3 * XHTML sanitizer for MediaWiki
5 * Copyright (C) 2002-2005 Brion Vibber <brion@pobox.com> et al
6 * http://www.mediawiki.org/
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
21 * http://www.gnu.org/copyleft/gpl.html
28 * Regular expression to match various types of character references in
29 * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
31 define( 'MW_CHAR_REFS_REGEX',
32 '/&([A-Za-z0-9\x80-\xff]+);
39 * Regular expression to match HTML/XML attribute pairs within a tag.
40 * Allows some... latitude.
41 * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
43 $attrib = '[A-Za-z0-9]';
44 $space = '[\x09\x0a\x0d\x20]';
45 define( 'MW_ATTRIBS_REGEX',
46 "/(?:^|$space)((?:xml:|xmlns:)?$attrib+)
49 # The attribute value: quoted or alone
52 | ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
53 | (\#[0-9a-fA-F]+) # Technically wrong, but lots of
54 # colors are specified like this.
55 # We'll be normalizing it.
57 )?(?=$space|\$)/sx" );
60 * Regular expression to match URIs that could trigger script execution
62 define( 'MW_EVIL_URI_PATTERN', '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i' );
65 * Regular expression to match namespace attributes
67 define( 'MW_XMLNS_ATTRIBUTE_PATTRN', "/^xmlns:$attrib+$/" );
70 * List of all named character entities defined in HTML 4.01
71 * http://www.w3.org/TR/html4/sgml/entities.html
74 global $wgHtmlEntities;
75 $wgHtmlEntities = array(
330 * Character entity aliases accepted by MediaWiki
332 global $wgHtmlEntityAliases;
333 $wgHtmlEntityAliases = array(
340 * XHTML sanitizer for MediaWiki
345 * Cleans up HTML, removes dangerous tags and attributes, and
346 * removes HTML comments
348 * @param $text String
349 * @param $processCallback Callback to do any variable or parameter replacements in HTML attribute values
350 * @param $args Array for the processing callback
351 * @param $extratags Array for any extra tags to include
352 * @param $removetags Array for any tags (default or extra) to exclude
355 static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array(), $removetags = array() ) {
358 static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
359 $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
361 wfProfileIn( __METHOD__
);
363 if ( !$staticInitialised ) {
365 $htmlpairsStatic = array( # Tags that must be closed
366 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
367 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
368 'strike', 'strong', 'tt', 'var', 'div', 'center',
369 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
370 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u', 'abbr'
373 'br', 'hr', 'li', 'dt', 'dd'
375 $htmlsingleonly = array( # Elements that cannot have close tags
378 $htmlnest = array( # Tags that can be nested--??
379 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
380 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
382 $tabletags = array( # Can only appear inside table, we will close them
385 $htmllist = array( # Tags used by list
388 $listtags = array( # Tags that can appear in a list
392 global $wgAllowImageTag;
393 if ( $wgAllowImageTag ) {
394 $htmlsingle[] = 'img';
395 $htmlsingleonly[] = 'img';
398 $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
399 $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
401 # Convert them all to hashtables for faster lookup
402 $vars = array( 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
403 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' );
404 foreach ( $vars as $var ) {
405 $
$var = array_flip( $
$var );
407 $staticInitialised = true;
409 # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
410 $extratags = array_flip( $extratags );
411 $removetags = array_flip( $removetags );
412 $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
413 $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ) , $removetags );
415 # Remove HTML comments
416 $text = Sanitizer
::removeHTMLcomments( $text );
417 $bits = explode( '<', $text );
418 $text = str_replace( '>', '>', array_shift( $bits ) );
420 $tagstack = $tablestack = array();
421 foreach ( $bits as $x ) {
423 # $slash: Does the current element start with a '/'?
424 # $t: Current element name
425 # $params: String between element name and >
426 # $brace: Ending '>' or '/>'
427 # $rest: Everything until the next element of $bits
428 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
429 list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
431 $slash = $t = $params = $brace = $rest = null;
435 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
437 if ( $slash && isset( $htmlsingleonly[$t] ) ) {
439 } elseif ( $slash ) {
440 # Closing a tag... is it the one we just opened?
