if( is_callable( $processCallback ) ) {
 536                                                 call_user_func_array( $processCallback, array( &$params, $args ) );
 537                                         }
 538                                         $newparams = Sanitizer::fixTagAttributes( $params, $t );
 539                                         $rest = str_replace( '>', '&gt;', $rest );
 540                                         $text .= "<$slash$t$newparams$brace$rest";
 541                                 } else {
 542                                         $text .= '&lt;' . str_replace( '>', '&gt;', $x);
 543                                 }
 544                         }
 545                 }
 546                 wfProfileOut( __METHOD__ );
 547                 return $text;
 548         }
 549
 550         /**
 551          * Remove '<!--', '-->', and everything between.
 552          * To avoid leaving blank lines, when a comment is both preceded
 553          * and followed by a newline (ignoring spaces), trim leading and
 554          * trailing spaces and one of the newlines.
 555          *
 556          * @private
 557          * @param $text String
 558          * @return string
 559          */
 560         static function removeHTMLcomments( $text ) {
 561                 wfProfileIn( __METHOD__ );
 562                 while (($start = strpos($text, '<!--')) !== false) {
 563                         $end = strpos($text, '-->', $start + 4);
 564                         if ($end === false) {
 565                                 # Unterminated comment; bail out
 566                                 break;
 567                         }
 568
 569                         $end += 3;
 570
 571                         # Trim space and newline if the comment is both
 572                         # preceded and followed by a newline
 573                         $spaceStart = max($start - 1, 0);
 574                         $spaceLen = $end - $spaceStart;
 575                         while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
 576                                 $spaceStart--;
 577                                 $spaceLen++;
 578                         }
 579                         while (substr($text, $spaceStart + $spaceLen, 1) === ' ')
 580                                 $spaceLen++;
 581                         if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart + $spaceLen, 1) === "\n") {
 582                                 # Remove the comment, leading and trailing
 583                                 # spaces, and leave only one newline.
 584                                 $text = substr_replace($text, "\n", $spaceStart, $spaceLen + 1);
 585                         }
 586                         else {
 587                                 # Remove just the comment.
 588                                 $text = substr_replace($text, '', $start, $end - $start);
 589                         }
 590                 }
 591                 wfProfileOut( __METHOD__ );
 592                 return $text;
 593         }
 594
 595         /**
 596          * Take an array of attribute names and values and normalize or discard
 597          * illegal values for the given element type.
 598          *
 599          * - Discards attributes not on a whitelist for the given element
 600          * - Unsafe style attributes are discarded
 601          * - Invalid id attributes are reencoded
 602          *
 603          * @param $attribs Array
 604          * @param $element String
 605          * @return Array
 606          *
 607          * @todo Check for legal values where the DTD limits things.
 608          * @todo Check for unique id attribute :P
 609          */
 610         static function validateTagAttributes( $attribs, $element ) {
 611                 return Sanitizer::validateAttributes( $attribs,
 612                         Sanitizer::attributeWhitelist( $element ) );
 613         }
 614
 615         /**
 616          * Take an array of attribute names and values and normalize or discard
 617          * illegal values for the given whitelist.
 618          *
 619          * - Discards attributes not the given whitelist
 620          * - Unsafe style attributes are discarded
 621          * - Invalid id attributes are reencoded
 622          *
 623          * @param $attribs Array
 624          * @param $whitelist Array: list of allowed attribute names
 625          * @return Array
 626          *
 627          * @todo Check for legal values where the DTD limits things.
 628          * @todo Check for unique id attribute :P
 629          */
 630         static function validateAttributes( $attribs, $whitelist ) {
 631                 global $wgAllowRdfaAttributes, $wgAllowMicrodataAttributes, $wgHtml5;
 632
 633                 $whitelist = array_flip( $whitelist );
 634                 $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
 635
 636                 $out = array();
 637                 foreach( $attribs as $attribute => $value ) {
 638                         #allow XML namespace declaration if RDFa is enabled
 639                         if ( $wgAllowRdfaAttributes && preg_match( MW_XMLNS_ATTRIBUTE_PATTRN, $attribute ) ) {
 640                                 if ( !preg_match( MW_EVIL_URI_PATTERN, $value ) ) {
 641                                         $out[$attribute] = $value;
 642                                 }
 643
 644                                 continue;
 645                         }
 646
 647                         # Allow any attribute beginning with "data-", if in HTML5 mode
 648                         if ( !($wgHtml5 && preg_match( '/^data-/i', $attribute )) && !isset( $whitelist[$attribute] ) ) {
 649                                 continue;
 650                         }
 651
 652                         # Strip javascript "expression" from stylesheets.
