includes/Sanitizer.php

   1 <?php
   2 /**
   3  * XHTML sanitizer for MediaWiki
   4  *
   5  * Copyright © 2002-2005 Brion Vibber <brion@pobox.com> et al
   6  * http://www.mediawiki.org/
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along
  19  * with this program; if not, write to the Free Software Foundation, Inc.,
  20  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  21  * http://www.gnu.org/copyleft/gpl.html
  22  *
  23  * @file
  24  * @ingroup Parser
  25  */
  26
  27 /**
  28  * Regular expression to match various types of character references in
  29  * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
  30  */
  31 define( 'MW_CHAR_REFS_REGEX',
  32         '/&([A-Za-z0-9\x80-\xff]+);
  33          |&\#([0-9]+);
  34          |&\#[xX]([0-9A-Fa-f]+);
  35          |(&)/x' );
  36
  37 /**
  38  * Regular expression to match HTML/XML attribute pairs within a tag.
  39  * Allows some... latitude.
  40  * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
  41  */
  42 $attribFirst = '[:A-Z_a-z0-9]';
  43 $attrib = '[:A-Z_a-z-.0-9]';
  44 $space = '[\x09\x0a\x0d\x20]';
  45 define( 'MW_ATTRIBS_REGEX',
  46         "/(?:^|$space)({$attribFirst}{$attrib}*)
  47           ($space*=$space*
  48                 (?:
  49                  # The attribute value: quoted or alone
  50                   \"([^<\"]*)\"
  51                  | '([^<']*)'
  52                  |  ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
  53                  |  (\#[0-9a-fA-F]+) # Technically wrong, but lots of
  54                                                          # colors are specified like this.
  55                                                          # We'll be normalizing it.
  56                 )
  57            )?(?=$space|\$)/sx" );
  58
  59 /**
  60  * Regular expression to match URIs that could trigger script execution
  61  */
  62 define( 'MW_EVIL_URI_PATTERN', '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i' );
  63
  64 /**
  65  * Regular expression to match namespace attributes
  66  */
  67 define( 'MW_XMLNS_ATTRIBUTE_PATTRN', "/^xmlns:$attrib+$/" );
  68
  69 /**
  70  * List of all named character entities defined in HTML 4.01
  71  * http://www.w3.org/TR/html4/sgml/entities.html
  72  * @private
  73  */
  74 global $wgHtmlEntities;
  75 $wgHtmlEntities = array(
  76         'Aacute'   => 193,
  77         'aacute'   => 225,
  78         'Acirc'    => 194,
  79         'acirc'    => 226,
  80         'acute'    => 180,
  81         'AElig'    => 198,
  82         'aelig'    => 230,
  83         'Agrave'   => 192,
  84         'agrave'   => 224,
  85         'alefsym'  => 8501,
  86         'Alpha'    => 913,
  87         'alpha'    => 945,
  88         'amp'      => 38,
  89         'and'      => 8743,
  90         'ang'      => 8736,
  91         'Aring'    => 197,
  92         'aring'    => 229,
  93         'asymp'    => 8776,
  94         'Atilde'   => 195,
  95         'atilde'   => 227,
  96         'Auml'     => 196,
  97         'auml'     => 228,
  98         'bdquo'    => 8222,
  99         'Beta'     => 914,
 100         'beta'     => 946,
 101         'brvbar'   => 166,
 102         'bull'     => 8226,
 103         'cap'      => 8745,
 104         'Ccedil'   => 199,
 105         'ccedil'   => 231,
 106         'cedil'    => 184,
 107         'cent'     => 162,
 108         'Chi'      => 935,
 109         'chi'      => 967,
 110         'circ'     => 710,
 111         'clubs'    => 9827,
 112         'cong'     => 8773,
 113         'copy'     => 169,
 114         'crarr'    => 8629,
 115         'cup'      => 8746,
 116         'curren'   => 164,
 117         'dagger'   => 8224,
 118         'Dagger'   => 8225,
 119         'darr'     => 8595,
 120         'dArr'     => 8659,
 121         'deg'      => 176,
 122         'Delta'    => 916,
 123         'delta'    => 948,
 124         'diams'    => 9830,
 125         'divide'   => 247,
 126         'Eacute'   => 201,
 127         'eacute'   => 233,
 128         'Ecirc'    => 202,
 129         'ecirc'    => 234,
 130         'Egrave'   => 200,
 131         'egrave'   => 232,
 132         'empty'    => 8709,
 133         'emsp'     => 8195,
 134         'ensp'     => 8194,
 135         'Epsilon'  => 917,
 136         'epsilon'  => 949,
 137         'equiv'    => 8801,
 138         'Eta'      => 919,
 139         'eta'      => 951,
 140         'ETH'      => 208,
 141         'eth'      => 240,
 142         'Euml'     => 203,
 143         'euml'     => 235,
 144         'euro'     => 8364,
 145         'exist'    => 8707,
 146         'fnof'     => 402,
 147         'forall'   => 8704,
 148         'frac12'   => 189,
 149         'frac14'   => 188,
 150         'frac34'   => 190,
 151         'frasl'    => 8260,
 152         'Gamma'    => 915,
 153         'gamma'    => 947,
 154         'ge'       => 8805,
 155         'gt'       => 62,
 156         'harr'     => 8596,
 157         'hArr'     => 8660,
 158         'hearts'   => 9829,
 159         'hellip'   => 8230,
 160         'Iacute'   => 205,
 161         'iacute'   => 237,
 162         'Icirc'    => 206,
 163         'icirc'    => 238,
 164         'iexcl'    => 161,
 165         'Igrave'   => 204,
 166         'igrave'   => 236,
 167         'image'    => 8465,
 168         'infin'    => 8734,
 169         'int'      => 8747,
 170         'Iota'     => 921,
 171         'iota'     => 953,
 172         'iquest'   => 191,
 173         'isin'     => 8712,
 174         'Iuml'     => 207,
 175         'iuml'     => 239,
 176         'Kappa'    => 922,
 177         'kappa'    => 954,
 178         'Lambda'   => 923,
 179         'lambda'   => 955,
 180         'lang'     => 9001,
 181         'laquo'    => 171,
 182         'larr'     => 8592,
 183         'lArr'     => 8656,
 184         'lceil'    => 8968,
 185         'ldquo'    => 8220,
 186         'le'       => 8804,
 187         'lfloor'   => 8970,
 188         'lowast'   => 8727,
 189         'loz'      => 9674,
 190         'lrm'      => 8206,
 191         'lsaquo'   => 8249,
 192         'lsquo'    => 8216,
 193         'lt'       => 60,
 194         'macr'     => 175,
 195         'mdash'    => 8212,
 196         'micro'    => 181,
 197         'middot'   => 183,
 198         'minus'    => 8722,
 199         'Mu'       => 924,
 200         'mu'       => 956,
 201         'nabla'    => 8711,
