3 * XHTML sanitizer for MediaWiki
5 * Copyright (C) 2002-2005 Brion Vibber <brion@pobox.com> et al
6 * http://www.mediawiki.org/
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
21 * http://www.gnu.org/copyleft/gpl.html
27 * Regular expression to match various types of character references in
28 * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
30 define( 'MW_CHAR_REFS_REGEX',
31 '/&([A-Za-z0-9\x80-\xff]+);
38 * Regular expression to match HTML/XML attribute pairs within a tag.
39 * Allows some... latitude.
40 * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
42 $attrib = '[A-Za-z0-9]';
43 $space = '[\x09\x0a\x0d\x20]';
44 define( 'MW_ATTRIBS_REGEX',
45 "/(?:^|$space)($attrib+)
48 # The attribute value: quoted or alone
51 | ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
52 | (\#[0-9a-fA-F]+) # Technically wrong, but lots of
53 # colors are specified like this.
54 # We'll be normalizing it.
56 )?(?=$space|\$)/sx" );
59 * List of all named character entities defined in HTML 4.01
60 * http://www.w3.org/TR/html4/sgml/entities.html
63 global $wgHtmlEntities;
64 $wgHtmlEntities = array(
319 * Character entity aliases accepted by MediaWiki
321 global $wgHtmlEntityAliases;
322 $wgHtmlEntityAliases = array(
329 * XHTML sanitizer for MediaWiki
334 * Cleans up HTML, removes dangerous tags and attributes, and
335 * removes HTML comments
337 * @param string $text
338 * @param callback $processCallback to do any variable or parameter replacements in HTML attribute values
339 * @param array $args for the processing callback
342 static function removeHTMLtags( $text, $processCallback = null, $args = array() ) {
345 static $htmlpairs, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
346 $htmllist, $listtags, $htmlsingleallowed, $htmlelements, $staticInitialised;
348 wfProfileIn( __METHOD__
);
350 if ( !$staticInitialised ) {
352 $htmlpairs = array( # Tags that must be closed
353 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
354 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
355 'strike', 'strong', 'tt', 'var', 'div', 'center',
356 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
357 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u'
360 'br', 'hr', 'li', 'dt', 'dd'
362 $htmlsingleonly = array( # Elements that cannot have close tags
365 $htmlnest = array( # Tags that can be nested--??
366 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
367 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
369 $tabletags = array( # Can only appear inside table, we will close them
372 $htmllist = array( # Tags used by list
375 $listtags = array( # Tags that can appear in a list
379 $htmlsingleallowed = array_merge( $htmlsingle, $tabletags );
380 $htmlelements = array_merge( $htmlsingle, $htmlpairs, $htmlnest );
382 # Convert them all to hashtables for faster lookup
383 $vars = array( 'htmlpairs', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
384 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelements' );
385 foreach ( $vars as $var ) {
386 $
$var = array_flip( $
$var );
388 $staticInitialised = true;
391 # Remove HTML comments
392 $text = Sanitizer
::removeHTMLcomments( $text );
393 $bits = explode( '<', $text );
394 $text = str_replace( '>', '>', array_shift( $bits ) );
396 $tagstack = $tablestack = array();
397 foreach ( $bits as $x ) {
399 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
400 list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
402 $slash = $t = $params = $brace = $rest = null;
406 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
410 if( isset( $htmlsingleonly[$t] ) ) {
412 } elseif ( ( $ot = @array_pop
( $tagstack ) ) != $t ) {
413 if ( isset( $htmlsingleallowed[$ot] ) ) {
414 # Pop all elements with an optional close tag
415 # and see if we find a match below them
417 array_push ($optstack, $ot);
418 while ( ( ( $ot = @array_pop
( $tagstack ) ) != $t ) &&
419 isset( $htmlsingleallowed[$ot] ) )
421 array_push ($optstack, $ot);
424 # No match. Push the optinal elements back again
426 while ( $ot = @array_pop
( $optstack ) ) {
427 array_push( $tagstack, $ot );
431 @array_push
( $tagstack, $ot );
432 # <li> can be nested in <ul> or <ol>, skip those cases:
433 if(!(isset( $htmllist[$ot] ) && isset( $listtags[$t] ) )) {
438 if ( $t == 'table' ) {
439 $tagstack = array_pop( $tablestack );
444 # Keep track for later
445 if ( isset( $tabletags[$t] ) &&
446 ! in_array( 'table', $tagstack ) ) {
448 } else if ( in_array( $t, $tagstack ) &&
449 ! isset( $htmlnest [$t ] ) ) {
451 #Â Is it a self closed htmlpair ? (bug 5487)
452 } else if( $brace == '/>' &&
453 isset( $htmlpairs[$t] ) ) {
455 } elseif( isset( $htmlsingleonly[$t] ) ) {
456 # Hack to force empty tag for uncloseable elements
458 } else if( isset( $htmlsingle[$t] ) ) {
459 # Hack to not close $htmlsingle tags
461 } else if( isset( $tabletags[$t] )
462 && in_array($t ,$tagstack) ) {
463 // New table tag but forgot to close the previous one
466 if ( $t == 'table' ) {
467 array_push( $tablestack, $tagstack );
470 array_push( $tagstack, $t );
473 # Replace any variables or template parameters with
475 if( is_callable( $processCallback ) ) {
476 call_user_func_array( $processCallback, array( &$params, $args ) );
479 # Strip non-approved attributes from the tag
480 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
483 $rest = str_replace( '>', '>', $rest );
484 $close = ( $brace == '/>' && !$slash ) ?