441 $ot = @array_pop
( $tagstack );
443 if ( isset( $htmlsingleallowed[$ot] ) ) {
444 # Pop all elements with an optional close tag
445 # and see if we find a match below them
447 array_push( $optstack, $ot );
448 $ot = @array_pop
( $tagstack );
449 while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
450 array_push( $optstack, $ot );
451 $ot = @array_pop
( $tagstack );
454 # No match. Push the optional elements back again
456 while ( $ot = @array_pop
( $optstack ) ) {
457 array_push( $tagstack, $ot );
461 @array_push
( $tagstack, $ot );
462 # <li> can be nested in <ul> or <ol>, skip those cases:
463 if ( !isset( $htmllist[$ot] ) ||
!isset( $listtags[$t] ) ) {
468 if ( $t == 'table' ) {
469 $tagstack = array_pop( $tablestack );
474 # Keep track for later
475 if ( isset( $tabletags[$t] ) &&
476 !in_array( 'table', $tagstack ) ) {
478 } elseif ( in_array( $t, $tagstack ) &&
479 !isset( $htmlnest [$t ] ) ) {
481 #Â Is it a self closed htmlpair ? (bug 5487)
482 } elseif ( $brace == '/>' &&
483 isset( $htmlpairs[$t] ) ) {
485 } elseif ( isset( $htmlsingleonly[$t] ) ) {
486 # Hack to force empty tag for uncloseable elements
488 } elseif ( isset( $htmlsingle[$t] ) ) {
489 # Hack to not close $htmlsingle tags
491 } elseif ( isset( $tabletags[$t] )
492 && in_array( $t, $tagstack ) ) {
493 // New table tag but forgot to close the previous one
496 if ( $t == 'table' ) {
497 array_push( $tablestack, $tagstack );
500 array_push( $tagstack, $t );
503 # Replace any variables or template parameters with
505 if( is_callable( $processCallback ) ) {
506 call_user_func_array( $processCallback, array( &$params, $args ) );
509 # Strip non-approved attributes from the tag
510 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
513 $rest = str_replace( '>', '>', $rest );
514 $close = ( $brace == '/>' && !$slash ) ?
' /' : '';
515 $text .= "<$slash$t$newparams$close>$rest";
519 $text .= '<' . str_replace( '>', '>', $x);
521 # Close off any remaining tags
522 while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
524 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
527 # this might be possible using tidy itself
528 foreach ( $bits as $x ) {
529 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
531 @list
( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
532 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
533 if( is_callable( $processCallback ) ) {
534 call_user_func_array( $processCallback, array( &$params, $args ) );
536 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
537 $rest = str_replace( '>', '>', $rest );
538 $text .= "<$slash$t$newparams$brace$rest";
540 $text .= '<' . str_replace( '>', '>', $x);
544 wfProfileOut( __METHOD__
);
549 * Remove '<!--', '-->', and everything between.
550 * To avoid leaving blank lines, when a comment is both preceded
551 * and followed by a newline (ignoring spaces), trim leading and
552 * trailing spaces and one of the newlines.
555 * @param $text String
558 static function removeHTMLcomments( $text ) {
559 wfProfileIn( __METHOD__
);
560 while (($start = strpos($text, '<!--')) !== false) {
561 $end = strpos($text, '-->', $start +
4);
562 if ($end === false) {
563 # Unterminated comment; bail out
569 # Trim space and newline if the comment is both
570 # preceded and followed by a newline
571 $spaceStart = max($start - 1, 0);
572 $spaceLen = $end - $spaceStart;
573 while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
577 while (substr($text, $spaceStart +
$spaceLen, 1) === ' ')
579 if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart +
$spaceLen, 1) === "\n") {
580 # Remove the comment, leading and trailing
581 # spaces, and leave only one newline.
582 $text = substr_replace($text, "\n", $spaceStart, $spaceLen +
1);
585 # Remove just the comment.
586 $text = substr_replace($text, '', $start, $end - $start);
589 wfProfileOut( __METHOD__
);
594 * Take an array of attribute names and values and normalize or discard
595 * illegal values for the given element type.
