3 * XHTML sanitizer for MediaWiki
5 * Copyright © 2002-2005 Brion Vibber <brion@pobox.com> et al
6 * http://www.mediawiki.org/
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
21 * http://www.gnu.org/copyleft/gpl.html
28 * Regular expression to match various types of character references in
29 * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
31 define( 'MW_CHAR_REFS_REGEX',
32 '/&([A-Za-z0-9\x80-\xff]+);
34 |&\#[xX]([0-9A-Fa-f]+);
38 * Regular expression to match HTML/XML attribute pairs within a tag.
39 * Allows some... latitude.
40 * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
42 $attribFirst = '[:A-Z_a-z0-9]';
43 $attrib = '[:A-Z_a-z-.0-9]';
44 $space = '[\x09\x0a\x0d\x20]';
45 define( 'MW_ATTRIBS_REGEX',
46 "/(?:^|$space)({$attribFirst}{$attrib}*)
49 # The attribute value: quoted or alone
52 | ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
53 | (\#[0-9a-fA-F]+) # Technically wrong, but lots of
54 # colors are specified like this.
55 # We'll be normalizing it.
57 )?(?=$space|\$)/sx" );
60 * Regular expression to match URIs that could trigger script execution
62 define( 'MW_EVIL_URI_PATTERN', '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i' );
65 * Regular expression to match namespace attributes
67 define( 'MW_XMLNS_ATTRIBUTE_PATTRN', "/^xmlns:$attrib+$/" );
70 * List of all named character entities defined in HTML 4.01
71 * http://www.w3.org/TR/html4/sgml/entities.html
74 global $wgHtmlEntities;
75 $wgHtmlEntities = array(
330 * Character entity aliases accepted by MediaWiki
332 global $wgHtmlEntityAliases;
333 $wgHtmlEntityAliases = array(
340 * XHTML sanitizer for MediaWiki
345 * Cleans up HTML, removes dangerous tags and attributes, and
346 * removes HTML comments
348 * @param $text String
349 * @param $processCallback Callback to do any variable or parameter replacements in HTML attribute values
350 * @param $args Array for the processing callback
351 * @param $extratags Array for any extra tags to include
352 * @param $removetags Array for any tags (default or extra) to exclude
355 static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array(), $removetags = array() ) {
358 static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
359 $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
361 wfProfileIn( __METHOD__
);
363 if ( !$staticInitialised ) {
365 $htmlpairsStatic = array( # Tags that must be closed
366 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
367 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
368 'strike', 'strong', 'tt', 'var', 'div', 'center',
369 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
370 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'abbr', 'dfn',
374 'br', 'hr', 'li', 'dt', 'dd'
376 $htmlsingleonly = array( # Elements that cannot have close tags
379 $htmlnest = array( # Tags that can be nested--??
380 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
381 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
383 $tabletags = array( # Can only appear inside table, we will close them
386 $htmllist = array( # Tags used by list
389 $listtags = array( # Tags that can appear in a list
393 global $wgAllowImageTag;
394 if ( $wgAllowImageTag ) {
395 $htmlsingle[] = 'img';
396 $htmlsingleonly[] = 'img';
399 $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
400 $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
402 # Convert them all to hashtables for faster lookup
403 $vars = array( 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
404 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' );
405 foreach ( $vars as $var ) {
406 $
$var = array_flip( $
$var );
408 $staticInitialised = true;
410 # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
411 $extratags = array_flip( $extratags );
412 $removetags = array_flip( $removetags );
413 $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
414 $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ) , $removetags );
416 # Remove HTML comments
417 $text = Sanitizer
::removeHTMLcomments( $text );
418 $bits = explode( '<', $text );
419 $text = str_replace( '>', '>', array_shift( $bits ) );
421 $tagstack = $tablestack = array();
422 foreach ( $bits as $x ) {
424 # $slash: Does the current element start with a '/'?
425 # $t: Current element name
426 # $params: String between element name and >
427 # $brace: Ending '>' or '/>'
428 # $rest: Everything until the next element of $bits
429 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
430 list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
432 $slash = $t = $params = $brace = $rest = null;
436 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
438 if ( $slash && isset( $htmlsingleonly[$t] ) ) {
440 } elseif ( $slash ) {
441 # Closing a tag... is it the one we just opened?