 202         'nbsp'     => 160,
 203         'ndash'    => 8211,
 204         'ne'       => 8800,
 205         'ni'       => 8715,
 206         'not'      => 172,
 207         'notin'    => 8713,
 208         'nsub'     => 8836,
 209         'Ntilde'   => 209,
 210         'ntilde'   => 241,
 211         'Nu'       => 925,
 212         'nu'       => 957,
 213         'Oacute'   => 211,
 214         'oacute'   => 243,
 215         'Ocirc'    => 212,
 216         'ocirc'    => 244,
 217         'OElig'    => 338,
 218         'oelig'    => 339,
 219         'Ograve'   => 210,
 220         'ograve'   => 242,
 221         'oline'    => 8254,
 222         'Omega'    => 937,
 223         'omega'    => 969,
 224         'Omicron'  => 927,
 225         'omicron'  => 959,
 226         'oplus'    => 8853,
 227         'or'       => 8744,
 228         'ordf'     => 170,
 229         'ordm'     => 186,
 230         'Oslash'   => 216,
 231         'oslash'   => 248,
 232         'Otilde'   => 213,
 233         'otilde'   => 245,
 234         'otimes'   => 8855,
 235         'Ouml'     => 214,
 236         'ouml'     => 246,
 237         'para'     => 182,
 238         'part'     => 8706,
 239         'permil'   => 8240,
 240         'perp'     => 8869,
 241         'Phi'      => 934,
 242         'phi'      => 966,
 243         'Pi'       => 928,
 244         'pi'       => 960,
 245         'piv'      => 982,
 246         'plusmn'   => 177,
 247         'pound'    => 163,
 248         'prime'    => 8242,
 249         'Prime'    => 8243,
 250         'prod'     => 8719,
 251         'prop'     => 8733,
 252         'Psi'      => 936,
 253         'psi'      => 968,
 254         'quot'     => 34,
 255         'radic'    => 8730,
 256         'rang'     => 9002,
 257         'raquo'    => 187,
 258         'rarr'     => 8594,
 259         'rArr'     => 8658,
 260         'rceil'    => 8969,
 261         'rdquo'    => 8221,
 262         'real'     => 8476,
 263         'reg'      => 174,
 264         'rfloor'   => 8971,
 265         'Rho'      => 929,
 266         'rho'      => 961,
 267         'rlm'      => 8207,
 268         'rsaquo'   => 8250,
 269         'rsquo'    => 8217,
 270         'sbquo'    => 8218,
 271         'Scaron'   => 352,
 272         'scaron'   => 353,
 273         'sdot'     => 8901,
 274         'sect'     => 167,
 275         'shy'      => 173,
 276         'Sigma'    => 931,
 277         'sigma'    => 963,
 278         'sigmaf'   => 962,
 279         'sim'      => 8764,
 280         'spades'   => 9824,
 281         'sub'      => 8834,
 282         'sube'     => 8838,
 283         'sum'      => 8721,
 284         'sup'      => 8835,
 285         'sup1'     => 185,
 286         'sup2'     => 178,
 287         'sup3'     => 179,
 288         'supe'     => 8839,
 289         'szlig'    => 223,
 290         'Tau'      => 932,
 291         'tau'      => 964,
 292         'there4'   => 8756,
 293         'Theta'    => 920,
 294         'theta'    => 952,
 295         'thetasym' => 977,
 296         'thinsp'   => 8201,
 297         'THORN'    => 222,
 298         'thorn'    => 254,
 299         'tilde'    => 732,
 300         'times'    => 215,
 301         'trade'    => 8482,
 302         'Uacute'   => 218,
 303         'uacute'   => 250,
 304         'uarr'     => 8593,
 305         'uArr'     => 8657,
 306         'Ucirc'    => 219,
 307         'ucirc'    => 251,
 308         'Ugrave'   => 217,
 309         'ugrave'   => 249,
 310         'uml'      => 168,
 311         'upsih'    => 978,
 312         'Upsilon'  => 933,
 313         'upsilon'  => 965,
 314         'Uuml'     => 220,
 315         'uuml'     => 252,
 316         'weierp'   => 8472,
 317         'Xi'       => 926,
 318         'xi'       => 958,
 319         'Yacute'   => 221,
 320         'yacute'   => 253,
 321         'yen'      => 165,
 322         'Yuml'     => 376,
 323         'yuml'     => 255,
 324         'Zeta'     => 918,
 325         'zeta'     => 950,
 326         'zwj'      => 8205,
 327         'zwnj'     => 8204 );
 328
 329 /**
 330  * Character entity aliases accepted by MediaWiki
 331  */
 332 global $wgHtmlEntityAliases;
 333 $wgHtmlEntityAliases = array(
 334         'רלמ' => 'rlm',
 335         'رلم' => 'rlm',
 336 );
 337
 338
 339 /**
 340  * XHTML sanitizer for MediaWiki
 341  * @ingroup Parser
 342  */
 343 class Sanitizer {
 344         /**
 345          * Cleans up HTML, removes dangerous tags and attributes, and
 346          * removes HTML comments
 347          * @private
 348          * @param $text String
 349          * @param $processCallback Callback to do any variable or parameter replacements in HTML attribute values
 350          * @param $args Array for the processing callback
 351          * @param $extratags Array for any extra tags to include
 352          * @param $removetags Array for any tags (default or extra) to exclude
 353          * @return string
 354          */
 355         static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array(), $removetags = array() ) {
 356                 global $wgUseTidy;
 357
 358                 static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
 359                         $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
 360
 361                 wfProfileIn( __METHOD__ );
 362
 363                 if ( !$staticInitialised ) {
 364
 365                         $htmlpairsStatic = array( # Tags that must be closed
 366                                 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
 367                                 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
 368                                 'strike', 'strong', 'tt', 'var', 'div', 'center',
 369                                 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
 370                                 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'abbr', 'dfn',
 371                                 'kbd', 'samp'
 372                         );
 373                         $htmlsingle = array(
 374                                 'br', 'hr', 'li', 'dt', 'dd'
 375                         );
 376                         $htmlsingleonly = array( # Elements that cannot have close tags
 377                                 'br', 'hr'
 378                         );
 379                         $htmlnest = array( # Tags that can be nested--??