597 * - Discards attributes not on a whitelist for the given element
598 * - Unsafe style attributes are discarded
599 * - Invalid id attributes are reencoded
601 * @param $attribs Array
602 * @param $element String
605 * @todo Check for legal values where the DTD limits things.
606 * @todo Check for unique id attribute :P
608 static function validateTagAttributes( $attribs, $element ) {
609 return Sanitizer
::validateAttributes( $attribs,
610 Sanitizer
::attributeWhitelist( $element ) );
614 * Take an array of attribute names and values and normalize or discard
615 * illegal values for the given whitelist.
617 * - Discards attributes not the given whitelist
618 * - Unsafe style attributes are discarded
619 * - Invalid id attributes are reencoded
621 * @param $attribs Array
622 * @param $whitelist Array: list of allowed attribute names
625 * @todo Check for legal values where the DTD limits things.
626 * @todo Check for unique id attribute :P
628 static function validateAttributes( $attribs, $whitelist ) {
629 global $wgAllowRdfaAttributes, $wgAllowMicrodataAttributes;
631 $whitelist = array_flip( $whitelist );
632 $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
635 foreach( $attribs as $attribute => $value ) {
636 #allow XML namespace declaration if RDFa is enabled
637 if ( $wgAllowRdfaAttributes && preg_match( MW_XMLNS_ATTRIBUTE_PATTRN
, $attribute ) ) {
638 if ( !preg_match( MW_EVIL_URI_PATTERN
, $value ) ) {
639 $out[$attribute] = $value;
645 if( !isset( $whitelist[$attribute] ) ) {
649 # Strip javascript "expression" from stylesheets.
650 # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
651 if( $attribute == 'style' ) {
652 $value = Sanitizer
::checkCss( $value );
655 if ( $attribute === 'id' ) {
656 $value = Sanitizer
::escapeId( $value, 'noninitial' );
659 //RDFa and microdata properties allow URLs, URIs and/or CURIs. check them for sanity
660 if ( $attribute === 'rel' ||
$attribute === 'rev' ||
661 $attribute === 'about' ||
$attribute === 'property' ||
$attribute === 'resource' ||
#RDFa
662 $attribute === 'datatype' ||
$attribute === 'typeof' ||
#RDFa
663 $attribute === 'itemid' ||
$attribute === 'itemprop' ||
$attribute === 'itemref' ||
#HTML5 microdata
664 $attribute === 'itemscope' ||
$attribute === 'itemtype' ) { #HTML5 microdata
666 //Paranoia. Allow "simple" values but suppress javascript
667 if ( preg_match( MW_EVIL_URI_PATTERN
, $value ) ) {
672 # NOTE: even though elements using href/src are not allowed directly, supply
673 # validation code that can be used by tag hook handlers, etc
674 if ( $attribute === 'href' ||
$attribute === 'src' ) {
675 if ( !preg_match( $hrefExp, $value ) ) {
676 continue; //drop any href or src attributes not using an allowed protocol.
677 //NOTE: this also drops all relative URLs
681 // If this attribute was previously set, override it.
682 // Output should only have one attribute of each name.
683 $out[$attribute] = $value;
686 if ( $wgAllowMicrodataAttributes ) {
687 # There are some complicated validity constraints we need to
688 # enforce here. First of all, we don't want to allow non-standard
690 $allowedTypes = array(
691 'http://microformats.org/profile/hcard',
692 'http://microformats.org/profile/hcalendar#vevent',
693 'http://n.whatwg.org/work',
695 if ( isset( $out['itemtype'] ) && !in_array( $out['itemtype'],
698 unset( $out['itemscope'] );
700 # itemtype, itemid, itemref don't make sense without itemscope
701 if ( !array_key_exists( 'itemscope', $out ) ) {
702 unset( $out['itemtype'] );
703 unset( $out['itemid'] );
704 unset( $out['itemref'] );
706 # TODO: Strip itemprop if we aren't descendants of an itemscope.
712 * Merge two sets of HTML attributes. Conflicting items in the second set
713 * will override those in the first, except for 'class' attributes which
714 * will be combined (if they're both strings).