442 $ot = @array_pop
( $tagstack );
444 if ( isset( $htmlsingleallowed[$ot] ) ) {
445 # Pop all elements with an optional close tag
446 # and see if we find a match below them
448 array_push( $optstack, $ot );
449 $ot = @array_pop
( $tagstack );
450 while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
451 array_push( $optstack, $ot );
452 $ot = @array_pop
( $tagstack );
455 # No match. Push the optional elements back again
457 while ( $ot = @array_pop
( $optstack ) ) {
458 array_push( $tagstack, $ot );
462 @array_push
( $tagstack, $ot );
463 # <li> can be nested in <ul> or <ol>, skip those cases:
464 if ( !isset( $htmllist[$ot] ) ||
!isset( $listtags[$t] ) ) {
469 if ( $t == 'table' ) {
470 $tagstack = array_pop( $tablestack );
475 # Keep track for later
476 if ( isset( $tabletags[$t] ) &&
477 !in_array( 'table', $tagstack ) ) {
479 } elseif ( in_array( $t, $tagstack ) &&
480 !isset( $htmlnest [$t ] ) ) {
482 # Is it a self closed htmlpair ? (bug 5487)
483 } elseif ( $brace == '/>' &&
484 isset( $htmlpairs[$t] ) ) {
486 } elseif ( isset( $htmlsingleonly[$t] ) ) {
487 # Hack to force empty tag for uncloseable elements
489 } elseif ( isset( $htmlsingle[$t] ) ) {
490 # Hack to not close $htmlsingle tags
492 } elseif ( isset( $tabletags[$t] )
493 && in_array( $t, $tagstack ) ) {
494 // New table tag but forgot to close the previous one
497 if ( $t == 'table' ) {
498 array_push( $tablestack, $tagstack );
501 array_push( $tagstack, $t );
504 # Replace any variables or template parameters with
506 if( is_callable( $processCallback ) ) {
507 call_user_func_array( $processCallback, array( &$params, $args ) );
510 # Strip non-approved attributes from the tag
511 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
514 $rest = str_replace( '>', '>', $rest );
515 $close = ( $brace == '/>' && !$slash ) ?
' /' : '';
516 $text .= "<$slash$t$newparams$close>$rest";
520 $text .= '<' . str_replace( '>', '>', $x);
522 # Close off any remaining tags
523 while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
525 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
528 # this might be possible using tidy itself
529 foreach ( $bits as $x ) {
530 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
532 @list
( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
533 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
534 if( is_callable( $processCallback ) ) {
535 call_user_func_array( $processCallback, array( &$params, $args ) );
537 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
538 $rest = str_replace( '>', '>', $rest );
539 $text .= "<$slash$t$newparams$brace$rest";
541 $text .= '<' . str_replace( '>', '>', $x);
545 wfProfileOut( __METHOD__
);
550 * Remove '<!--', '-->', and everything between.
551 * To avoid leaving blank lines, when a comment is both preceded
552 * and followed by a newline (ignoring spaces), trim leading and
553 * trailing spaces and one of the newlines.
556 * @param $text String
559 static function removeHTMLcomments( $text ) {
560 wfProfileIn( __METHOD__
);
561 while (($start = strpos($text, '<!--')) !== false) {
562 $end = strpos($text, '-->', $start +
4);
563 if ($end === false) {
564 # Unterminated comment; bail out
570 # Trim space and newline if the comment is both
571 # preceded and followed by a newline
572 $spaceStart = max($start - 1, 0);
573 $spaceLen = $end - $spaceStart;
574 while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
578 while (substr($text, $spaceStart +
$spaceLen, 1) === ' ')
580 if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart +
$spaceLen, 1) === "\n") {
581 # Remove the comment, leading and trailing
582 # spaces, and leave only one newline.
583 $text = substr_replace($text, "\n", $spaceStart, $spaceLen +
1);
586 # Remove just the comment.
587 $text = substr_replace($text, '', $start, $end - $start);
590 wfProfileOut( __METHOD__
);
595 * Take an array of attribute names and values and normalize or discard
596 * illegal values for the given element type.
598 * - Discards attributes not on a whitelist for the given element
599 * - Unsafe style attributes are discarded
600 * - Invalid id attributes are reencoded
602 * @param $attribs Array
603 * @param $element String
606 * @todo Check for legal values where the DTD limits things.