 653                         # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
 654                         if( $attribute == 'style' ) {
 655                                 $value = Sanitizer::checkCss( $value );
 656                         }
 657
 658                         if ( $attribute === 'id' ) {
 659                                 $value = Sanitizer::escapeId( $value, 'noninitial' );
 660                         }
 661
 662                         //RDFa and microdata properties allow URLs, URIs and/or CURIs. check them for sanity
 663                         if ( $attribute === 'rel' || $attribute === 'rev' ||
 664                                 $attribute === 'about' || $attribute === 'property' || $attribute === 'resource' || #RDFa
 665                                 $attribute === 'datatype' || $attribute === 'typeof' ||                             #RDFa
 666                                 $attribute === 'itemid' || $attribute === 'itemprop' || $attribute === 'itemref' || #HTML5 microdata
 667                                 $attribute === 'itemscope' || $attribute === 'itemtype' ) {                         #HTML5 microdata
 668
 669                                 //Paranoia. Allow "simple" values but suppress javascript
 670                                 if ( preg_match( MW_EVIL_URI_PATTERN, $value ) ) {
 671                                         continue;
 672                                 }
 673                         }
 674
 675                         # NOTE: even though elements using href/src are not allowed directly, supply
 676                         #       validation code that can be used by tag hook handlers, etc
 677                         if ( $attribute === 'href' || $attribute === 'src' ) {
 678                                 if ( !preg_match( $hrefExp, $value ) ) {
 679                                         continue; //drop any href or src attributes not using an allowed protocol.
 680                                                   //NOTE: this also drops all relative URLs
 681                                 }
 682                         }
 683
 684                         // If this attribute was previously set, override it.
 685                         // Output should only have one attribute of each name.
 686                         $out[$attribute] = $value;
 687                 }
 688
 689                 if ( $wgAllowMicrodataAttributes ) {
 690                         # There are some complicated validity constraints we need to
 691                         # enforce here.  First of all, we don't want to allow non-standard
 692                         # itemtypes.
 693                         $allowedTypes = array(
 694                                 'http://microformats.org/profile/hcard',
 695                                 'http://microformats.org/profile/hcalendar#vevent',
 696                                 'http://n.whatwg.org/work',
 697                         );
 698                         if ( isset( $out['itemtype'] ) && !in_array( $out['itemtype'],
 699                         $allowedTypes ) ) {
 700                                 # Kill everything
 701                                 unset( $out['itemscope'] );
 702                         }
 703                         # itemtype, itemid, itemref don't make sense without itemscope
 704                         if ( !array_key_exists( 'itemscope', $out ) ) {
 705                                 unset( $out['itemtype'] );
 706                                 unset( $out['itemid'] );
 707                                 unset( $out['itemref'] );
 708                         }
 709                         # TODO: Strip itemprop if we aren't descendants of an itemscope.
 710                 }
 711                 return $out;
 712         }
 713
 714         /**
 715          * Merge two sets of HTML attributes.  Conflicting items in the second set
 716          * will override those in the first, except for 'class' attributes which
 717          * will be combined (if they're both strings).
 718          *
 719          * @todo implement merging for other attributes such as style
 720          * @param $a Array
 721          * @param $b Array
 722          * @return array
 723          */
 724         static function mergeAttributes( $a, $b ) {
 725                 $out = array_merge( $a, $b );
 726                 if( isset( $a['class'] ) && isset( $b['class'] )
 727                 && is_string( $a['class'] ) && is_string( $b['class'] )
 728                 && $a['class'] !== $b['class'] ) {
 729                         $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
 730                                 -1, PREG_SPLIT_NO_EMPTY );
 731                         $out['class'] = implode( ' ', array_unique( $classes ) );
 732                 }
 733                 return $out;
 734         }
 735
 736         /**
 737          * Pick apart some CSS and check it for forbidden or unsafe structures.
 738          * Returns a sanitized string, or false if it was just too evil.
 739          *
 740          * Currently URL references, 'expression', 'tps' are forbidden.
 741          *
 742          * @param $value String
 743          * @return Mixed
 744          */
 745         static function checkCss( $value ) {
 746                 $value = Sanitizer::decodeCharReferences( $value );
 747
 748                 // Remove any comments; IE gets token splitting wrong
 749                 $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value );
 750
 751                 // Decode escape sequences and line continuation
 752                 // See the grammar in the CSS 2 spec, appendix D.
 753                 static $decodeRegex;
 754                 if ( !$decodeRegex ) {
 755                         $space = '[\\x20\\t\\r\\n\\f]';
 756                         $nl = '(?:\\n|\\r\\n|\\r|\\f)';
 757                         $backslash = '\\\\';
 758                         $decodeRegex = "/ $backslash
 759                                 (?:
 760                                         ($nl) |  # 1. Line continuation
 761                                         ([0-9A-Fa-f]{1,6})$space? |  # 2. character number
 762                                         (.) | # 3. backslash cancelling special meaning
 763                                         () | # 4. backslash at end of string
 764                                 )/xu";
 765                 }
 766                 $value = preg_replace_callback( $decodeRegex,
 767                         array( __CLASS__, 'cssDecodeCallback' ), $value );
 768
 769                 // Reject problematic keywords and control characters
 770                 if ( preg_match( '/[\000-\010\016-\037\177]/', $value ) ) {
 771                         return '/* invalid control char */';
 772                 } elseif ( preg_match( '! expression | filter\s*: | accelerator\s*: | url\s*\( !ix', $value ) ) {
 773                         return '/* insecure input */';
 774                 }
 775                 return $value;
 776         }
 777
 778         static function cssDecodeCallback( $matches ) {
 779                 if ( $matches[1] !== '' ) {
 780                         // Line continuation
 781                         return '';
 782                 } elseif ( $matches[2] !== '' ) {
 783                         $char = codepointToUtf8( hexdec( $matches[2] ) );
 784                 } elseif ( $matches[3] !== '' ) {
 785                         $char = $matches[3];
 786                 } else {
 787                         $char = '\\';
 788                 }
 789                 if ( $char == "\n" || $char == '"' || $char == "'" || $char == '\\' ) {
 790                         // These characters need to be escaped in strings
 791                         // Clean up the escape sequence to avoid parsing errors by clients
 792                         return '\\' . dechex( ord( $char ) ) . ' ';
 793                 } else {
 794                         // Decode unnecessary escape
 795                         return $char;
 796                 }
 797         }
 798
 799         /**
 800         * Take an associative array of attribute name/value pairs
 801         * and generate a css style representing all the style-related
 802         * attributes. If there already a style attribute in the array,
 803         * it is also included in the value returned.