716 * @todo implement merging for other attributes such as style
721 static function mergeAttributes( $a, $b ) {
722 $out = array_merge( $a, $b );
723 if( isset( $a['class'] ) && isset( $b['class'] )
724 && is_string( $a['class'] ) && is_string( $b['class'] )
725 && $a['class'] !== $b['class'] ) {
726 $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
727 -1, PREG_SPLIT_NO_EMPTY
);
728 $out['class'] = implode( ' ', array_unique( $classes ) );
734 * Pick apart some CSS and check it for forbidden or unsafe structures.
735 * Returns a sanitized string, or false if it was just too evil.
737 * Currently URL references, 'expression', 'tps' are forbidden.
739 * @param $value String
742 static function checkCss( $value ) {
743 $value = Sanitizer
::decodeCharReferences( $value );
745 // Remove any comments; IE gets token splitting wrong
746 $value = StringUtils
::delimiterReplace( '/*', '*/', ' ', $value );
748 // Decode escape sequences and line continuation
749 // See the grammar in the CSS 2 spec, appendix D.
750 static $decodeRegex, $reencodeTable;
751 if ( !$decodeRegex ) {
752 $space = '[\\x20\\t\\r\\n\\f]';
753 $nl = '(?:\\n|\\r\\n|\\r|\\f)';
755 $decodeRegex = "/ $backslash
757 ($nl) | # 1. Line continuation
758 ([0-9A-Fa-f]{1,6})$space? | # 2. character number
759 (.) | # 3. backslash cancelling special meaning
760 () | # 4. backslash at end of string
763 $value = preg_replace_callback( $decodeRegex,
764 array( __CLASS__
, 'cssDecodeCallback' ), $value );
766 // Reject problematic keywords and control characters
767 if ( preg_match( '/[\000-\010\016-\037\177]/', $value ) ) {
768 return '/* invalid control char */';
769 } elseif ( preg_match( '! expression | filter\s*: | accelerator\s*: | url\s*\( !ix', $value ) ) {
770 return '/* insecure input */';
775 static function cssDecodeCallback( $matches ) {
776 if ( $matches[1] !== '' ) {
779 } elseif ( $matches[2] !== '' ) {
780 $char = codepointToUtf8( hexdec( $matches[2] ) );
781 } elseif ( $matches[3] !== '' ) {
786 if ( $char == "\n" ||
$char == '"' ||
$char == "'" ||
$char == '\\' ) {
787 // These characters need to be escaped in strings
788 // Clean up the escape sequence to avoid parsing errors by clients
789 return '\\' . dechex( ord( $char ) ) . ' ';
791 // Decode unnecessary escape
797 * Take a tag soup fragment listing an HTML element's attributes
798 * and normalize it to well-formed XML, discarding unwanted attributes.
799 * Output is safe for further wikitext processing, with escaping of
800 * values that could trigger problems.
802 * - Normalizes attribute names to lowercase
803 * - Discards attributes not on a whitelist for the given element
804 * - Turns broken or invalid entities into plaintext
805 * - Double-quotes all attribute values
806 * - Attributes without values are given the name as attribute
807 * - Double attributes are discarded
808 * - Unsafe style attributes are discarded
809 * - Prepends space if there are attributes.
811 * @param $text String
812 * @param $element String
815 static function fixTagAttributes( $text, $element ) {
816 if( trim( $text ) == '' ) {
820 $stripped = Sanitizer
::validateTagAttributes(
821 Sanitizer
::decodeTagAttributes( $text ), $element );
824 foreach( $stripped as $attribute => $value ) {
825 $encAttribute = htmlspecialchars( $attribute );
826 $encValue = Sanitizer
::safeEncodeAttribute( $value );
828 $attribs[] = "$encAttribute=\"$encValue\"";
830 return count( $attribs ) ?
' ' . implode( ' ', $attribs ) : '';
834 * Encode an attribute value for HTML output.
835 * @param $text String
836 * @return HTML-encoded text fragment
838 static function encodeAttribute( $text ) {
839 $encValue = htmlspecialchars( $text, ENT_QUOTES
);
841 // Whitespace is normalized during attribute decoding,
842 // so if we've been passed non-spaces we must encode them
843 // ahead of time or they won't be preserved.
844 $encValue = strtr( $encValue, array(
854 * Encode an attribute value for HTML tags, with extra armoring
855 * against further wiki processing.