607 * @todo Check for unique id attribute :P
609 static function validateTagAttributes( $attribs, $element ) {
610 return Sanitizer
::validateAttributes( $attribs,
611 Sanitizer
::attributeWhitelist( $element ) );
615 * Take an array of attribute names and values and normalize or discard
616 * illegal values for the given whitelist.
618 * - Discards attributes not the given whitelist
619 * - Unsafe style attributes are discarded
620 * - Invalid id attributes are reencoded
622 * @param $attribs Array
623 * @param $whitelist Array: list of allowed attribute names
626 * @todo Check for legal values where the DTD limits things.
627 * @todo Check for unique id attribute :P
629 static function validateAttributes( $attribs, $whitelist ) {
630 global $wgAllowRdfaAttributes, $wgAllowMicrodataAttributes, $wgHtml5;
632 $whitelist = array_flip( $whitelist );
633 $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
636 foreach( $attribs as $attribute => $value ) {
637 #allow XML namespace declaration if RDFa is enabled
638 if ( $wgAllowRdfaAttributes && preg_match( MW_XMLNS_ATTRIBUTE_PATTRN
, $attribute ) ) {
639 if ( !preg_match( MW_EVIL_URI_PATTERN
, $value ) ) {
640 $out[$attribute] = $value;
646 # Allow any attribute beginning with "data-", if in HTML5 mode
647 if ( !($wgHtml5 && preg_match( '/^data-/i', $attribute )) && !isset( $whitelist[$attribute] ) ) {
651 # Strip javascript "expression" from stylesheets.
652 # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
653 if( $attribute == 'style' ) {
654 $value = Sanitizer
::checkCss( $value );
657 if ( $attribute === 'id' ) {
658 $value = Sanitizer
::escapeId( $value, 'noninitial' );
661 //RDFa and microdata properties allow URLs, URIs and/or CURIs. check them for sanity
662 if ( $attribute === 'rel' ||
$attribute === 'rev' ||
663 $attribute === 'about' ||
$attribute === 'property' ||
$attribute === 'resource' ||
#RDFa
664 $attribute === 'datatype' ||
$attribute === 'typeof' ||
#RDFa
665 $attribute === 'itemid' ||
$attribute === 'itemprop' ||
$attribute === 'itemref' ||
#HTML5 microdata
666 $attribute === 'itemscope' ||
$attribute === 'itemtype' ) { #HTML5 microdata
668 //Paranoia. Allow "simple" values but suppress javascript
669 if ( preg_match( MW_EVIL_URI_PATTERN
, $value ) ) {
674 # NOTE: even though elements using href/src are not allowed directly, supply
675 # validation code that can be used by tag hook handlers, etc
676 if ( $attribute === 'href' ||
$attribute === 'src' ) {
677 if ( !preg_match( $hrefExp, $value ) ) {
678 continue; //drop any href or src attributes not using an allowed protocol.
679 //NOTE: this also drops all relative URLs
683 // If this attribute was previously set, override it.
684 // Output should only have one attribute of each name.
685 $out[$attribute] = $value;
688 if ( $wgAllowMicrodataAttributes ) {
689 # There are some complicated validity constraints we need to
690 # enforce here. First of all, we don't want to allow non-standard
692 $allowedTypes = array(
693 'http://microformats.org/profile/hcard',
694 'http://microformats.org/profile/hcalendar#vevent',
695 'http://n.whatwg.org/work',
697 if ( isset( $out['itemtype'] ) && !in_array( $out['itemtype'],
700 unset( $out['itemscope'] );
702 # itemtype, itemid, itemref don't make sense without itemscope
703 if ( !array_key_exists( 'itemscope', $out ) ) {
704 unset( $out['itemtype'] );
705 unset( $out['itemid'] );
706 unset( $out['itemref'] );
708 # TODO: Strip itemprop if we aren't descendants of an itemscope.
714 * Merge two sets of HTML attributes. Conflicting items in the second set
715 * will override those in the first, except for 'class' attributes which
716 * will be combined (if they're both strings).