 380                                 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
 381                                 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
 382                         );
 383                         $tabletags = array( # Can only appear inside table, we will close them
 384                                 'td', 'th', 'tr',
 385                         );
 386                         $htmllist = array( # Tags used by list
 387                                 'ul','ol',
 388                         );
 389                         $listtags = array( # Tags that can appear in a list
 390                                 'li',
 391                         );
 392
 393                         global $wgAllowImageTag;
 394                         if ( $wgAllowImageTag ) {
 395                                 $htmlsingle[] = 'img';
 396                                 $htmlsingleonly[] = 'img';
 397                         }
 398
 399                         $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
 400                         $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
 401
 402                         # Convert them all to hashtables for faster lookup
 403                         $vars = array( 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
 404                                 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' );
 405                         foreach ( $vars as $var ) {
 406                                 $$var = array_flip( $$var );
 407                         }
 408                         $staticInitialised = true;
 409                 }
 410                 # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
 411                 $extratags = array_flip( $extratags );
 412                 $removetags = array_flip( $removetags );
 413                 $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
 414                 $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ) , $removetags );
 415
 416                 # Remove HTML comments
 417                 $text = Sanitizer::removeHTMLcomments( $text );
 418                 $bits = explode( '<', $text );
 419                 $text = str_replace( '>', '&gt;', array_shift( $bits ) );
 420                 if ( !$wgUseTidy ) {
 421                         $tagstack = $tablestack = array();
 422                         foreach ( $bits as $x ) {
 423                                 $regs = array();
 424                                 # $slash: Does the current element start with a '/'?
 425                                 # $t: Current element name
 426                                 # $params: String between element name and >
 427                                 # $brace: Ending '>' or '/>'
 428                                 # $rest: Everything until the next element of $bits
 429                                 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
 430                                         list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
 431                                 } else {
 432                                         $slash = $t = $params = $brace = $rest = null;
 433                                 }
 434
 435                                 $badtag = false;
 436                                 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
 437                                         # Check our stack
 438                                         if ( $slash && isset( $htmlsingleonly[$t] ) ) {
 439                                                 $badtag = true;
 440                                         } elseif ( $slash ) {
 441                                                 # Closing a tag... is it the one we just opened?
 442                                                 $ot = @array_pop( $tagstack );
 443                                                 if ( $ot != $t ) {
 444                                                         if ( isset( $htmlsingleallowed[$ot] ) ) {
 445                                                                 # Pop all elements with an optional close tag
 446                                                                 # and see if we find a match below them
 447                                                                 $optstack = array();
 448                                                                 array_push( $optstack, $ot );
 449                                                                 $ot = @array_pop( $tagstack );
 450                                                                 while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
 451                                                                         array_push( $optstack, $ot );
 452                                                                         $ot = @array_pop( $tagstack );
 453                                                                 }
 454                                                                 if ( $t != $ot ) {
 455                                                                         # No match. Push the optional elements back again
 456                                                                         $badtag = true;
 457                                                                         while ( $ot = @array_pop( $optstack ) ) {
 458                                                                                 array_push( $tagstack, $ot );
 459                                                                         }
 460                                                                 }
 461                                                         } else {
 462                                                                 @array_push( $tagstack, $ot );
 463                                                                 # <li> can be nested in <ul> or <ol>, skip those cases:
 464                                                                 if ( !isset( $htmllist[$ot] ) || !isset( $listtags[$t] ) ) {
 465                                                                         $badtag = true;
 466                                                                 }
 467                                                         }
 468                                                 } else {
 469                                                         if ( $t == 'table' ) {
 470                                                                 $tagstack = array_pop( $tablestack );
 471                                                         }
 472                                                 }
 473                                                 $newparams = '';
 474                                         } else {
 475                                                 # Keep track for later
 476                                                 if ( isset( $tabletags[$t] ) &&
 477                                                 !in_array( 'table', $tagstack ) ) {
 478                                                         $badtag = true;
 479                                                 } elseif ( in_array( $t, $tagstack ) &&
 480                                                 !isset( $htmlnest [$t ] ) ) {
 481                                                         $badtag = true;
 482                                                 # Is it a self closed htmlpair ? (bug 5487)
 483                                                 } elseif ( $brace == '/>' &&
 484                                                 isset( $htmlpairs[$t] ) ) {
 485                                                         $badtag = true;
 486                                                 } elseif ( isset( $htmlsingleonly[$t] ) ) {
 487                                                         # Hack to force empty tag for uncloseable elements
 488                                                         $brace = '/>';
 489                                                 } elseif ( isset( $htmlsingle[$t] ) ) {
 490                                                         # Hack to not close $htmlsingle tags
 491                                                         $brace = null;
 492                                                 } elseif ( isset( $tabletags[$t] )
 493                                                 && in_array( $t, $tagstack ) ) {
 494                                                         // New table tag but forgot to close the previous one
 495                                                         $text .= "</$t>";
 496                                                 } else {
 497                                                         if ( $t == 'table' ) {
 498                                                                 array_push( $tablestack, $tagstack );
 499                                                                 $tagstack = array();
 500                                                         }
 501                                                         array_push( $tagstack, $t );
 502                                                 }
 503
 504                                                 # Replace any variables or template parameters with
 505                                                 # plaintext results.
 506                                                 if( is_callable( $processCallback ) ) {
 507                                                         call_user_func_array( $processCallback, array( &$params, $args ) );
 508                                                 }
 509
 510                                                 # Strip non-approved attributes from the tag
 511                                                 $newparams = Sanitizer::fixTagAttributes( $params, $t );
 512                                         }
 513                                         if ( !$badtag ) {
 514                                                 $rest = str_replace( '>', '&gt;', $rest );
 515                                                 $close = ( $brace == '/>' && !$slash ) ? ' /' : '';
 516                                                 $text .= "<$slash$t$newparams$close>$rest";
 517                                                 continue;
 518                                         }
 519                                 }
 520                                 $text .= '&lt;' . str_replace( '>', '&gt;', $x);
 521                         }
 522                         # Close off any remaining tags
 523                         while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
 524                                 $text .= "</$t>\n";
 525                                 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
 526                         }
 527                 } else {
 528                         # this might be possible using tidy itself
 529                         foreach ( $bits as $x ) {
 530                                 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
 531                                 $x, $regs );
 532                                 @list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
 533                                 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
 534                                         if( is_callable( $processCallback ) ) {
 535                                                 call_user_func_array( $processCallback, array( &$params, $args ) );
 536                                         }
 537                                         $newparams = Sanitizer::fixTagAttributes( $params, $t );
 538                                         $rest = str_replace( '>', '&gt;', $rest );
 539                                         $text .= "<$slash$t$newparams$brace$rest";
 540                                 } else {
 541                                         $text .= '&lt;' . str_replace( '>', '&gt;', $x);
 542                                 }
 543                         }
 544                 }
 545                 wfProfileOut( __METHOD__ );
 546                 return $text;
 547         }
 548
 549         /**
 550          * Remove '<!--', '-->', and everything between.