' /' : '';
485 $text .= "<$slash$t$newparams$close>$rest";
489 $text .= '<' . str_replace( '>', '>', $x);
491 # Close off any remaining tags
492 while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
494 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
497 # this might be possible using tidy itself
498 foreach ( $bits as $x ) {
499 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
501 @list
( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
502 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
503 if( is_callable( $processCallback ) ) {
504 call_user_func_array( $processCallback, array( &$params, $args ) );
506 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
507 $rest = str_replace( '>', '>', $rest );
508 $text .= "<$slash$t$newparams$brace$rest";
510 $text .= '<' . str_replace( '>', '>', $x);
514 wfProfileOut( __METHOD__
);
519 * Remove '<!--', '-->', and everything between.
520 * To avoid leaving blank lines, when a comment is both preceded
521 * and followed by a newline (ignoring spaces), trim leading and
522 * trailing spaces and one of the newlines.
525 * @param string $text
528 static function removeHTMLcomments( $text ) {
529 wfProfileIn( __METHOD__
);
530 while (($start = strpos($text, '<!--')) !== false) {
531 $end = strpos($text, '-->', $start +
4);
532 if ($end === false) {
533 # Unterminated comment; bail out
539 # Trim space and newline if the comment is both
540 # preceded and followed by a newline
541 $spaceStart = max($start - 1, 0);
542 $spaceLen = $end - $spaceStart;
543 while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
547 while (substr($text, $spaceStart +
$spaceLen, 1) === ' ')
549 if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart +
$spaceLen, 1) === "\n") {
550 # Remove the comment, leading and trailing
551 # spaces, and leave only one newline.
552 $text = substr_replace($text, "\n", $spaceStart, $spaceLen +
1);
555 # Remove just the comment.
556 $text = substr_replace($text, '', $start, $end - $start);
559 wfProfileOut( __METHOD__
);
564 * Take an array of attribute names and values and normalize or discard
565 * illegal values for the given element type.
567 * - Discards attributes not on a whitelist for the given element
568 * - Unsafe style attributes are discarded
570 * @param array $attribs
571 * @param string $element
574 * @todo Check for legal values where the DTD limits things.
575 * @todo Check for unique id attribute :P
577 static function validateTagAttributes( $attribs, $element ) {
578 $whitelist = array_flip( Sanitizer
::attributeWhitelist( $element ) );
580 foreach( $attribs as $attribute => $value ) {
581 if( !isset( $whitelist[$attribute] ) ) {
584 # Strip javascript "expression" from stylesheets.
585 # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
586 if( $attribute == 'style' ) {
587 $value = Sanitizer
::checkCss( $value );
588 if( $value === false ) {
594 if ( $attribute === 'id' )
595 $value = Sanitizer
::escapeId( $value );
597 // If this attribute was previously set, override it.
598 // Output should only have one attribute of each name.
599 $out[$attribute] = $value;
605 * Pick apart some CSS and check it for forbidden or unsafe structures.
606 * Returns a sanitized string, or false if it was just too evil.
608 * Currently URL references, 'expression', 'tps' are forbidden.
610 * @param string $value
613 static function checkCss( $value ) {
614 $stripped = Sanitizer
::decodeCharReferences( $value );
616 // Remove any comments; IE gets token splitting wrong
617 $stripped = StringUtils
::delimiterReplace( '/*', '*/', ' ', $stripped );
621 // ... and continue checks
622 $stripped = preg_replace( '!\\\\([0-9A-Fa-f]{1,6})[ \\n\\r\\t\\f]?!e',
623 'codepointToUtf8(hexdec("$1"))', $stripped );
624 $stripped = str_replace( '\\', '', $stripped );
625 if( preg_match( '/(?:expression|tps*:\/\/|url\\s*\().*/is',
635 * Take a tag soup fragment listing an HTML element's attributes
636 * and normalize it to well-formed XML, discarding unwanted attributes.