856 * @param $text String
857 * @return HTML-encoded text fragment
859 static function safeEncodeAttribute( $text ) {
860 $encValue = Sanitizer
::encodeAttribute( $text );
862 # Templates and links may be expanded in later parsing,
863 # creating invalid or dangerous output. Suppress this.
864 $encValue = strtr( $encValue, array(
865 '<' => '<', // This should never happen,
866 '>' => '>', // we've received invalid input
867 '"' => '"', // which should have been escaped.
870 "''" => '''',
871 'ISBN' => 'ISBN',
873 'PMID' => 'PMID',
879 $encValue = preg_replace_callback(
880 '/(' . wfUrlProtocols() . ')/',
881 array( 'Sanitizer', 'armorLinksCallback' ),
887 * Given a value, escape it so that it can be used in an id attribute and
888 * return it. This will use HTML5 validation if $wgExperimentalHtmlIds is
889 * true, allowing anything but ASCII whitespace. Otherwise it will use
890 * HTML 4 rules, which means a narrow subset of ASCII, with bad characters
891 * escaped with lots of dots.
893 * To ensure we don't have to bother escaping anything, we also strip ', ",
894 * & even if $wgExperimentalIds is true. TODO: Is this the best tactic?
895 * We also strip # because it upsets IE6.
897 * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters
900 * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
901 * @see http://www.whatwg.org/specs/web-apps/current-work/multipage/elements.html#the-id-attribute
902 * HTML5 definition of id attribute
904 * @param $id String: id to escape
905 * @param $options Mixed: string or array of strings (default is array()):
906 * 'noninitial': This is a non-initial fragment of an id, not a full id,
907 * so don't pay attention if the first character isn't valid at the
908 * beginning of an id. Only matters if $wgExperimentalHtmlIds is
910 * 'legacy': Behave the way the old HTML 4-based ID escaping worked even
911 * if $wgExperimentalHtmlIds is used, so we can generate extra
912 * anchors and links won't break.
915 static function escapeId( $id, $options = array() ) {
916 global $wgHtml5, $wgExperimentalHtmlIds;
917 $options = (array)$options;
919 if ( $wgHtml5 && $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) {
920 $id = Sanitizer
::decodeCharReferences( $id );
921 $id = preg_replace( '/[ \t\n\r\f_\'"&#]+/', '_', $id );
922 $id = trim( $id, '_' );
924 # Must have been all whitespace to start with.
931 # HTML4-style escaping
932 static $replace = array(
937 $id = urlencode( Sanitizer
::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
938 $id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
940 if ( !preg_match( '/^[a-zA-Z]/', $id )
941 && !in_array( 'noninitial', $options ) ) {
942 // Initial character must be a letter!
949 * Given a value, escape it so that it can be used as a CSS class and
952 * @todo For extra validity, input should be validated UTF-8.
954 * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
956 * @param $class String
959 static function escapeClass( $class ) {
960 // Convert ugly stuff to underscores and kill underscores in ugly places
961 return rtrim(preg_replace(
962 array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
968 * Given HTML input, escape with htmlspecialchars but un-escape entites.
969 * This allows (generally harmless) entities like   to survive.
971 * @param $html String to escape
972 * @return String: escaped input
974 static function escapeHtmlAllowEntities( $html ) {
975 # It seems wise to escape ' as well as ", as a matter of course. Can't
977 $html = htmlspecialchars( $html, ENT_QUOTES
);
978 $html = str_replace( '&', '&', $html );
979 $html = Sanitizer
::normalizeCharReferences( $html );
984 * Regex replace callback for armoring links against further processing.
985 * @param $matches Array
988 private static function armorLinksCallback( $matches ) {
989 return str_replace( ':', ':', $matches[1] );
993 * Return an associative array of attribute names and values from
994 * a partial tag string. Attribute names are forces to lowercase,
995 * character references are decoded to UTF-8 text.