 551          * To avoid leaving blank lines, when a comment is both preceded
 552          * and followed by a newline (ignoring spaces), trim leading and
 553          * trailing spaces and one of the newlines.
 554          *
 555          * @private
 556          * @param $text String
 557          * @return string
 558          */
 559         static function removeHTMLcomments( $text ) {
 560                 wfProfileIn( __METHOD__ );
 561                 while (($start = strpos($text, '<!--')) !== false) {
 562                         $end = strpos($text, '-->', $start + 4);
 563                         if ($end === false) {
 564                                 # Unterminated comment; bail out
 565                                 break;
 566                         }
 567
 568                         $end += 3;
 569
 570                         # Trim space and newline if the comment is both
 571                         # preceded and followed by a newline
 572                         $spaceStart = max($start - 1, 0);
 573                         $spaceLen = $end - $spaceStart;
 574                         while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
 575                                 $spaceStart--;
 576                                 $spaceLen++;
 577                         }
 578                         while (substr($text, $spaceStart + $spaceLen, 1) === ' ')
 579                                 $spaceLen++;
 580                         if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart + $spaceLen, 1) === "\n") {
 581                                 # Remove the comment, leading and trailing
 582                                 # spaces, and leave only one newline.
 583                                 $text = substr_replace($text, "\n", $spaceStart, $spaceLen + 1);
 584                         }
 585                         else {
 586                                 # Remove just the comment.
 587                                 $text = substr_replace($text, '', $start, $end - $start);
 588                         }
 589                 }
 590                 wfProfileOut( __METHOD__ );
 591                 return $text;
 592         }
 593
 594         /**
 595          * Take an array of attribute names and values and normalize or discard
 596          * illegal values for the given element type.
 597          *
 598          * - Discards attributes not on a whitelist for the given element
 599          * - Unsafe style attributes are discarded
 600          * - Invalid id attributes are reencoded
 601          *
 602          * @param $attribs Array
 603          * @param $element String
 604          * @return Array
 605          *
 606          * @todo Check for legal values where the DTD limits things.
 607          * @todo Check for unique id attribute :P
 608          */
 609         static function validateTagAttributes( $attribs, $element ) {
 610                 return Sanitizer::validateAttributes( $attribs,
 611                         Sanitizer::attributeWhitelist( $element ) );
 612         }
 613
 614         /**
 615          * Take an array of attribute names and values and normalize or discard
 616          * illegal values for the given whitelist.
 617          *
 618          * - Discards attributes not the given whitelist
 619          * - Unsafe style attributes are discarded
 620          * - Invalid id attributes are reencoded
 621          *
 622          * @param $attribs Array
 623          * @param $whitelist Array: list of allowed attribute names
 624          * @return Array
 625          *
 626          * @todo Check for legal values where the DTD limits things.
 627          * @todo Check for unique id attribute :P
 628          */
 629         static function validateAttributes( $attribs, $whitelist ) {
 630                 global $wgAllowRdfaAttributes, $wgAllowMicrodataAttributes, $wgHtml5;
 631
 632                 $whitelist = array_flip( $whitelist );
 633                 $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
 634
 635                 $out = array();
 636                 foreach( $attribs as $attribute => $value ) {
 637                         #allow XML namespace declaration if RDFa is enabled
 638                         if ( $wgAllowRdfaAttributes && preg_match( MW_XMLNS_ATTRIBUTE_PATTRN, $attribute ) ) {
 639                                 if ( !preg_match( MW_EVIL_URI_PATTERN, $value ) ) {
 640                                         $out[$attribute] = $value;
 641                                 }
 642
 643                                 continue;
 644                         }
 645
 646                         # Allow any attribute beginning with "data-", if in HTML5 mode
 647                         if ( !($wgHtml5 && preg_match( '/^data-/i', $attribute )) && !isset( $whitelist[$attribute] ) ) {
 648                                 continue;
 649                         }
 650
 651                         # Strip javascript "expression" from stylesheets.
 652                         # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
 653                         if( $attribute == 'style' ) {
 654                                 $value = Sanitizer::checkCss( $value );
 655                         }
 656
 657                         if ( $attribute === 'id' ) {
 658                                 $value = Sanitizer::escapeId( $value, 'noninitial' );
 659                         }
 660
 661                         //RDFa and microdata properties allow URLs, URIs and/or CURIs. check them for sanity
 662                         if ( $attribute === 'rel' || $attribute === 'rev' ||
 663                                 $attribute === 'about' || $attribute === 'property' || $attribute === 'resource' || #RDFa
 664                                 $attribute === 'datatype' || $attribute === 'typeof' ||                             #RDFa
 665                                 $attribute === 'itemid' || $attribute === 'itemprop' || $attribute === 'itemref' || #HTML5 microdata
 666                                 $attribute === 'itemscope' || $attribute === 'itemtype' ) {                         #HTML5 microdata
 667
 668                                 //Paranoia. Allow "simple" values but suppress javascript
 669                                 if ( preg_match( MW_EVIL_URI_PATTERN, $value ) ) {
 670                                         continue;
 671                                 }
 672                         }
 673
 674                         # NOTE: even though elements using href/src are not allowed directly, supply
 675                         #       validation code that can be used by tag hook handlers, etc
 676                         if ( $attribute === 'href' || $attribute === 'src' ) {
 677                                 if ( !preg_match( $hrefExp, $value ) ) {
 678                                         continue; //drop any href or src attributes not using an allowed protocol.
 679                                                   //NOTE: this also drops all relative URLs
 680                                 }
 681                         }
 682
 683                         // If this attribute was previously set, override it.
 684                         // Output should only have one attribute of each name.
 685                         $out[$attribute] = $value;
 686                 }
 687
 688                 if ( $wgAllowMicrodataAttributes ) {
 689                         # itemtype, itemid, itemref don't make sense without itemscope
 690                         if ( !array_key_exists( 'itemscope', $out ) ) {
 691                                 unset( $out['itemtype'] );
 692                                 unset( $out['itemid'] );
 693                                 unset( $out['itemref'] );
 694                         }
 695                         # TODO: Strip itemprop if we aren't descendants of an itemscope.
 696                 }
 697                 return $out;
 698         }
 699
 700         /**
 701          * Merge two sets of HTML attributes.  Conflicting items in the second set
 702          * will override those in the first, except for 'class' attributes which
 703          * will be combined (if they're both strings).