637 * Output is safe for further wikitext processing, with escaping of
638 * values that could trigger problems.
640 * - Normalizes attribute names to lowercase
641 * - Discards attributes not on a whitelist for the given element
642 * - Turns broken or invalid entities into plaintext
643 * - Double-quotes all attribute values
644 * - Attributes without values are given the name as attribute
645 * - Double attributes are discarded
646 * - Unsafe style attributes are discarded
647 * - Prepends space if there are attributes.
649 * @param string $text
650 * @param string $element
653 static function fixTagAttributes( $text, $element ) {
654 if( trim( $text ) == '' ) {
658 $stripped = Sanitizer
::validateTagAttributes(
659 Sanitizer
::decodeTagAttributes( $text ), $element );
662 foreach( $stripped as $attribute => $value ) {
663 $encAttribute = htmlspecialchars( $attribute );
664 $encValue = Sanitizer
::safeEncodeAttribute( $value );
666 $attribs[] = "$encAttribute=\"$encValue\"";
668 return count( $attribs ) ?
' ' . implode( ' ', $attribs ) : '';
672 * Encode an attribute value for HTML output.
674 * @return HTML-encoded text fragment
676 static function encodeAttribute( $text ) {
677 $encValue = htmlspecialchars( $text );
679 // Whitespace is normalized during attribute decoding,
680 // so if we've been passed non-spaces we must encode them
681 // ahead of time or they won't be preserved.
682 $encValue = strtr( $encValue, array(
692 * Encode an attribute value for HTML tags, with extra armoring
693 * against further wiki processing.
695 * @return HTML-encoded text fragment
697 static function safeEncodeAttribute( $text ) {
698 $encValue = Sanitizer
::encodeAttribute( $text );
700 # Templates and links may be expanded in later parsing,
701 # creating invalid or dangerous output. Suppress this.
702 $encValue = strtr( $encValue, array(
703 '<' => '<', // This should never happen,
704 '>' => '>', // we've received invalid input
705 '"' => '"', // which should have been escaped.
708 "''" => '''',
709 'ISBN' => 'ISBN',
711 'PMID' => 'PMID',
717 $encValue = preg_replace_callback(
718 '/(' . wfUrlProtocols() . ')/',
719 array( 'Sanitizer', 'armorLinksCallback' ),
725 * Given a value escape it so that it can be used in an id attribute and
726 * return it, this does not validate the value however (see first link)
728 * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters
731 * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
738 static function escapeId( $id ) {
739 static $replace = array(
744 $id = urlencode( Sanitizer
::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
746 return str_replace( array_keys( $replace ), array_values( $replace ), $id );
750 * Given a value, escape it so that it can be used as a CSS class and
753 * @todo For extra validity, input should be validated UTF-8.
755 * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
757 * @param string $class
760 static function escapeClass( $class ) {
761 // Convert ugly stuff to underscores and kill underscores in ugly places
762 return rtrim(preg_replace(
763 array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
769 * Regex replace callback for armoring links against further processing.
770 * @param array $matches
774 private static function armorLinksCallback( $matches ) {
775 return str_replace( ':', ':', $matches[1] );
779 * Return an associative array of attribute names and values from
780 * a partial tag string. Attribute names are forces to lowercase,
781 * character references are decoded to UTF-8 text.
786 static function decodeTagAttributes( $text ) {
789 if( trim( $text ) == '' ) {
802 foreach( $pairs as $set ) {
803 $attribute = strtolower( $set[1] );
804 $value = Sanitizer
::getTagAttributeCallback( $set );
806 // Normalize whitespace
807 $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
808 $value = trim( $value );
810 // Decode character references
811 $attribs[$attribute] = Sanitizer
::decodeCharReferences( $value );
817 * Pick the appropriate attribute value from a match set from the
818 * MW_ATTRIBS_REGEX matches.
824 private static function getTagAttributeCallback( $set ) {
825 if( isset( $set[6] ) ) {
826 # Illegal #XXXXXX color with no quotes.
828 } elseif( isset( $set[5] ) ) {
831 } elseif( isset( $set[4] ) ) {
834 } elseif( isset( $set[3] ) ) {
837 } elseif( !isset( $set[2] ) ) {
838 # In XHTML, attributes must have a value.
839 # For 'reduced' form, return explicitly the attribute name here.
842 throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
847 * Normalize whitespace and character references in an XML source-
848 * encoded text for an attribute value.