 804         */
 805         static function styleFromAttributes( $attributes ) {
 806                 $styles = array();
 807
 808                 foreach ( $attributes as $attribute => $value ) {
 809                         if ( $attribute == 'bgcolor' ) {
 810                                 $styles[] = "background-color: $value";
 811                         } else if ( $attribute == 'border' ) {
 812                                 $styles[] = "border-width: $value";
 813                         } else if ( $attribute == 'align' ) {
 814                                 $styles[] = "text-align: $value";
 815                         } else if ( $attribute == 'valign' ) {
 816                                 $styles[] = "vertical-align: $value";
 817                         } else if ( $attribute == 'width' ) {
 818                                 if ( preg_match( '/\d+/', $value ) === false ) {
 819                                       $value .= 'px';
 820                                 }
 821
 822                                 $styles[] = "width: $value";
 823                         } else if ( $attribute == 'height' ) {
 824                                 if ( preg_match( '/\d+/', $value ) === false ) {
 825                                       $value .= 'px';
 826                                 }
 827
 828                                 $styles[] = "height: $value";
 829                         } else if ( $attribute == 'nowrap' ) {
 830                                 if ( $value ) {
 831                                         $styles[] = "white-space: nowrap";
 832                                 }
 833                         }
 834                 }
 835
 836                 if ( isset( $attributes[ 'style' ] ) ) {
 837                         $styles[] = $attributes[ 'style' ];
 838                 }
 839
 840                 if ( !$styles ) return '';
 841                 else return implode( '; ', $styles );
 842         }
 843
 844         /**
 845          * Take a tag soup fragment listing an HTML element's attributes
 846          * and normalize it to well-formed XML, discarding unwanted attributes.
 847          * Output is safe for further wikitext processing, with escaping of
 848          * values that could trigger problems.
 849          *
 850          * - Normalizes attribute names to lowercase
 851          * - Discards attributes not on a whitelist for the given element
 852          * - Turns broken or invalid entities into plaintext
 853          * - Double-quotes all attribute values
 854          * - Attributes without values are given the name as attribute
 855          * - Double attributes are discarded
 856          * - Unsafe style attributes are discarded
 857          * - Prepends space if there are attributes.
 858          *
 859          * @param $text String
 860          * @param $element String
 861          * @param $defaults Array (optional) associative array of default attributes to splice in.
 862          *                      class and style attributes are combined. Otherwise, values from
 863          *                      $attributes take precedence over values from $defaults.
 864          * @return String
 865          */
 866         static function fixTagAttributes( $text, $element, $defaults = null ) {
 867                 if( trim( $text ) == '' ) {
 868                         return '';
 869                 }
 870
 871                 $decoded = Sanitizer::decodeTagAttributes( $text );
 872                 $stripped = Sanitizer::validateTagAttributes( $decoded, $element );
 873                 $attribs = Sanitizer::collapseTagAttributes( $stripped, $defaults );
 874
 875                 return $attribs;
 876         }
 877
 878         /**
 879          * Take an associative array or attribute name/value pairs
 880          * and collapses it to well-formed XML.
 881          * Does not filter attributes.
 882          * Output is safe for further wikitext processing, with escaping of
 883          * values that could trigger problems.
 884          *
 885          * - Double-quotes all attribute values
 886          * - Prepends space if there are attributes.
 887          *
 888          * @param $attributes Array is an associative array of attribute name/value pairs.
 889          *                      Assumed to be sanitized already.
 890          * @param $defaults Array (optional) associative array of default attributes to splice in.
 891          *                      class and style attributes are combined. Otherwise, values from
 892          *                      $attributes take precedence over values from $defaults.
 893          * @return String
 894          */
 895         static function collapseTagAttributes( $attributes, $defaults = null ) {
 896                 if ( $defaults ) {
 897                         foreach( $defaults as $attribute => $value ) {
 898                                 if ( isset( $attributes[ $attribute ] ) ) {
 899                                         if ( $attribute == 'class' ) {
 900                                                 $value .= ' '. $attributes[ $attribute ];
 901                                         } else if ( $attribute == 'style' ) {
 902                                                 $value .= '; ' . $attributes[ $attribute ];
 903                                         } else {
 904                                                 continue;
 905                                         }
 906                                 }
 907
 908                                 $attributes[ $attribute ] = $value;
 909                         }
 910                 }
 911
 912                 $chunks = array();
 913
 914                 foreach( $attributes as $attribute => $value ) {
 915                         $encAttribute = htmlspecialchars( $attribute );
 916                         $encValue = Sanitizer::safeEncodeAttribute( $value );
 917
 918                         $chunks[] = "$encAttribute=\"$encValue\"";
 919                 }
 920                 return count( $chunks ) ? ' ' . implode( ' ', $chunks ) : '';
 921         }
 922
 923         /**
 924          * Encode an attribute value for HTML output.