997 * @param $text String
1000 public static function decodeTagAttributes( $text ) {
1001 if( trim( $text ) == '' ) {
1007 if( !preg_match_all(
1011 PREG_SET_ORDER
) ) {
1015 foreach( $pairs as $set ) {
1016 $attribute = strtolower( $set[1] );
1017 $value = Sanitizer
::getTagAttributeCallback( $set );
1019 // Normalize whitespace
1020 $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1021 $value = trim( $value );
1023 // Decode character references
1024 $attribs[$attribute] = Sanitizer
::decodeCharReferences( $value );
1030 * Pick the appropriate attribute value from a match set from the
1031 * MW_ATTRIBS_REGEX matches.
1036 private static function getTagAttributeCallback( $set ) {
1037 if( isset( $set[6] ) ) {
1038 # Illegal #XXXXXX color with no quotes.
1040 } elseif( isset( $set[5] ) ) {
1043 } elseif( isset( $set[4] ) ) {
1046 } elseif( isset( $set[3] ) ) {
1049 } elseif( !isset( $set[2] ) ) {
1050 # In XHTML, attributes must have a value.
1051 # For 'reduced' form, return explicitly the attribute name here.
1054 throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1059 * Normalize whitespace and character references in an XML source-
1060 * encoded text for an attribute value.
1062 * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
1063 * but note that we're not returning the value, but are returning
1064 * XML source fragments that will be slapped into output.
1066 * @param $text String
1069 private static function normalizeAttributeValue( $text ) {
1070 return str_replace( '"', '"',
1071 self
::normalizeWhitespace(
1072 Sanitizer
::normalizeCharReferences( $text ) ) );
1075 private static function normalizeWhitespace( $text ) {
1076 return preg_replace(
1077 '/\r\n|[\x20\x0d\x0a\x09]/',
1083 * Ensure that any entities and character references are legal
1084 * for XML and XHTML specifically. Any stray bits will be
1085 * &-escaped to result in a valid text fragment.
1087 * a. any named char refs must be known in XHTML
1088 * b. any numeric char refs must be legal chars, not invalid or forbidden
1089 * c. use &#x, not &#X
1090 * d. fix or reject non-valid attributes
1092 * @param $text String
1096 static function normalizeCharReferences( $text ) {
1097 return preg_replace_callback(
1099 array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
1103 * @param $matches String
1106 static function normalizeCharReferencesCallback( $matches ) {
1108 if( $matches[1] != '' ) {
1109 $ret = Sanitizer
::normalizeEntity( $matches[1] );
1110 } elseif( $matches[2] != '' ) {
1111 $ret = Sanitizer
::decCharReference( $matches[2] );
1112 } elseif( $matches[3] != '' ) {
1113 $ret = Sanitizer
::hexCharReference( $matches[3] );
1114 } elseif( $matches[4] != '' ) {
1115 $ret = Sanitizer
::hexCharReference( $matches[4] );
1117 if( is_null( $ret ) ) {
1118 return htmlspecialchars( $matches[0] );
1125 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1126 * return the named entity reference as is. If the entity is a
1127 * MediaWiki-specific alias, returns the HTML equivalent. Otherwise,
1128 * returns HTML-escaped text of pseudo-entity source (eg &foo;)
1130 * @param $name String
1133 static function normalizeEntity( $name ) {
1134 global $wgHtmlEntities, $wgHtmlEntityAliases;
1135 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1136 return "&{$wgHtmlEntityAliases[$name]};";
1137 } elseif( isset( $wgHtmlEntities[$name] ) ) {
1140 return "&$name;";
1144 static function decCharReference( $codepoint ) {
1145 $point = intval( $codepoint );
1146 if( Sanitizer
::validateCodepoint( $point ) ) {
1147 return sprintf( '&#%d;', $point );
1153 static function hexCharReference( $codepoint ) {
1154 $point = hexdec( $codepoint );
1155 if( Sanitizer
::validateCodepoint( $point ) ) {
1156 return sprintf( '&#x%x;', $point );
1163 * Returns true if a given Unicode codepoint is a valid character in XML.
1164 * @param $codepoint Integer
1167 private static function validateCodepoint( $codepoint ) {
1168 return ($codepoint == 0x09)
1169 ||
($codepoint == 0x0a)
1170 ||
($codepoint == 0x0d)
1171 ||
($codepoint >= 0x20 && $codepoint <= 0xd7ff)
1172 ||
($codepoint >= 0xe000 && $codepoint <= 0xfffd)
1173 ||
($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
1177 * Decode any character references, numeric or named entities,
1178 * in the text and return a UTF-8 string.