718 * @todo implement merging for other attributes such as style
723 static function mergeAttributes( $a, $b ) {
724 $out = array_merge( $a, $b );
725 if( isset( $a['class'] ) && isset( $b['class'] )
726 && is_string( $a['class'] ) && is_string( $b['class'] )
727 && $a['class'] !== $b['class'] ) {
728 $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
729 -1, PREG_SPLIT_NO_EMPTY
);
730 $out['class'] = implode( ' ', array_unique( $classes ) );
736 * Pick apart some CSS and check it for forbidden or unsafe structures.
737 * Returns a sanitized string, or false if it was just too evil.
739 * Currently URL references, 'expression', 'tps' are forbidden.
741 * @param $value String
744 static function checkCss( $value ) {
745 $value = Sanitizer
::decodeCharReferences( $value );
747 // Remove any comments; IE gets token splitting wrong
748 $value = StringUtils
::delimiterReplace( '/*', '*/', ' ', $value );
750 // Remove anything after a comment-start token, to guard against
751 // incorrect client implementations.
752 $commentPos = strpos( $value, '/*' );
753 if ( $commentPos !== false ) {
754 $value = substr( $value, 0, $commentPos );
757 // Decode escape sequences and line continuation
758 // See the grammar in the CSS 2 spec, appendix D.
760 if ( !$decodeRegex ) {
761 $space = '[\\x20\\t\\r\\n\\f]';
762 $nl = '(?:\\n|\\r\\n|\\r|\\f)';
764 $decodeRegex = "/ $backslash
766 ($nl) | # 1. Line continuation
767 ([0-9A-Fa-f]{1,6})$space? | # 2. character number
768 (.) | # 3. backslash cancelling special meaning
769 () | # 4. backslash at end of string
772 $value = preg_replace_callback( $decodeRegex,
773 array( __CLASS__
, 'cssDecodeCallback' ), $value );
775 // Reject problematic keywords and control characters
776 if ( preg_match( '/[\000-\010\016-\037\177]/', $value ) ) {
777 return '/* invalid control char */';
778 } elseif ( preg_match( '! expression | filter\s*: | accelerator\s*: | url\s*\( !ix', $value ) ) {
779 return '/* insecure input */';
784 static function cssDecodeCallback( $matches ) {
785 if ( $matches[1] !== '' ) {
788 } elseif ( $matches[2] !== '' ) {
789 $char = codepointToUtf8( hexdec( $matches[2] ) );
790 } elseif ( $matches[3] !== '' ) {
795 if ( $char == "\n" ||
$char == '"' ||
$char == "'" ||
$char == '\\' ) {
796 // These characters need to be escaped in strings
797 // Clean up the escape sequence to avoid parsing errors by clients
798 return '\\' . dechex( ord( $char ) ) . ' ';
800 // Decode unnecessary escape
806 * Take a tag soup fragment listing an HTML element's attributes
807 * and normalize it to well-formed XML, discarding unwanted attributes.
808 * Output is safe for further wikitext processing, with escaping of
809 * values that could trigger problems.
811 * - Normalizes attribute names to lowercase
812 * - Discards attributes not on a whitelist for the given element
813 * - Turns broken or invalid entities into plaintext
814 * - Double-quotes all attribute values
815 * - Attributes without values are given the name as attribute
816 * - Double attributes are discarded
817 * - Unsafe style attributes are discarded
818 * - Prepends space if there are attributes.
820 * @param $text String
821 * @param $element String
824 static function fixTagAttributes( $text, $element ) {
825 if( trim( $text ) == '' ) {
829 $stripped = Sanitizer
::validateTagAttributes(
830 Sanitizer
::decodeTagAttributes( $text ), $element );
833 foreach( $stripped as $attribute => $value ) {
834 $encAttribute = htmlspecialchars( $attribute );
835 $encValue = Sanitizer
::safeEncodeAttribute( $value );
837 $attribs[] = "$encAttribute=\"$encValue\"";
839 return count( $attribs ) ?
' ' . implode( ' ', $attribs ) : '';
843 * Encode an attribute value for HTML output.
844 * @param $text String
845 * @return HTML-encoded text fragment
847 static function encodeAttribute( $text ) {
848 $encValue = htmlspecialchars( $text, ENT_QUOTES
);
850 // Whitespace is normalized during attribute decoding,
851 // so if we've been passed non-spaces we must encode them
852 // ahead of time or they won't be preserved.