 925          * @param $text String
 926          * @return HTML-encoded text fragment
 927          */
 928         static function encodeAttribute( $text ) {
 929                 $encValue = htmlspecialchars( $text, ENT_QUOTES );
 930
 931                 // Whitespace is normalized during attribute decoding,
 932                 // so if we've been passed non-spaces we must encode them
 933                 // ahead of time or they won't be preserved.
 934                 $encValue = strtr( $encValue, array(
 935                         "\n" => '&#10;',
 936                         "\r" => '&#13;',
 937                         "\t" => '&#9;',
 938                 ) );
 939
 940                 return $encValue;
 941         }
 942
 943         /**
 944          * Encode an attribute value for HTML tags, with extra armoring
 945          * against further wiki processing.
 946          * @param $text String
 947          * @return HTML-encoded text fragment
 948          */
 949         static function safeEncodeAttribute( $text ) {
 950                 $encValue = Sanitizer::encodeAttribute( $text );
 951
 952                 # Templates and links may be expanded in later parsing,
 953                 # creating invalid or dangerous output. Suppress this.
 954                 $encValue = strtr( $encValue, array(
 955                         '<'    => '&lt;',   // This should never happen,
 956                         '>'    => '&gt;',   // we've received invalid input
 957                         '"'    => '&quot;', // which should have been escaped.
 958                         '{'    => '&#123;',
 959                         '['    => '&#91;',
 960                         "''"   => '&#39;&#39;',
 961                         'ISBN' => '&#73;SBN',
 962                         'RFC'  => '&#82;FC',
 963                         'PMID' => '&#80;MID',
 964                         '|'    => '&#124;',
 965                         '__'   => '&#95;_',
 966                 ) );
 967
 968                 # Stupid hack
 969                 $encValue = preg_replace_callback(
 970                         '/(' . wfUrlProtocols() . ')/',
 971                         array( 'Sanitizer', 'armorLinksCallback' ),
 972                         $encValue );
 973                 return $encValue;
 974         }
 975
 976         /**
 977          * Given a value, escape it so that it can be used in an id attribute and
 978          * return it.  This will use HTML5 validation if $wgExperimentalHtmlIds is
 979          * true, allowing anything but ASCII whitespace.  Otherwise it will use
 980          * HTML 4 rules, which means a narrow subset of ASCII, with bad characters
 981          * escaped with lots of dots.
 982          *
 983          * To ensure we don't have to bother escaping anything, we also strip ', ",
 984          * & even if $wgExperimentalIds is true.  TODO: Is this the best tactic?
 985          * We also strip # because it upsets IE, and % because it could be
 986          * ambiguous if it's part of something that looks like a percent escape
 987          * (which don't work reliably in fragments cross-browser).
 988          *
 989          * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters
 990          *                                                          in the id and
 991          *                                                          name attributes
 992          * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
 993          * @see http://www.whatwg.org/specs/web-apps/current-work/multipage/elements.html#the-id-attribute
 994          *   HTML5 definition of id attribute
 995          *
 996          * @param $id String: id to escape
 997          * @param $options Mixed: string or array of strings (default is array()):
 998          *   'noninitial': This is a non-initial fragment of an id, not a full id,
 999          *       so don't pay attention if the first character isn't valid at the
1000          *       beginning of an id.  Only matters if $wgExperimentalHtmlIds is
1001          *       false.
1002          *   'legacy': Behave the way the old HTML 4-based ID escaping worked even
1003          *       if $wgExperimentalHtmlIds is used, so we can generate extra
1004          *       anchors and links won't break.
1005          * @return String
1006          */
1007         static function escapeId( $id, $options = array() ) {
1008                 global $wgHtml5, $wgExperimentalHtmlIds;
1009                 $options = (array)$options;
1010
1011                 if ( $wgHtml5 && $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) {
1012                         $id = Sanitizer::decodeCharReferences( $id );
1013                         $id = preg_replace( '/[ \t\n\r\f_\'"&#%]+/', '_', $id );
1014                         $id = trim( $id, '_' );
1015                         if ( $id === '' ) {
1016                                 # Must have been all whitespace to start with.
1017                                 return '_';
1018                         } else {
1019                                 return $id;
1020                         }
1021                 }
1022
1023                 # HTML4-style escaping
1024                 static $replace = array(
1025                         '%3A' => ':',
1026                         '%' => '.'
1027                 );
1028
1029                 $id = urlencode( Sanitizer::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
1030                 $id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
1031
1032                 if ( !preg_match( '/^[a-zA-Z]/', $id )
1033                 && !in_array( 'noninitial', $options ) )  {
1034                         // Initial character must be a letter!
1035                         $id = "x$id";
1036                 }
1037                 return $id;
1038         }
1039
1040         /**
1041          * Given a value, escape it so that it can be used as a CSS class and
1042          * return it.