1180 * @param $text String
1183 public static function decodeCharReferences( $text ) {
1184 return preg_replace_callback(
1186 array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1191 * Decode any character references, numeric or named entities,
1192 * in the next and normalize the resulting string. (bug 14952)
1194 * This is useful for page titles, not for text to be displayed,
1195 * MediaWiki allows HTML entities to escape normalization as a feature.
1197 * @param $text String (already normalized, containing entities)
1198 * @return String (still normalized, without entities)
1200 public static function decodeCharReferencesAndNormalize( $text ) {
1202 $text = preg_replace_callback(
1204 array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1205 $text, /* limit */ -1, $count );
1208 return $wgContLang->normalize( $text );
1215 * @param $matches String
1218 static function decodeCharReferencesCallback( $matches ) {
1219 if( $matches[1] != '' ) {
1220 return Sanitizer
::decodeEntity( $matches[1] );
1221 } elseif( $matches[2] != '' ) {
1222 return Sanitizer
::decodeChar( intval( $matches[2] ) );
1223 } elseif( $matches[3] != '' ) {
1224 return Sanitizer
::decodeChar( hexdec( $matches[3] ) );
1225 } elseif( $matches[4] != '' ) {
1226 return Sanitizer
::decodeChar( hexdec( $matches[4] ) );
1228 # Last case should be an ampersand by itself
1233 * Return UTF-8 string for a codepoint if that is a valid
1234 * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
1235 * @param $codepoint Integer
1239 static function decodeChar( $codepoint ) {
1240 if( Sanitizer
::validateCodepoint( $codepoint ) ) {
1241 return codepointToUtf8( $codepoint );
1243 return UTF8_REPLACEMENT
;
1248 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1249 * return the UTF-8 encoding of that character. Otherwise, returns
1250 * pseudo-entity source (eg &foo;)
1252 * @param $name Strings
1255 static function decodeEntity( $name ) {
1256 global $wgHtmlEntities, $wgHtmlEntityAliases;
1257 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1258 $name = $wgHtmlEntityAliases[$name];
1260 if( isset( $wgHtmlEntities[$name] ) ) {
1261 return codepointToUtf8( $wgHtmlEntities[$name] );
1268 * Fetch the whitelist of acceptable attributes for a given element name.
1270 * @param $element String
1273 static function attributeWhitelist( $element ) {
1275 if( !isset( $list ) ) {
1276 $list = Sanitizer
::setupAttributeWhitelist();
1278 return isset( $list[$element] )
1284 * Foreach array key (an allowed HTML element), return an array
1285 * of allowed attributes
1288 static function setupAttributeWhitelist() {
1289 global $wgAllowRdfaAttributes, $wgHtml5, $wgAllowMicrodataAttributes;
1291 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );
1293 if ( $wgAllowRdfaAttributes ) {
1294 #RDFa attributes as specified in section 9 of http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1295 $common = array_merge( $common, array(
1296 'about', 'property', 'resource', 'datatype', 'typeof',
1300 if ( $wgHtml5 && $wgAllowMicrodataAttributes ) {
1301 # add HTML5 microdata tages as pecified by http://www.whatwg.org/specs/web-apps/current-work/multipage/microdata.html#the-microdata-model
1302 $common = array_merge( $common, array(
1303 'itemid', 'itemprop', 'itemref', 'itemscope', 'itemtype'
1307 $block = array_merge( $common, array( 'align' ) );
1308 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1309 $tablecell = array( 'abbr',
1315 'nowrap', # deprecated
1316 'width', # deprecated
1317 'height', # deprecated
1318 'bgcolor' # deprecated
1321 # Numbers refer to sections in HTML 4.01 standard describing the element.
1322 # See: http://www.w3.org/TR/html4/
1323 $whitelist = array (
1326 'center' => $common, # deprecated
1327 'span' => $block, # ??