853 $encValue = strtr( $encValue, array(
863 * Encode an attribute value for HTML tags, with extra armoring
864 * against further wiki processing.
865 * @param $text String
866 * @return HTML-encoded text fragment
868 static function safeEncodeAttribute( $text ) {
869 $encValue = Sanitizer
::encodeAttribute( $text );
871 # Templates and links may be expanded in later parsing,
872 # creating invalid or dangerous output. Suppress this.
873 $encValue = strtr( $encValue, array(
874 '<' => '<', // This should never happen,
875 '>' => '>', // we've received invalid input
876 '"' => '"', // which should have been escaped.
879 "''" => '''',
880 'ISBN' => 'ISBN',
882 'PMID' => 'PMID',
888 $encValue = preg_replace_callback(
889 '/(' . wfUrlProtocols() . ')/',
890 array( 'Sanitizer', 'armorLinksCallback' ),
896 * Given a value, escape it so that it can be used in an id attribute and
897 * return it. This will use HTML5 validation if $wgExperimentalHtmlIds is
898 * true, allowing anything but ASCII whitespace. Otherwise it will use
899 * HTML 4 rules, which means a narrow subset of ASCII, with bad characters
900 * escaped with lots of dots.
902 * To ensure we don't have to bother escaping anything, we also strip ', ",
903 * & even if $wgExperimentalIds is true. TODO: Is this the best tactic?
904 * We also strip # because it upsets IE, and % because it could be
905 * ambiguous if it's part of something that looks like a percent escape
906 * (which don't work reliably in fragments cross-browser).
908 * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters
911 * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
912 * @see http://www.whatwg.org/specs/web-apps/current-work/multipage/elements.html#the-id-attribute
913 * HTML5 definition of id attribute
915 * @param $id String: id to escape
916 * @param $options Mixed: string or array of strings (default is array()):
917 * 'noninitial': This is a non-initial fragment of an id, not a full id,
918 * so don't pay attention if the first character isn't valid at the
919 * beginning of an id. Only matters if $wgExperimentalHtmlIds is
921 * 'legacy': Behave the way the old HTML 4-based ID escaping worked even
922 * if $wgExperimentalHtmlIds is used, so we can generate extra
923 * anchors and links won't break.
926 static function escapeId( $id, $options = array() ) {
927 global $wgHtml5, $wgExperimentalHtmlIds;
928 $options = (array)$options;
930 if ( $wgHtml5 && $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) {
931 $id = Sanitizer
::decodeCharReferences( $id );
932 $id = preg_replace( '/[ \t\n\r\f_\'"&#%]+/', '_', $id );
933 $id = trim( $id, '_' );
935 # Must have been all whitespace to start with.
942 # HTML4-style escaping
943 static $replace = array(
948 $id = urlencode( Sanitizer
::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
949 $id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
951 if ( !preg_match( '/^[a-zA-Z]/', $id )
952 && !in_array( 'noninitial', $options ) ) {
953 // Initial character must be a letter!
960 * Given a value, escape it so that it can be used as a CSS class and
963 * @todo For extra validity, input should be validated UTF-8.
965 * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
967 * @param $class String
970 static function escapeClass( $class ) {
971 // Convert ugly stuff to underscores and kill underscores in ugly places
972 return rtrim(preg_replace(
973 array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
979 * Given HTML input, escape with htmlspecialchars but un-escape entites.
980 * This allows (generally harmless) entities like   to survive.
982 * @param $html String to escape
983 * @return String: escaped input
985 static function escapeHtmlAllowEntities( $html ) {
986 $html = Sanitizer
::decodeCharReferences( $html );
987 # It seems wise to escape ' as well as ", as a matter of course. Can't
989 $html = htmlspecialchars( $html, ENT_QUOTES
);
994 * Regex replace callback for armoring links against further processing.
995 * @param $matches Array
998 private static function armorLinksCallback( $matches ) {
999 return str_replace( ':', ':', $matches[1] );
1003 * Return an associative array of attribute names and values from
1004 * a partial tag string. Attribute names are forces to lowercase,
1005 * character references are decoded to UTF-8 text.