1043          *
1044          * @todo For extra validity, input should be validated UTF-8.
1045          *
1046          * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
1047          *
1048          * @param $class String
1049          * @return String
1050          */
1051         static function escapeClass( $class ) {
1052                 // Convert ugly stuff to underscores and kill underscores in ugly places
1053                 return rtrim(preg_replace(
1054                         array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
1055                         '_',
1056                         $class ), '_');
1057         }
1058
1059         /**
1060          * Given HTML input, escape with htmlspecialchars but un-escape entites.
1061          * This allows (generally harmless) entities like &#160; to survive.
1062          *
1063          * @param $html String to escape
1064          * @return String: escaped input
1065          */
1066         static function escapeHtmlAllowEntities( $html ) {
1067                 $html = Sanitizer::decodeCharReferences( $html );
1068                 # It seems wise to escape ' as well as ", as a matter of course.  Can't
1069                 # hurt.
1070                 $html = htmlspecialchars( $html, ENT_QUOTES );
1071                 return $html;
1072         }
1073
1074         /**
1075          * Regex replace callback for armoring links against further processing.
1076          * @param $matches Array
1077          * @return string
1078          */
1079         private static function armorLinksCallback( $matches ) {
1080                 return str_replace( ':', '&#58;', $matches[1] );
1081         }
1082
1083         /**
1084          * Return an associative array of attribute names and values from
1085          * a partial tag string. Attribute names are forces to lowercase,
1086          * character references are decoded to UTF-8 text.
1087          *
1088          * @param $text String
1089          * @return Array
1090          */
1091         public static function decodeTagAttributes( $text ) {
1092                 if( trim( $text ) == '' ) {
1093                         return array();
1094                 }
1095
1096                 $attribs = array();
1097                 $pairs = array();
1098                 if( !preg_match_all(
1099                         MW_ATTRIBS_REGEX,
1100                         $text,
1101                         $pairs,
1102                         PREG_SET_ORDER ) ) {
1103                         return $attribs;
1104                 }
1105
1106                 foreach( $pairs as $set ) {
1107                         $attribute = strtolower( $set[1] );
1108                         $value = Sanitizer::getTagAttributeCallback( $set );
1109
1110                         // Normalize whitespace
1111                         $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1112                         $value = trim( $value );
1113
1114                         // Decode character references
1115                         $attribs[$attribute] = Sanitizer::decodeCharReferences( $value );
1116                 }
1117                 return $attribs;
1118         }
1119
1120         /**
1121          * Pick the appropriate attribute value from a match set from the
1122          * MW_ATTRIBS_REGEX matches.
1123          *
1124          * @param $set Array
1125          * @return String
1126          */
1127         private static function getTagAttributeCallback( $set ) {
1128                 if( isset( $set[6] ) ) {
1129                         # Illegal #XXXXXX color with no quotes.
1130                         return $set[6];
1131                 } elseif( isset( $set[5] ) ) {
1132                         # No quotes.
1133                         return $set[5];
1134                 } elseif( isset( $set[4] ) ) {
1135                         # Single-quoted
1136                         return $set[4];
1137                 } elseif( isset( $set[3] ) ) {
1138                         # Double-quoted
1139                         return $set[3];
1140                 } elseif( !isset( $set[2] ) ) {
1141                         # In XHTML, attributes must have a value.
1142                         # For 'reduced' form, return explicitly the attribute name here.
1143                         return $set[1];
1144                 } else {
1145                         throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1146                 }
1147         }
1148
1149         /**
1150          * Normalize whitespace and character references in an XML source-
1151          * encoded text for an attribute value.
1152          *
1153          * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
1154          * but note that we're not returning the value, but are returning
1155          * XML source fragments that will be slapped into output.
1156          *
1157          * @param $text String
1158          * @return String
1159          */
1160         private static function normalizeAttributeValue( $text ) {
1161                 return str_replace( '"', '&quot;',
1162                         self::normalizeWhitespace(
1163                                 Sanitizer::normalizeCharReferences( $text ) ) );
1164         }
1165
1166         private static function normalizeWhitespace( $text ) {
1167                 return preg_replace(
1168                         '/\r\n|[\x20\x0d\x0a\x09]/',
1169                         ' ',
1170                         $text );
1171         }
1172
1173         /**
1174          * Normalizes whitespace in a section name, such as might be returned
1175          * by Parser::stripSectionName(), for use in the id's that are used for
1176          * section links.
1177          *
1178          * @param $section String
1179          * @return String
1180          */
1181         static function normalizeSectionNameWhitespace( $section ) {
1182                 return trim( preg_replace( '/[ _]+/', ' ', $section ) );
1183         }
1184
1185         /**
1186          * Ensure that any entities and character references are legal
1187          * for XML and XHTML specifically. Any stray bits will be
1188          * &amp;-escaped to result in a valid text fragment.