 704          *
 705          * @todo implement merging for other attributes such as style
 706          * @param $a Array
 707          * @param $b Array
 708          * @return array
 709          */
 710         static function mergeAttributes( $a, $b ) {
 711                 $out = array_merge( $a, $b );
 712                 if( isset( $a['class'] ) && isset( $b['class'] )
 713                 && is_string( $a['class'] ) && is_string( $b['class'] )
 714                 && $a['class'] !== $b['class'] ) {
 715                         $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
 716                                 -1, PREG_SPLIT_NO_EMPTY );
 717                         $out['class'] = implode( ' ', array_unique( $classes ) );
 718                 }
 719                 return $out;
 720         }
 721
 722         /**
 723          * Pick apart some CSS and check it for forbidden or unsafe structures.
 724          * Returns a sanitized string, or false if it was just too evil.
 725          *
 726          * Currently URL references, 'expression', 'tps' are forbidden.
 727          *
 728          * @param $value String
 729          * @return Mixed
 730          */
 731         static function checkCss( $value ) {
 732                 $value = Sanitizer::decodeCharReferences( $value );
 733
 734                 // Remove any comments; IE gets token splitting wrong
 735                 $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value );
 736
 737                 // Remove anything after a comment-start token, to guard against
 738                 // incorrect client implementations.
 739                 $commentPos = strpos( $value, '/*' );
 740                 if ( $commentPos !== false ) {
 741                         $value = substr( $value, 0, $commentPos );
 742                 }
 743
 744                 // Decode escape sequences and line continuation
 745                 // See the grammar in the CSS 2 spec, appendix D.
 746                 static $decodeRegex;
 747                 if ( !$decodeRegex ) {
 748                         $space = '[\\x20\\t\\r\\n\\f]';
 749                         $nl = '(?:\\n|\\r\\n|\\r|\\f)';
 750                         $backslash = '\\\\';
 751                         $decodeRegex = "/ $backslash
 752                                 (?:
 753                                         ($nl) |  # 1. Line continuation
 754                                         ([0-9A-Fa-f]{1,6})$space? |  # 2. character number
 755                                         (.) | # 3. backslash cancelling special meaning
 756                                         () | # 4. backslash at end of string
 757                                 )/xu";
 758                 }
 759                 $value = preg_replace_callback( $decodeRegex,
 760                         array( __CLASS__, 'cssDecodeCallback' ), $value );
 761
 762                 // Reject problematic keywords and control characters
 763                 if ( preg_match( '/[\000-\010\016-\037\177]/', $value ) ) {
 764                         return '/* invalid control char */';
 765                 } elseif ( preg_match( '! expression | filter\s*: | accelerator\s*: | url\s*\( !ix', $value ) ) {
 766                         return '/* insecure input */';
 767                 }
 768                 return $value;
 769         }
 770
 771         static function cssDecodeCallback( $matches ) {
 772                 if ( $matches[1] !== '' ) {
 773                         // Line continuation
 774                         return '';
 775                 } elseif ( $matches[2] !== '' ) {
 776                         $char = codepointToUtf8( hexdec( $matches[2] ) );
 777                 } elseif ( $matches[3] !== '' ) {
 778                         $char = $matches[3];
 779                 } else {
 780                         $char = '\\';
 781                 }
 782                 if ( $char == "\n" || $char == '"' || $char == "'" || $char == '\\' ) {
 783                         // These characters need to be escaped in strings
 784                         // Clean up the escape sequence to avoid parsing errors by clients
 785                         return '\\' . dechex( ord( $char ) ) . ' ';
 786                 } else {
 787                         // Decode unnecessary escape
 788                         return $char;
 789                 }
 790         }
 791
 792         /**
 793          * Take a tag soup fragment listing an HTML element's attributes
 794          * and normalize it to well-formed XML, discarding unwanted attributes.
 795          * Output is safe for further wikitext processing, with escaping of
 796          * values that could trigger problems.
 797          *
 798          * - Normalizes attribute names to lowercase
 799          * - Discards attributes not on a whitelist for the given element
 800          * - Turns broken or invalid entities into plaintext
 801          * - Double-quotes all attribute values
 802          * - Attributes without values are given the name as attribute
 803          * - Double attributes are discarded
 804          * - Unsafe style attributes are discarded
 805          * - Prepends space if there are attributes.
 806          *
 807          * @param $text String
 808          * @param $element String
 809          * @return String
 810          */
 811         static function fixTagAttributes( $text, $element ) {
 812                 if( trim( $text ) == '' ) {
 813                         return '';
 814                 }
 815
 816                 $stripped = Sanitizer::validateTagAttributes(
 817                         Sanitizer::decodeTagAttributes( $text ), $element );
 818
 819                 $attribs = array();
 820                 foreach( $stripped as $attribute => $value ) {
 821                         $encAttribute = htmlspecialchars( $attribute );
 822                         $encValue = Sanitizer::safeEncodeAttribute( $value );
 823
 824                         $attribs[] = "$encAttribute=\"$encValue\"";
 825                 }
 826                 return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : '';
 827         }
 828
 829         /**
 830          * Encode an attribute value for HTML output.
 831          * @param $text String
 832          * @return HTML-encoded text fragment
 833          */
 834         static function encodeAttribute( $text ) {
 835                 $encValue = htmlspecialchars( $text, ENT_QUOTES );
 836
 837                 // Whitespace is normalized during attribute decoding,
 838                 // so if we've been passed non-spaces we must encode them
 839                 // ahead of time or they won't be preserved.
 840                 $encValue = strtr( $encValue, array(
 841                         "\n" => '&#10;',
 842                         "\r" => '&#13;',
 843                         "\t" => '&#9;',
 844                 ) );
 845
 846                 return $encValue;
 847         }
 848
 849         /**
 850          * Encode an attribute value for HTML tags, with extra armoring
 851          * against further wiki processing.
 852          * @param $text String
 853          * @return HTML-encoded text fragment
 854          */
 855         static function safeEncodeAttribute( $text ) {
 856                 $encValue = Sanitizer::encodeAttribute( $text );
 857
 858                 # Templates and links may be expanded in later parsing,
 859                 # creating invalid or dangerous output. Suppress this.
 860                 $encValue = strtr( $encValue, array(
 861                         '<'    => '&lt;',   // This should never happen,
 862                         '>'    => '&gt;',   // we've received invalid input
 863                         '"'    => '&quot;', // which should have been escaped.