1007 * @param $text String
1010 public static function decodeTagAttributes( $text ) {
1011 if( trim( $text ) == '' ) {
1017 if( !preg_match_all(
1021 PREG_SET_ORDER
) ) {
1025 foreach( $pairs as $set ) {
1026 $attribute = strtolower( $set[1] );
1027 $value = Sanitizer
::getTagAttributeCallback( $set );
1029 // Normalize whitespace
1030 $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1031 $value = trim( $value );
1033 // Decode character references
1034 $attribs[$attribute] = Sanitizer
::decodeCharReferences( $value );
1040 * Pick the appropriate attribute value from a match set from the
1041 * MW_ATTRIBS_REGEX matches.
1046 private static function getTagAttributeCallback( $set ) {
1047 if( isset( $set[6] ) ) {
1048 # Illegal #XXXXXX color with no quotes.
1050 } elseif( isset( $set[5] ) ) {
1053 } elseif( isset( $set[4] ) ) {
1056 } elseif( isset( $set[3] ) ) {
1059 } elseif( !isset( $set[2] ) ) {
1060 # In XHTML, attributes must have a value.
1061 # For 'reduced' form, return explicitly the attribute name here.
1064 throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1069 * Normalize whitespace and character references in an XML source-
1070 * encoded text for an attribute value.
1072 * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
1073 * but note that we're not returning the value, but are returning
1074 * XML source fragments that will be slapped into output.
1076 * @param $text String
1079 private static function normalizeAttributeValue( $text ) {
1080 return str_replace( '"', '"',
1081 self
::normalizeWhitespace(
1082 Sanitizer
::normalizeCharReferences( $text ) ) );
1085 private static function normalizeWhitespace( $text ) {
1086 return preg_replace(
1087 '/\r\n|[\x20\x0d\x0a\x09]/',
1093 * Normalizes whitespace in a section name, such as might be returned
1094 * by Parser::stripSectionName(), for use in the id's that are used for
1097 * @param $section String
1100 static function normalizeSectionNameWhitespace( $section ) {
1101 return trim( preg_replace( '/[ _]+/', ' ', $section ) );
1105 * Ensure that any entities and character references are legal
1106 * for XML and XHTML specifically. Any stray bits will be
1107 * &-escaped to result in a valid text fragment.
1109 * a. any named char refs must be known in XHTML
1110 * b. any numeric char refs must be legal chars, not invalid or forbidden
1111 * c. use &#x, not &#X
1112 * d. fix or reject non-valid attributes
1114 * @param $text String
1118 static function normalizeCharReferences( $text ) {
1119 return preg_replace_callback(
1121 array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
1125 * @param $matches String
1128 static function normalizeCharReferencesCallback( $matches ) {
1130 if( $matches[1] != '' ) {
1131 $ret = Sanitizer
::normalizeEntity( $matches[1] );
1132 } elseif( $matches[2] != '' ) {
1133 $ret = Sanitizer
::decCharReference( $matches[2] );
1134 } elseif( $matches[3] != '' ) {
1135 $ret = Sanitizer
::hexCharReference( $matches[3] );
1137 if( is_null( $ret ) ) {
1138 return htmlspecialchars( $matches[0] );
1145 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1146 * return the named entity reference as is. If the entity is a
1147 * MediaWiki-specific alias, returns the HTML equivalent. Otherwise,
1148 * returns HTML-escaped text of pseudo-entity source (eg &foo;)
1150 * @param $name String
1153 static function normalizeEntity( $name ) {
1154 global $wgHtmlEntities, $wgHtmlEntityAliases;
1155 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1156 return "&{$wgHtmlEntityAliases[$name]};";
1157 } elseif( isset( $wgHtmlEntities[$name] ) ) {
1160 return "&$name;";
1164 static function decCharReference( $codepoint ) {
1165 $point = intval( $codepoint );
1166 if( Sanitizer
::validateCodepoint( $point ) ) {
1167 return sprintf( '&#%d;', $point );
1173 static function hexCharReference( $codepoint ) {
1174 $point = hexdec( $codepoint );
1175 if( Sanitizer
::validateCodepoint( $point ) ) {
1176 return sprintf( '&#x%x;', $point );
1183 * Returns true if a given Unicode codepoint is a valid character in XML.