1189          *
1190          * a. any named char refs must be known in XHTML
1191          * b. any numeric char refs must be legal chars, not invalid or forbidden
1192          * c. use &#x, not &#X
1193          * d. fix or reject non-valid attributes
1194          *
1195          * @param $text String
1196          * @return String
1197          * @private
1198          */
1199         static function normalizeCharReferences( $text ) {
1200                 return preg_replace_callback(
1201                         MW_CHAR_REFS_REGEX,
1202                         array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
1203                         $text );
1204         }
1205         /**
1206          * @param $matches String
1207          * @return String
1208          */
1209         static function normalizeCharReferencesCallback( $matches ) {
1210                 $ret = null;
1211                 if( $matches[1] != '' ) {
1212                         $ret = Sanitizer::normalizeEntity( $matches[1] );
1213                 } elseif( $matches[2] != '' ) {
1214                         $ret = Sanitizer::decCharReference( $matches[2] );
1215                 } elseif( $matches[3] != ''  ) {
1216                         $ret = Sanitizer::hexCharReference( $matches[3] );
1217                 } elseif( $matches[4] != '' ) {
1218                         $ret = Sanitizer::hexCharReference( $matches[4] );
1219                 }
1220                 if( is_null( $ret ) ) {
1221                         return htmlspecialchars( $matches[0] );
1222                 } else {
1223                         return $ret;
1224                 }
1225         }
1226
1227         /**
1228          * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1229          * return the named entity reference as is. If the entity is a
1230          * MediaWiki-specific alias, returns the HTML equivalent. Otherwise,
1231          * returns HTML-escaped text of pseudo-entity source (eg &amp;foo;)
1232          *
1233          * @param $name String
1234          * @return String
1235          */
1236         static function normalizeEntity( $name ) {
1237                 global $wgHtmlEntities, $wgHtmlEntityAliases;
1238                 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1239                         return "&{$wgHtmlEntityAliases[$name]};";
1240                 } elseif( isset( $wgHtmlEntities[$name] ) ) {
1241                         return "&$name;";
1242                 } else {
1243                         return "&amp;$name;";
1244                 }
1245         }
1246
1247         static function decCharReference( $codepoint ) {
1248                 $point = intval( $codepoint );
1249                 if( Sanitizer::validateCodepoint( $point ) ) {
1250                         return sprintf( '&#%d;', $point );
1251                 } else {
1252                         return null;
1253                 }
1254         }
1255
1256         static function hexCharReference( $codepoint ) {
1257                 $point = hexdec( $codepoint );
1258                 if( Sanitizer::validateCodepoint( $point ) ) {
1259                         return sprintf( '&#x%x;', $point );
1260                 } else {
1261                         return null;
1262                 }
1263         }
1264
1265         /**
1266          * Returns true if a given Unicode codepoint is a valid character in XML.
1267          * @param $codepoint Integer
1268          * @return Boolean
1269          */
1270         private static function validateCodepoint( $codepoint ) {
1271                 return ($codepoint ==    0x09)
1272                         || ($codepoint ==    0x0a)
1273                         || ($codepoint ==    0x0d)
1274                         || ($codepoint >=    0x20 && $codepoint <=   0xd7ff)
1275                         || ($codepoint >=  0xe000 && $codepoint <=   0xfffd)
1276                         || ($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
1277         }
1278
1279         /**
1280          * Decode any character references, numeric or named entities,
1281          * in the text and return a UTF-8 string.
1282          *
1283          * @param $text String
1284          * @return String
1285          */
1286         public static function decodeCharReferences( $text ) {
1287                 return preg_replace_callback(
1288                         MW_CHAR_REFS_REGEX,
1289                         array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1290                         $text );
1291         }
1292
1293         /**
1294          * Decode any character references, numeric or named entities,
1295          * in the next and normalize the resulting string. (bug 14952)
1296          *
1297          * This is useful for page titles, not for text to be displayed,
1298          * MediaWiki allows HTML entities to escape normalization as a feature.
1299          *
1300          * @param $text String (already normalized, containing entities)
1301          * @return String (still normalized, without entities)
1302          */
1303         public static function decodeCharReferencesAndNormalize( $text ) {
1304                 global $wgContLang;
1305                 $text = preg_replace_callback(
1306                         MW_CHAR_REFS_REGEX,
1307                         array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1308                         $text, /* limit */ -1, $count );
1309
1310                 if ( $count ) {
1311                         return $wgContLang->normalize( $text );
1312                 } else {
1313                         return $text;
1314                 }
1315         }
1316
1317         /**
1318          * @param $matches String
1319          * @return String
1320          */
1321         static function decodeCharReferencesCallback( $matches ) {
1322                 if( $matches[1] != '' ) {
1323                         return Sanitizer::decodeEntity( $matches[1] );
1324                 } elseif( $matches[2] != '' ) {
1325                         return  Sanitizer::decodeChar( intval( $matches[2] ) );
1326                 } elseif( $matches[3] != ''  ) {
1327                         return  Sanitizer::decodeChar( hexdec( $matches[3] ) );
1328                 } elseif( $matches[4] != '' ) {
1329                         return  Sanitizer::decodeChar( hexdec( $matches[4] ) );
1330                 }
1331                 # Last case should be an ampersand by itself
1332                 return $matches[0];
1333         }
1334
1335         /**
1336          * Return UTF-8 string for a codepoint if that is a valid
1337          * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
1338          * @param $codepoint Integer
1339          * @return String
1340          * @private
1341          */
1342         static function decodeChar( $codepoint ) {
1343                 if( Sanitizer::validateCodepoint( $codepoint ) ) {
1344                         return codepointToUtf8( $codepoint );
1345                 } else {
1346                         return UTF8_REPLACEMENT;
1347                 }
1348         }
1349
1350         /**
1351          * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1352          * return the UTF-8 encoding of that character. Otherwise, returns
1353          * pseudo-entity source (eg &foo;)
1354          *
1355          * @param $name Strings
1356          * @return String
1357          */
1358         static function decodeEntity( $name ) {
1359                 global $wgHtmlEntities, $wgHtmlEntityAliases;
1360                 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1361                         $name = $wgHtmlEntityAliases[$name];
1362                 }
1363                 if( isset( $wgHtmlEntities[$name] ) ) {
1364                         return codepointToUtf8( $wgHtmlEntities[$name] );
1365                 } else {
1366                         return "&$name;";
1367                 }
1368         }
1369
1370         /**
1371          * Fetch the whitelist of acceptable attributes for a given element name.