 864                         '{'    => '&#123;',
 865                         '['    => '&#91;',
 866                         "''"   => '&#39;&#39;',
 867                         'ISBN' => '&#73;SBN',
 868                         'RFC'  => '&#82;FC',
 869                         'PMID' => '&#80;MID',
 870                         '|'    => '&#124;',
 871                         '__'   => '&#95;_',
 872                 ) );
 873
 874                 # Stupid hack
 875                 $encValue = preg_replace_callback(
 876                         '/(' . wfUrlProtocols() . ')/',
 877                         array( 'Sanitizer', 'armorLinksCallback' ),
 878                         $encValue );
 879                 return $encValue;
 880         }
 881
 882         /**
 883          * Given a value, escape it so that it can be used in an id attribute and
 884          * return it.  This will use HTML5 validation if $wgExperimentalHtmlIds is
 885          * true, allowing anything but ASCII whitespace.  Otherwise it will use
 886          * HTML 4 rules, which means a narrow subset of ASCII, with bad characters
 887          * escaped with lots of dots.
 888          *
 889          * To ensure we don't have to bother escaping anything, we also strip ', ",
 890          * & even if $wgExperimentalIds is true.  TODO: Is this the best tactic?
 891          * We also strip # because it upsets IE, and % because it could be
 892          * ambiguous if it's part of something that looks like a percent escape
 893          * (which don't work reliably in fragments cross-browser).
 894          *
 895          * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters
 896          *                                                          in the id and
 897          *                                                          name attributes
 898          * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
 899          * @see http://www.whatwg.org/specs/web-apps/current-work/multipage/elements.html#the-id-attribute
 900          *   HTML5 definition of id attribute
 901          *
 902          * @param $id String: id to escape
 903          * @param $options Mixed: string or array of strings (default is array()):
 904          *   'noninitial': This is a non-initial fragment of an id, not a full id,
 905          *       so don't pay attention if the first character isn't valid at the
 906          *       beginning of an id.  Only matters if $wgExperimentalHtmlIds is
 907          *       false.
 908          *   'legacy': Behave the way the old HTML 4-based ID escaping worked even
 909          *       if $wgExperimentalHtmlIds is used, so we can generate extra
 910          *       anchors and links won't break.
 911          * @return String
 912          */
 913         static function escapeId( $id, $options = array() ) {
 914                 global $wgHtml5, $wgExperimentalHtmlIds;
 915                 $options = (array)$options;
 916
 917                 if ( $wgHtml5 && $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) {
 918                         $id = Sanitizer::decodeCharReferences( $id );
 919                         $id = preg_replace( '/[ \t\n\r\f_\'"&#%]+/', '_', $id );
 920                         $id = trim( $id, '_' );
 921                         if ( $id === '' ) {
 922                                 # Must have been all whitespace to start with.
 923                                 return '_';
 924                         } else {
 925                                 return $id;
 926                         }
 927                 }
 928
 929                 # HTML4-style escaping
 930                 static $replace = array(
 931                         '%3A' => ':',
 932                         '%' => '.'
 933                 );
 934
 935                 $id = urlencode( Sanitizer::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
 936                 $id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
 937
 938                 if ( !preg_match( '/^[a-zA-Z]/', $id )
 939                 && !in_array( 'noninitial', $options ) )  {
 940                         // Initial character must be a letter!
 941                         $id = "x$id";
 942                 }
 943                 return $id;
 944         }
 945
 946         /**
 947          * Given a value, escape it so that it can be used as a CSS class and
 948          * return it.
 949          *
 950          * @todo For extra validity, input should be validated UTF-8.
 951          *
 952          * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
 953          *
 954          * @param $class String
 955          * @return String
 956          */
 957         static function escapeClass( $class ) {
 958                 // Convert ugly stuff to underscores and kill underscores in ugly places
 959                 return rtrim(preg_replace(
 960                         array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
 961                         '_',
 962                         $class ), '_');
 963         }
 964
 965         /**
 966          * Given HTML input, escape with htmlspecialchars but un-escape entites.
 967          * This allows (generally harmless) entities like &#160; to survive.
 968          *
 969          * @param $html String to escape
 970          * @return String: escaped input
 971          */
 972         static function escapeHtmlAllowEntities( $html ) {
 973                 $html = Sanitizer::decodeCharReferences( $html );
 974                 # It seems wise to escape ' as well as ", as a matter of course.  Can't
 975                 # hurt.
 976                 $html = htmlspecialchars( $html, ENT_QUOTES );
 977                 return $html;
 978         }
 979
 980         /**
 981          * Regex replace callback for armoring links against further processing.
 982          * @param $matches Array
 983          * @return string
 984          */
 985         private static function armorLinksCallback( $matches ) {
 986                 return str_replace( ':', '&#58;', $matches[1] );
 987         }
 988
 989         /**
 990          * Return an associative array of attribute names and values from
 991          * a partial tag string. Attribute names are forces to lowercase,
 992          * character references are decoded to UTF-8 text.
 993          *
 994          * @param $text String
 995          * @return Array
 996          */
 997         public static function decodeTagAttributes( $text ) {
 998                 if( trim( $text ) == '' ) {
 999                         return array();
1000                 }
1001
1002                 $attribs = array();
1003                 $pairs = array();
1004                 if( !preg_match_all(
1005                         MW_ATTRIBS_REGEX,
1006                         $text,
1007                         $pairs,
1008                         PREG_SET_ORDER ) ) {
1009                         return $attribs;
1010                 }
1011
1012                 foreach( $pairs as $set ) {
1013                         $attribute = strtolower( $set[1] );
1014                         $value = Sanitizer::getTagAttributeCallback( $set );
1015
1016                         // Normalize whitespace
1017                         $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1018                         $value = trim( $value );
1019
1020                         // Decode character references
1021                         $attribs[$attribute] = Sanitizer::decodeCharReferences( $value );
1022                 }
1023                 return $attribs;
1024         }
1025
1026         /**
1027          * Pick the appropriate attribute value from a match set from the
1028          * MW_ATTRIBS_REGEX matches.
1029          *
1030          * @param $set Array
1031          * @return String
1032          */
1033         private static function getTagAttributeCallback( $set ) {
1034                 if( isset( $set[6] ) ) {
1035                         # Illegal #XXXXXX color with no quotes.
1036                         return $set[6];
1037                 } elseif( isset( $set[5] ) ) {
1038                         # No quotes.
1039                         return $set[5];
1040                 } elseif( isset( $set[4] ) ) {
1041                         # Single-quoted
1042                         return $set[4];
1043                 } elseif( isset( $set[3] ) ) {
1044                         # Double-quoted
1045                         return $set[3];
1046                 } elseif( !isset( $set[2] ) ) {
1047                         # In XHTML, attributes must have a value.
1048                         # For 'reduced' form, return explicitly the attribute name here.
1049                         return $set[1];
1050                 } else {
1051                         throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1052                 }
1053         }
1054
1055         /**
1056          * Normalize whitespace and character references in an XML source-
1057          * encoded text for an attribute value.
1058          *
1059          * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
1060          * but note that we're not returning the value, but are returning
1061          * XML source fragments that will be slapped into output.