1345 'strong' => $common,
1356 'blockquote' => array_merge( $common, array( 'cite' ) ),
1367 'br' => array( 'id', 'class', 'title', 'style', 'clear' ),
1370 'pre' => array_merge( $common, array( 'width' ) ),
1373 'ins' => array_merge( $common, array( 'cite', 'datetime' ) ),
1374 'del' => array_merge( $common, array( 'cite', 'datetime' ) ),
1377 'ul' => array_merge( $common, array( 'type' ) ),
1378 'ol' => array_merge( $common, array( 'type', 'start' ) ),
1379 'li' => array_merge( $common, array( 'type', 'value' ) ),
1387 'table' => array_merge( $common,
1388 array( 'summary', 'width', 'border', 'frame',
1389 'rules', 'cellspacing', 'cellpadding',
1394 'caption' => array_merge( $common, array( 'align' ) ),
1397 'thead' => array_merge( $common, $tablealign ),
1398 'tfoot' => array_merge( $common, $tablealign ),
1399 'tbody' => array_merge( $common, $tablealign ),
1402 'colgroup' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1403 'col' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1406 'tr' => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1409 'td' => array_merge( $common, $tablecell, $tablealign ),
1410 'th' => array_merge( $common, $tablecell, $tablealign ),
1412 # 12.2 # NOTE: <a> is not allowed directly, but the attrib whitelist is used from the Parser object
1413 'a' => array_merge( $common, array( 'href', 'rel', 'rev' ) ), # rel/rev esp. for RDFa
1416 # Not usually allowed, but may be used for extension-style hooks
1417 # such as <math> when it is rasterized, or if $wgAllowImageTag is
1419 'img' => array_merge( $common, array( 'alt', 'src', 'width', 'height' ) ),
1427 'strike' => $common,
1432 'font' => array_merge( $common, array( 'size', 'color', 'face' ) ),
1436 'hr' => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1438 # XHTML Ruby annotation text module, simple ruby only.
1439 # http://www.w3c.org/TR/ruby/
1444 'rt' => $common, #array_merge( $common, array( 'rbspan' ) ),
1447 # MathML root element, where used for extensions
1448 # 'title' may not be 100% valid here; it's XHTML
1449 # http://www.w3.org/TR/REC-MathML/
1450 'math' => array( 'class', 'style', 'id', 'title' ),
1456 * Take a fragment of (potentially invalid) HTML and return
1457 * a version with any tags removed, encoded as plain text.
1459 * Warning: this return value must be further escaped for literal
1460 * inclusion in HTML output as of 1.10!
1462 * @param $text String: HTML fragment
1465 static function stripAllTags( $text ) {
1467 $text = StringUtils
::delimiterReplace( '<', '>', '', $text );
1469 # Normalize &entities and whitespace
1470 $text = self
::decodeCharReferences( $text );
1471 $text = self
::normalizeWhitespace( $text );
1477 * Hack up a private DOCTYPE with HTML's standard entity declarations.
1478 * PHP 4 seemed to know these if you gave it an HTML doctype, but
1481 * Use for passing XHTML fragments to PHP's XML parsing functions
1485 static function hackDocType() {
1486 global $wgHtmlEntities;
1487 $out = "<!DOCTYPE html [\n";
1488 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1489 $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1495 static function cleanUrl( $url ) {
1496 # Normalize any HTML entities in input. They will be
1497 # re-escaped by makeExternalLink().
1498 $url = Sanitizer
::decodeCharReferences( $url );
1500 # Escape any control characters introduced by the above step
1501 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F\|]/e', "urlencode('\\0')", $url );
1503 # Validate hostname portion
1505 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1506 list( /* $whole */, $protocol, $host, $rest ) = $matches;
1508 // Characters that will be ignored in IDNs.
1509 // http://tools.ietf.org/html/3454#section-3.1
1510 // Strip them before further processing so blacklists and such work.
1512 \\s| # general whitespace
1513 \xc2\xad| # 00ad SOFT HYPHEN
1514 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1515 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1516 \xe2\x81\xa0| # 2060 WORD JOINER
1517 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1518 \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
1519 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1520 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1521 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1522 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1523 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1524 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1527 $host = preg_replace( $strip, '', $host );
1529 // @todo Fixme: validate hostnames here
1531 return $protocol . $host . $rest;