1372          *
1373          * @param $element String
1374          * @return Array
1375          */
1376         static function attributeWhitelist( $element ) {
1377                 static $list;
1378                 if( !isset( $list ) ) {
1379                         $list = Sanitizer::setupAttributeWhitelist();
1380                 }
1381                 return isset( $list[$element] )
1382                         ? $list[$element]
1383                         : array();
1384         }
1385
1386         /**
1387          * Foreach array key (an allowed HTML element), return an array
1388          * of allowed attributes
1389          * @return Array
1390          */
1391         static function setupAttributeWhitelist() {
1392                 global $wgAllowRdfaAttributes, $wgHtml5, $wgAllowMicrodataAttributes;
1393
1394                 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );
1395
1396                 if ( $wgAllowRdfaAttributes ) {
1397                         #RDFa attributes as specified in section 9 of http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1398                         $common = array_merge( $common, array(
1399                             'about', 'property', 'resource', 'datatype', 'typeof',
1400                         ) );
1401                 }
1402
1403                 if ( $wgHtml5 && $wgAllowMicrodataAttributes ) {
1404                         # add HTML5 microdata tages as pecified by http://www.whatwg.org/specs/web-apps/current-work/multipage/microdata.html#the-microdata-model
1405                         $common = array_merge( $common, array(
1406                             'itemid', 'itemprop', 'itemref', 'itemscope', 'itemtype'
1407                         ) );
1408                 }
1409
1410                 $block = array_merge( $common, array( 'align' ) );
1411                 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1412                 $tablecell = array( 'abbr',
1413                                     'axis',
1414                                     'headers',
1415                                     'scope',
1416                                     'rowspan',
1417                                     'colspan',
1418                                     'nowrap', # deprecated
1419                                     'width',  # deprecated
1420                                     'height', # deprecated
1421                                     'bgcolor' # deprecated
1422                                     );
1423
1424                 # Numbers refer to sections in HTML 4.01 standard describing the element.
1425                 # See: http://www.w3.org/TR/html4/
1426                 $whitelist = array (
1427                         # 7.5.4
1428                         'div'        => $block,
1429                         'center'     => $common, # deprecated
1430                         'span'       => $block, # ??
1431
1432                         # 7.5.5
1433                         'h1'         => $block,
1434                         'h2'         => $block,
1435                         'h3'         => $block,
1436                         'h4'         => $block,
1437                         'h5'         => $block,
1438                         'h6'         => $block,
1439
1440                         # 7.5.6
1441                         # address
1442
1443                         # 8.2.4
1444                         # bdo
1445
1446                         # 9.2.1
1447                         'em'         => $common,
1448                         'strong'     => $common,
1449                         'cite'       => $common,
1450                         'dfn'        => $common,
1451                         'code'       => $common,
1452                         'samp'       => $common,
1453                         'kbd'        => $common,
1454                         'var'        => $common,
1455                         'abbr'       => $common,
1456                         # acronym
1457
1458                         # 9.2.2
1459                         'blockquote' => array_merge( $common, array( 'cite' ) ),
1460                         # q
1461
1462                         # 9.2.3
1463                         'sub'        => $common,
1464                         'sup'        => $common,
1465
1466                         # 9.3.1
1467                         'p'          => $block,
1468
1469                         # 9.3.2
1470                         'br'         => array( 'id', 'class', 'title', 'style', 'clear' ),
1471
1472                         # 9.3.4
1473                         'pre'        => array_merge( $common, array( 'width' ) ),
1474
1475                         # 9.4
1476                         'ins'        => array_merge( $common, array( 'cite', 'datetime' ) ),
1477                         'del'        => array_merge( $common, array( 'cite', 'datetime' ) ),
1478
1479                         # 10.2
1480                         'ul'         => array_merge( $common, array( 'type' ) ),
1481                         'ol'         => array_merge( $common, array( 'type', 'start' ) ),
1482                         'li'         => array_merge( $common, array( 'type', 'value' ) ),
1483
1484                         # 10.3
1485                         'dl'         => $common,
1486                         'dd'         => $common,
1487                         'dt'         => $common,
1488
1489                         # 11.2.1
1490                         'table'      => array_merge( $common,
1491                                                                 array( 'summary', 'width', 'border', 'frame',
1492                                                                                 'rules', 'cellspacing', 'cellpadding',
1493                                                                                 'align', 'bgcolor',
1494                                                                 ) ),
1495
1496                         # 11.2.2
1497                         'caption'    => array_merge( $common, array( 'align' ) ),
1498
1499                         # 11.2.3
1500                         'thead'      => array_merge( $common, $tablealign ),
1501                         'tfoot'      => array_merge( $common, $tablealign ),
1502                         'tbody'      => array_merge( $common, $tablealign ),
1503
1504                         # 11.2.4
1505                         'colgroup'   => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1506                         'col'        => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1507
1508                         # 11.2.5