1062          *
1063          * @param $text String
1064          * @return String
1065          */
1066         private static function normalizeAttributeValue( $text ) {
1067                 return str_replace( '"', '&quot;',
1068                         self::normalizeWhitespace(
1069                                 Sanitizer::normalizeCharReferences( $text ) ) );
1070         }
1071
1072         private static function normalizeWhitespace( $text ) {
1073                 return preg_replace(
1074                         '/\r\n|[\x20\x0d\x0a\x09]/',
1075                         ' ',
1076                         $text );
1077         }
1078
1079         /**
1080          * Normalizes whitespace in a section name, such as might be returned
1081          * by Parser::stripSectionName(), for use in the id's that are used for
1082          * section links.
1083          *
1084          * @param $section String
1085          * @return String
1086          */
1087         static function normalizeSectionNameWhitespace( $section ) {
1088                 return trim( preg_replace( '/[ _]+/', ' ', $section ) );
1089         }
1090
1091         /**
1092          * Ensure that any entities and character references are legal
1093          * for XML and XHTML specifically. Any stray bits will be
1094          * &amp;-escaped to result in a valid text fragment.
1095          *
1096          * a. named char refs can only be &lt; &gt; &amp; &quot;, others are
1097          *   numericized (this way we're well-formed even without a DTD)
1098          * b. any numeric char refs must be legal chars, not invalid or forbidden
1099          * c. use &#x, not &#X
1100          * d. fix or reject non-valid attributes
1101          *
1102          * @param $text String
1103          * @return String
1104          * @private
1105          */
1106         static function normalizeCharReferences( $text ) {
1107                 return preg_replace_callback(
1108                         MW_CHAR_REFS_REGEX,
1109                         array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
1110                         $text );
1111         }
1112         /**
1113          * @param $matches String
1114          * @return String
1115          */
1116         static function normalizeCharReferencesCallback( $matches ) {
1117                 $ret = null;
1118                 if( $matches[1] != '' ) {
1119                         $ret = Sanitizer::normalizeEntity( $matches[1] );
1120                 } elseif( $matches[2] != '' ) {
1121                         $ret = Sanitizer::decCharReference( $matches[2] );
1122                 } elseif( $matches[3] != ''  ) {
1123                         $ret = Sanitizer::hexCharReference( $matches[3] );
1124                 }
1125                 if( is_null( $ret ) ) {
1126                         return htmlspecialchars( $matches[0] );
1127                 } else {
1128                         return $ret;
1129                 }
1130         }
1131
1132         /**
1133          * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1134          * return the equivalent numeric entity reference (except for the core &lt;
1135          * &gt; &amp; &quot;). If the entity is a MediaWiki-specific alias, returns
1136          * the HTML equivalent. Otherwise, returns HTML-escaped text of
1137          * pseudo-entity source (eg &amp;foo;)
1138          *
1139          * @param $name String
1140          * @return String
1141          */
1142         static function normalizeEntity( $name ) {
1143                 global $wgHtmlEntities, $wgHtmlEntityAliases;
1144                 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1145                         return "&{$wgHtmlEntityAliases[$name]};";
1146                 } elseif ( in_array( $name,
1147                 array( 'lt', 'gt', 'amp', 'quot' ) ) ) {
1148                         return "&$name;";
1149                 } elseif ( isset( $wgHtmlEntities[$name] ) ) {
1150                         return "&#{$wgHtmlEntities[$name]};";
1151                 } else {
1152                         return "&amp;$name;";
1153                 }
1154         }
1155
1156         static function decCharReference( $codepoint ) {
1157                 $point = intval( $codepoint );
1158                 if( Sanitizer::validateCodepoint( $point ) ) {
1159                         return sprintf( '&#%d;', $point );
1160                 } else {
1161                         return null;
1162                 }
1163         }
1164
1165         static function hexCharReference( $codepoint ) {
1166                 $point = hexdec( $codepoint );
1167                 if( Sanitizer::validateCodepoint( $point ) ) {
1168                         return sprintf( '&#x%x;', $point );
1169                 } else {
1170                         return null;
1171                 }
1172         }
1173
1174         /**
1175          * Returns true if a given Unicode codepoint is a valid character in XML.
1176          * @param $codepoint Integer
1177          * @return Boolean
1178          */
1179         private static function validateCodepoint( $codepoint ) {
1180                 return ($codepoint ==    0x09)
1181                         || ($codepoint ==    0x0a)
1182                         || ($codepoint ==    0x0d)
1183                         || ($codepoint >=    0x20 && $codepoint <=   0xd7ff)
1184                         || ($codepoint >=  0xe000 && $codepoint <=   0xfffd)
1185                         || ($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
1186         }
1187
1188         /**
1189          * Decode any character references, numeric or named entities,
1190          * in the text and return a UTF-8 string.
1191          *
1192          * @param $text String
1193          * @return String
1194          */
1195         public static function decodeCharReferences( $text ) {
1196                 return preg_replace_callback(
1197                         MW_CHAR_REFS_REGEX,
1198                         array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1199                         $text );
1200         }
1201
1202         /**
1203          * Decode any character references, numeric or named entities,
1204          * in the next and normalize the resulting string. (bug 14952)
1205          *
1206          * This is useful for page titles, not for text to be displayed,
1207          * MediaWiki allows HTML entities to escape normalization as a feature.
1208          *
1209          * @param $text String (already normalized, containing entities)
1210          * @return String (still normalized, without entities)
1211          */
1212         public static function decodeCharReferencesAndNormalize( $text ) {
1213                 global $wgContLang;
1214                 $text = preg_replace_callback(
1215                         MW_CHAR_REFS_REGEX,
1216                         array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1217                         $text, /* limit */ -1, $count );
1218
1219                 if ( $count ) {
1220                         return $wgContLang->normalize( $text );
1221                 } else {
1222                         return $text;
1223                 }
1224         }
1225
1226         /**
1227          * @param $matches String
1228          * @return String
1229          */
1230         static function decodeCharReferencesCallback( $matches ) {
1231                 if( $matches[1] != '' ) {
1232                         return Sanitizer::decodeEntity( $matches[1] );
1233                 } elseif( $matches[2] != '' ) {
1234                         return  Sanitizer::decodeChar( intval( $matches[2] ) );
1235                 } elseif( $matches[3] != ''  ) {
1236                         return  Sanitizer::decodeChar( hexdec( $matches[3] ) );
1237                 }
1238                 # Last case should be an ampersand by itself
1239                 return $matches[0];
1240         }
1241
1242         /**
1243          * Return UTF-8 string for a codepoint if that is a valid
1244          * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
1245          * @param $codepoint Integer
1246          * @return String
1247          * @private
1248          */
1249         static function decodeChar( $codepoint ) {
1250                 if( Sanitizer::validateCodepoint( $codepoint ) ) {
1251                         return codepointToUtf8( $codepoint );
1252                 } else {
1253                         return UTF8_REPLACEMENT;
1254                 }
1255         }
1256
1257         /**
1258          * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1259          * return the UTF-8 encoding of that character. Otherwise, returns
1260          * pseudo-entity source (eg &foo;)
1261          *
1262          * @param $name Strings
1263          * @return String
1264          */
1265         static function decodeEntity( $name ) {
1266                 global $wgHtmlEntities, $wgHtmlEntityAliases;
1267                 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1268                         $name = $wgHtmlEntityAliases[$name];
1269                 }
1270                 if( isset( $wgHtmlEntities[$name] ) ) {
1271                         return codepointToUtf8( $wgHtmlEntities[$name] );
1272                 } else {
1273                         return "&$name;";
1274                 }
1275         }
1276
1277         /**
1278          * Fetch the whitelist of acceptable attributes for a given element name.