1184 * @param $codepoint Integer
1187 private static function validateCodepoint( $codepoint ) {
1188 return ($codepoint == 0x09)
1189 ||
($codepoint == 0x0a)
1190 ||
($codepoint == 0x0d)
1191 ||
($codepoint >= 0x20 && $codepoint <= 0xd7ff)
1192 ||
($codepoint >= 0xe000 && $codepoint <= 0xfffd)
1193 ||
($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
1197 * Decode any character references, numeric or named entities,
1198 * in the text and return a UTF-8 string.
1200 * @param $text String
1203 public static function decodeCharReferences( $text ) {
1204 return preg_replace_callback(
1206 array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1211 * Decode any character references, numeric or named entities,
1212 * in the next and normalize the resulting string. (bug 14952)
1214 * This is useful for page titles, not for text to be displayed,
1215 * MediaWiki allows HTML entities to escape normalization as a feature.
1217 * @param $text String (already normalized, containing entities)
1218 * @return String (still normalized, without entities)
1220 public static function decodeCharReferencesAndNormalize( $text ) {
1222 $text = preg_replace_callback(
1224 array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1225 $text, /* limit */ -1, $count );
1228 return $wgContLang->normalize( $text );
1235 * @param $matches String
1238 static function decodeCharReferencesCallback( $matches ) {
1239 if( $matches[1] != '' ) {
1240 return Sanitizer
::decodeEntity( $matches[1] );
1241 } elseif( $matches[2] != '' ) {
1242 return Sanitizer
::decodeChar( intval( $matches[2] ) );
1243 } elseif( $matches[3] != '' ) {
1244 return Sanitizer
::decodeChar( hexdec( $matches[3] ) );
1246 # Last case should be an ampersand by itself
1251 * Return UTF-8 string for a codepoint if that is a valid
1252 * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
1253 * @param $codepoint Integer
1257 static function decodeChar( $codepoint ) {
1258 if( Sanitizer
::validateCodepoint( $codepoint ) ) {
1259 return codepointToUtf8( $codepoint );
1261 return UTF8_REPLACEMENT
;
1266 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1267 * return the UTF-8 encoding of that character. Otherwise, returns
1268 * pseudo-entity source (eg &foo;)
1270 * @param $name Strings
1273 static function decodeEntity( $name ) {
1274 global $wgHtmlEntities, $wgHtmlEntityAliases;
1275 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1276 $name = $wgHtmlEntityAliases[$name];
1278 if( isset( $wgHtmlEntities[$name] ) ) {
1279 return codepointToUtf8( $wgHtmlEntities[$name] );
1286 * Fetch the whitelist of acceptable attributes for a given element name.
1288 * @param $element String
1291 static function attributeWhitelist( $element ) {
1293 if( !isset( $list ) ) {
1294 $list = Sanitizer
::setupAttributeWhitelist();
1296 return isset( $list[$element] )
1302 * Foreach array key (an allowed HTML element), return an array
1303 * of allowed attributes
1306 static function setupAttributeWhitelist() {
1307 global $wgAllowRdfaAttributes, $wgHtml5, $wgAllowMicrodataAttributes;
1309 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );
1311 if ( $wgAllowRdfaAttributes ) {
1312 #RDFa attributes as specified in section 9 of http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1313 $common = array_merge( $common, array(
1314 'about', 'property', 'resource', 'datatype', 'typeof',
1318 if ( $wgHtml5 && $wgAllowMicrodataAttributes ) {
1319 # add HTML5 microdata tages as pecified by http://www.whatwg.org/specs/web-apps/current-work/multipage/microdata.html#the-microdata-model
1320 $common = array_merge( $common, array(
1321 'itemid', 'itemprop', 'itemref', 'itemscope', 'itemtype'
1325 $block = array_merge( $common, array( 'align' ) );
1326 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1327 $tablecell = array( 'abbr',
1333 'nowrap', # deprecated
1334 'width', # deprecated
1335 'height', # deprecated
1336 'bgcolor' # deprecated
1339 # Numbers refer to sections in HTML 4.01 standard describing the element.
1340 # See: http://www.w3.org/TR/html4/
1341 $whitelist = array (
1344 'center' => $common, # deprecated
1345 'span' => $block, # ??