1509                         'tr'         => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1510
1511                         # 11.2.6
1512                         'td'         => array_merge( $common, $tablecell, $tablealign ),
1513                         'th'         => array_merge( $common, $tablecell, $tablealign ),
1514
1515                         # 12.2 # NOTE: <a> is not allowed directly, but the attrib whitelist is used from the Parser object
1516                         'a'          => array_merge( $common, array( 'href', 'rel', 'rev' ) ), # rel/rev esp. for RDFa
1517
1518                         # 13.2
1519                         # Not usually allowed, but may be used for extension-style hooks
1520                         # such as <math> when it is rasterized, or if $wgAllowImageTag is
1521                         # true
1522                         'img'        => array_merge( $common, array( 'alt', 'src', 'width', 'height' ) ),
1523
1524                         # 15.2.1
1525                         'tt'         => $common,
1526                         'b'          => $common,
1527                         'i'          => $common,
1528                         'big'        => $common,
1529                         'small'      => $common,
1530                         'strike'     => $common,
1531                         's'          => $common,
1532                         'u'          => $common,
1533
1534                         # 15.2.2
1535                         'font'       => array_merge( $common, array( 'size', 'color', 'face' ) ),
1536                         # basefont
1537
1538                         # 15.3
1539                         'hr'         => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1540
1541                         # XHTML Ruby annotation text module, simple ruby only.
1542                         # http://www.w3c.org/TR/ruby/
1543                         'ruby'       => $common,
1544                         # rbc
1545                         # rtc
1546                         'rb'         => $common,
1547                         'rt'         => $common, #array_merge( $common, array( 'rbspan' ) ),
1548                         'rp'         => $common,
1549
1550                         # MathML root element, where used for extensions
1551                         # 'title' may not be 100% valid here; it's XHTML
1552                         # http://www.w3.org/TR/REC-MathML/
1553                         'math'       => array( 'class', 'style', 'id', 'title' ),
1554                         );
1555                 return $whitelist;
1556         }
1557
1558         /**
1559          * Take a fragment of (potentially invalid) HTML and return
1560          * a version with any tags removed, encoded as plain text.
1561          *
1562          * Warning: this return value must be further escaped for literal
1563          * inclusion in HTML output as of 1.10!
1564          *
1565          * @param $text String: HTML fragment
1566          * @return String
1567          */
1568         static function stripAllTags( $text ) {
1569                 # Actual <tags>
1570                 $text = StringUtils::delimiterReplace( '<', '>', '', $text );
1571
1572                 # Normalize &entities and whitespace
1573                 $text = self::decodeCharReferences( $text );
1574                 $text = self::normalizeWhitespace( $text );
1575
1576                 return $text;
1577         }
1578
1579         /**
1580          * Hack up a private DOCTYPE with HTML's standard entity declarations.
1581          * PHP 4 seemed to know these if you gave it an HTML doctype, but
1582          * PHP 5.1 doesn't.
1583          *
1584          * Use for passing XHTML fragments to PHP's XML parsing functions
1585          *
1586          * @return String
1587          */
1588         static function hackDocType() {
1589                 global $wgHtmlEntities;
1590                 $out = "<!DOCTYPE html [\n";
1591                 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1592                         $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1593                 }
1594                 $out .= "]>\n";
1595                 return $out;
1596         }
1597
1598         static function cleanUrl( $url ) {
1599                 # Normalize any HTML entities in input. They will be
1600                 # re-escaped by makeExternalLink().
1601                 $url = Sanitizer::decodeCharReferences( $url );
1602
1603                 # Escape any control characters introduced by the above step
1604                 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F\|]/e', "urlencode('\\0')", $url );
1605
1606                 # Validate hostname portion
1607                 $matches = array();
1608                 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1609                         list( /* $whole */, $protocol, $host, $rest ) = $matches;
1610
1611                         // Characters that will be ignored in IDNs.
1612                         // http://tools.ietf.org/html/3454#section-3.1
1613                         // Strip them before further processing so blacklists and such work.
1614                         $strip = "/
1615                                 \\s|          # general whitespace
1616                                 \xc2\xad|     # 00ad SOFT HYPHEN
1617                                 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1618                                 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1619                                 \xe2\x81\xa0| # 2060 WORD JOINER
1620                                 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1621                                 \xcd\x8f|     # 034f COMBINING GRAPHEME JOINER
1622                                 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1623                                 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1624                                 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1625                                 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1626                                 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1627                                 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1628                                 /xuD";
1629
1630                         $host = preg_replace( $strip, '', $host );
1631
1632                         // @todo Fixme: validate hostnames here
1633
1634                         return $protocol . $host . $rest;
1635                 } else {
1636                         return $url;
1637                 }
1638         }
1639
1640 }