850 * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
851 * but note that we're not returning the value, but are returning
852 * XML source fragments that will be slapped into output.
854 * @param string $text
858 private static function normalizeAttributeValue( $text ) {
859 return str_replace( '"', '"',
860 self
::normalizeWhitespace(
861 Sanitizer
::normalizeCharReferences( $text ) ) );
864 private static function normalizeWhitespace( $text ) {
866 '/\r\n|[\x20\x0d\x0a\x09]/',
872 * Ensure that any entities and character references are legal
873 * for XML and XHTML specifically. Any stray bits will be
874 * &-escaped to result in a valid text fragment.
876 * a. any named char refs must be known in XHTML
877 * b. any numeric char refs must be legal chars, not invalid or forbidden
878 * c. use &#x, not &#X
879 * d. fix or reject non-valid attributes
881 * @param string $text
885 static function normalizeCharReferences( $text ) {
886 return preg_replace_callback(
888 array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
892 * @param string $matches
895 static function normalizeCharReferencesCallback( $matches ) {
897 if( $matches[1] != '' ) {
898 $ret = Sanitizer
::normalizeEntity( $matches[1] );
899 } elseif( $matches[2] != '' ) {
900 $ret = Sanitizer
::decCharReference( $matches[2] );
901 } elseif( $matches[3] != '' ) {
902 $ret = Sanitizer
::hexCharReference( $matches[3] );
903 } elseif( $matches[4] != '' ) {
904 $ret = Sanitizer
::hexCharReference( $matches[4] );
906 if( is_null( $ret ) ) {
907 return htmlspecialchars( $matches[0] );
914 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
915 * return the named entity reference as is. If the entity is a
916 * MediaWiki-specific alias, returns the HTML equivalent. Otherwise,
917 * returns HTML-escaped text of pseudo-entity source (eg &foo;)
919 * @param string $name
923 static function normalizeEntity( $name ) {
924 global $wgHtmlEntities, $wgHtmlEntityAliases;
925 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
926 return "&{$wgHtmlEntityAliases[$name]};";
927 } elseif( isset( $wgHtmlEntities[$name] ) ) {
930 return "&$name;";
934 static function decCharReference( $codepoint ) {
935 $point = intval( $codepoint );
936 if( Sanitizer
::validateCodepoint( $point ) ) {
937 return sprintf( '&#%d;', $point );
943 static function hexCharReference( $codepoint ) {
944 $point = hexdec( $codepoint );
945 if( Sanitizer
::validateCodepoint( $point ) ) {
946 return sprintf( '&#x%x;', $point );
953 * Returns true if a given Unicode codepoint is a valid character in XML.
954 * @param int $codepoint
957 private static function validateCodepoint( $codepoint ) {
958 return ($codepoint == 0x09)
959 ||
($codepoint == 0x0a)
960 ||
($codepoint == 0x0d)
961 ||
($codepoint >= 0x20 && $codepoint <= 0xd7ff)
962 ||
($codepoint >= 0xe000 && $codepoint <= 0xfffd)
963 ||
($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
967 * Decode any character references, numeric or named entities,
968 * in the text and return a UTF-8 string.
970 * @param string $text
975 public static function decodeCharReferences( $text ) {
976 return preg_replace_callback(
978 array( 'Sanitizer', 'decodeCharReferencesCallback' ),
983 * @param string $matches
986 static function decodeCharReferencesCallback( $matches ) {
987 if( $matches[1] != '' ) {
988 return Sanitizer
::decodeEntity( $matches[1] );
989 } elseif( $matches[2] != '' ) {
990 return Sanitizer
::decodeChar( intval( $matches[2] ) );
991 } elseif( $matches[3] != '' ) {
992 return Sanitizer
::decodeChar( hexdec( $matches[3] ) );
993 } elseif( $matches[4] != '' ) {
994 return Sanitizer
::decodeChar( hexdec( $matches[4] ) );
996 # Last case should be an ampersand by itself
1001 * Return UTF-8 string for a codepoint if that is a valid
1002 * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
1003 * @param int $codepoint
1007 static function decodeChar( $codepoint ) {
1008 if( Sanitizer
::validateCodepoint( $codepoint ) ) {
1009 return codepointToUtf8( $codepoint );
1011 return UTF8_REPLACEMENT
;
1016 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1017 * return the UTF-8 encoding of that character. Otherwise, returns
1018 * pseudo-entity source (eg &foo;)
1020 * @param string $name
1023 static function decodeEntity( $name ) {
1024 global $wgHtmlEntities, $wgHtmlEntityAliases;
1025 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1026 $name = $wgHtmlEntityAliases[$name];
1028 if( isset( $wgHtmlEntities[$name] ) ) {
1029 return codepointToUtf8( $wgHtmlEntities[$name] );
1036 * Fetch the whitelist of acceptable attributes for a given
1039 * @param string $element
1042 static function attributeWhitelist( $element ) {
1044 if( !isset( $list ) ) {
1045 $list = Sanitizer
::setupAttributeWhitelist();
1047 return isset( $list[$element] )
1053 * @todo Document it a bit
1056 static function setupAttributeWhitelist() {
1057 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );
1058 $block = array_merge( $common, array( 'align' ) );
1059 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1060 $tablecell = array( 'abbr',
1066 'nowrap', # deprecated
1067 'width', # deprecated
1068 'height', # deprecated
1069 'bgcolor' # deprecated
1072 # Numbers refer to sections in HTML 4.01 standard describing the element.