1363 'strong' => $common,
1374 'blockquote' => array_merge( $common, array( 'cite' ) ),
1385 'br' => array( 'id', 'class', 'title', 'style', 'clear' ),
1388 'pre' => array_merge( $common, array( 'width' ) ),
1391 'ins' => array_merge( $common, array( 'cite', 'datetime' ) ),
1392 'del' => array_merge( $common, array( 'cite', 'datetime' ) ),
1395 'ul' => array_merge( $common, array( 'type' ) ),
1396 'ol' => array_merge( $common, array( 'type', 'start' ) ),
1397 'li' => array_merge( $common, array( 'type', 'value' ) ),
1405 'table' => array_merge( $common,
1406 array( 'summary', 'width', 'border', 'frame',
1407 'rules', 'cellspacing', 'cellpadding',
1412 'caption' => array_merge( $common, array( 'align' ) ),
1415 'thead' => array_merge( $common, $tablealign ),
1416 'tfoot' => array_merge( $common, $tablealign ),
1417 'tbody' => array_merge( $common, $tablealign ),
1420 'colgroup' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1421 'col' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1424 'tr' => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1427 'td' => array_merge( $common, $tablecell, $tablealign ),
1428 'th' => array_merge( $common, $tablecell, $tablealign ),
1430 # 12.2 # NOTE: <a> is not allowed directly, but the attrib whitelist is used from the Parser object
1431 'a' => array_merge( $common, array( 'href', 'rel', 'rev' ) ), # rel/rev esp. for RDFa
1434 # Not usually allowed, but may be used for extension-style hooks
1435 # such as <math> when it is rasterized, or if $wgAllowImageTag is
1437 'img' => array_merge( $common, array( 'alt', 'src', 'width', 'height' ) ),
1445 'strike' => $common,
1450 'font' => array_merge( $common, array( 'size', 'color', 'face' ) ),
1454 'hr' => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1456 # XHTML Ruby annotation text module, simple ruby only.
1457 # http://www.w3c.org/TR/ruby/
1462 'rt' => $common, #array_merge( $common, array( 'rbspan' ) ),
1465 # MathML root element, where used for extensions
1466 # 'title' may not be 100% valid here; it's XHTML
1467 # http://www.w3.org/TR/REC-MathML/
1468 'math' => array( 'class', 'style', 'id', 'title' ),
1474 * Take a fragment of (potentially invalid) HTML and return
1475 * a version with any tags removed, encoded as plain text.
1477 * Warning: this return value must be further escaped for literal
1478 * inclusion in HTML output as of 1.10!
1480 * @param $text String: HTML fragment
1483 static function stripAllTags( $text ) {
1485 $text = StringUtils
::delimiterReplace( '<', '>', '', $text );
1487 # Normalize &entities and whitespace
1488 $text = self
::decodeCharReferences( $text );
1489 $text = self
::normalizeWhitespace( $text );
1495 * Hack up a private DOCTYPE with HTML's standard entity declarations.
1496 * PHP 4 seemed to know these if you gave it an HTML doctype, but
1499 * Use for passing XHTML fragments to PHP's XML parsing functions
1503 static function hackDocType() {
1504 global $wgHtmlEntities;
1505 $out = "<!DOCTYPE html [\n";
1506 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1507 $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1513 static function cleanUrl( $url ) {
1514 # Normalize any HTML entities in input. They will be
1515 # re-escaped by makeExternalLink().
1516 $url = Sanitizer
::decodeCharReferences( $url );
1518 # Escape any control characters introduced by the above step
1519 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F\|]/e', "urlencode('\\0')", $url );
1521 # Validate hostname portion
1523 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1524 list( /* $whole */, $protocol, $host, $rest ) = $matches;
1526 // Characters that will be ignored in IDNs.
1527 // http://tools.ietf.org/html/3454#section-3.1
1528 // Strip them before further processing so blacklists and such work.
1530 \\s| # general whitespace
1531 \xc2\xad| # 00ad SOFT HYPHEN
1532 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1533 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1534 \xe2\x81\xa0| # 2060 WORD JOINER
1535 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1536 \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
1537 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1538 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1539 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1540 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1541 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1542 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1545 $host = preg_replace( $strip, '', $host );
1547 // @todo Fixme: validate hostnames here
1549 return $protocol . $host . $rest;