1073 # See: http://www.w3.org/TR/html4/
1074 $whitelist = array (
1077 'center' => $common, # deprecated
1078 'span' => $block, # ??
1096 'strong' => $common,
1107 'blockquote' => array_merge( $common, array( 'cite' ) ),
1118 'br' => array( 'id', 'class', 'title', 'style', 'clear' ),
1121 'pre' => array_merge( $common, array( 'width' ) ),
1124 'ins' => array_merge( $common, array( 'cite', 'datetime' ) ),
1125 'del' => array_merge( $common, array( 'cite', 'datetime' ) ),
1128 'ul' => array_merge( $common, array( 'type' ) ),
1129 'ol' => array_merge( $common, array( 'type', 'start' ) ),
1130 'li' => array_merge( $common, array( 'type', 'value' ) ),
1138 'table' => array_merge( $common,
1139 array( 'summary', 'width', 'border', 'frame',
1140 'rules', 'cellspacing', 'cellpadding',
1145 'caption' => array_merge( $common, array( 'align' ) ),
1148 'thead' => array_merge( $common, $tablealign ),
1149 'tfoot' => array_merge( $common, $tablealign ),
1150 'tbody' => array_merge( $common, $tablealign ),
1153 'colgroup' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1154 'col' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1157 'tr' => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1160 'td' => array_merge( $common, $tablecell, $tablealign ),
1161 'th' => array_merge( $common, $tablecell, $tablealign ),
1169 'strike' => $common,
1174 'font' => array_merge( $common, array( 'size', 'color', 'face' ) ),
1178 'hr' => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1180 # XHTML Ruby annotation text module, simple ruby only.
1181 # http://www.w3c.org/TR/ruby/
1186 'rt' => $common, #array_merge( $common, array( 'rbspan' ) ),
1193 * Take a fragment of (potentially invalid) HTML and return
1194 * a version with any tags removed, encoded as plain text.
1196 * Warning: this return value must be further escaped for literal
1197 * inclusion in HTML output as of 1.10!
1199 * @param string $text HTML fragment
1202 static function stripAllTags( $text ) {
1204 $text = StringUtils
::delimiterReplace( '<', '>', '', $text );
1206 # Normalize &entities and whitespace
1207 $text = self
::decodeCharReferences( $text );
1208 $text = self
::normalizeWhitespace( $text );
1214 * Hack up a private DOCTYPE with HTML's standard entity declarations.
1215 * PHP 4 seemed to know these if you gave it an HTML doctype, but
1218 * Use for passing XHTML fragments to PHP's XML parsing functions
1223 static function hackDocType() {
1224 global $wgHtmlEntities;
1225 $out = "<!DOCTYPE html [\n";
1226 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1227 $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1233 static function cleanUrl( $url, $hostname=true ) {
1234 # Normalize any HTML entities in input. They will be
1235 # re-escaped by makeExternalLink().
1236 $url = Sanitizer
::decodeCharReferences( $url );
1238 # Escape any control characters introduced by the above step
1239 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F]/e', "urlencode('\\0')", $url );
1241 # Validate hostname portion
1243 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1244 list( /* $whole */, $protocol, $host, $rest ) = $matches;
1246 // Characters that will be ignored in IDNs.
1247 // http://tools.ietf.org/html/3454#section-3.1
1248 // Strip them before further processing so blacklists and such work.
1250 \\s| # general whitespace
1251 \xc2\xad| # 00ad SOFT HYPHEN
1252 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1253 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1254 \xe2\x81\xa0| # 2060 WORD JOINER
1255 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1256 \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
1257 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1258 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1259 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1260 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1261 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1262 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1265 $host = preg_replace( $strip, '', $host );
1267 // @fixme: validate hostnames here
1269 return $protocol . $host . $rest;