1279          *
1280          * @param $element String
1281          * @return Array
1282          */
1283         static function attributeWhitelist( $element ) {
1284                 static $list;
1285                 if( !isset( $list ) ) {
1286                         $list = Sanitizer::setupAttributeWhitelist();
1287                 }
1288                 return isset( $list[$element] )
1289                         ? $list[$element]
1290                         : array();
1291         }
1292
1293         /**
1294          * Foreach array key (an allowed HTML element), return an array
1295          * of allowed attributes
1296          * @return Array
1297          */
1298         static function setupAttributeWhitelist() {
1299                 global $wgAllowRdfaAttributes, $wgHtml5, $wgAllowMicrodataAttributes;
1300
1301                 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );
1302
1303                 if ( $wgAllowRdfaAttributes ) {
1304                         #RDFa attributes as specified in section 9 of http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1305                         $common = array_merge( $common, array(
1306                             'about', 'property', 'resource', 'datatype', 'typeof',
1307                         ) );
1308                 }
1309
1310                 if ( $wgHtml5 && $wgAllowMicrodataAttributes ) {
1311                         # add HTML5 microdata tages as pecified by http://www.whatwg.org/specs/web-apps/current-work/multipage/microdata.html#the-microdata-model
1312                         $common = array_merge( $common, array(
1313                             'itemid', 'itemprop', 'itemref', 'itemscope', 'itemtype'
1314                         ) );
1315                 }
1316
1317                 $block = array_merge( $common, array( 'align' ) );
1318                 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1319                 $tablecell = array( 'abbr',
1320                                     'axis',
1321                                     'headers',
1322                                     'scope',
1323                                     'rowspan',
1324                                     'colspan',
1325                                     'nowrap', # deprecated
1326                                     'width',  # deprecated
1327                                     'height', # deprecated
1328                                     'bgcolor' # deprecated
1329                                     );
1330
1331                 # Numbers refer to sections in HTML 4.01 standard describing the element.
1332                 # See: http://www.w3.org/TR/html4/
1333                 $whitelist = array (
1334                         # 7.5.4
1335                         'div'        => $block,
1336                         'center'     => $common, # deprecated
1337                         'span'       => $block, # ??
1338
1339                         # 7.5.5
1340                         'h1'         => $block,
1341                         'h2'         => $block,
1342                         'h3'         => $block,
1343                         'h4'         => $block,
1344                         'h5'         => $block,
1345                         'h6'         => $block,
1346
1347                         # 7.5.6
1348                         # address
1349
1350                         # 8.2.4
1351                         # bdo
1352
1353                         # 9.2.1
1354                         'em'         => $common,
1355                         'strong'     => $common,
1356                         'cite'       => $common,
1357                         'dfn'        => $common,
1358                         'code'       => $common,
1359                         'samp'       => $common,
1360                         'kbd'        => $common,
1361                         'var'        => $common,
1362                         'abbr'       => $common,
1363                         # acronym
1364
1365                         # 9.2.2
1366                         'blockquote' => array_merge( $common, array( 'cite' ) ),
1367                         # q
1368
1369                         # 9.2.3
1370                         'sub'        => $common,
1371                         'sup'        => $common,
1372
1373                         # 9.3.1
1374                         'p'          => $block,
1375
1376                         # 9.3.2
1377                         'br'         => array( 'id', 'class', 'title', 'style', 'clear' ),
1378
1379                         # 9.3.4
1380                         'pre'        => array_merge( $common, array( 'width' ) ),
1381
1382                         # 9.4
1383                         'ins'        => array_merge( $common, array( 'cite', 'datetime' ) ),
1384                         'del'        => array_merge( $common, array( 'cite', 'datetime' ) ),
1385
1386                         # 10.2
1387                         'ul'         => array_merge( $common, array( 'type' ) ),
1388                         'ol'         => array_merge( $common, array( 'type', 'start' ) ),
1389                         'li'         => array_merge( $common, array( 'type', 'value' ) ),
1390
1391                         # 10.3
1392                         'dl'         => $common,
1393                         'dd'         => $common,
1394                         'dt'         => $common,
1395
1396                         # 11.2.1
1397                         'table'      => array_merge( $common,
1398                                                                 array( 'summary', 'width', 'border', 'frame',
1399                                                                                 'rules', 'cellspacing', 'cellpadding',
1400                                                                                 'align', 'bgcolor',
1401                                                                 ) ),
1402
1403                         # 11.2.2
1404                         'caption'    => array_merge( $common, array( 'align' ) ),
1405
1406                         # 11.2.3
1407                         'thead'      => array_merge( $common, $tablealign ),
1408                         'tfoot'      => array_merge( $common, $tablealign ),
1409                         'tbody'      => array_merge( $common, $tablealign ),
1410
1411                         # 11.2.4
1412                         'colgroup'   => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1413                         'col'        => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1414
1415                         # 11.2.5
1416                         'tr'         => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1417
1418                         # 11.2.6
1419                         'td'         => array_merge( $common, $tablecell, $tablealign ),
1420                         'th'         => array_merge( $common, $tablecell, $tablealign ),
1421
1422                         # 12.2 # NOTE: <a> is not allowed directly, but the attrib whitelist is used from the Parser object
1423                         'a'          => array_merge( $common, array( 'href', 'rel', 'rev' ) ), # rel/rev esp. for RDFa
1424
1425                         # 13.2
1426                         # Not usually allowed, but may be used for extension-style hooks
1427                         # such as <math> when it is rasterized, or if $wgAllowImageTag is
1428                         # true
1429                         'img'        => array_merge( $common, array( 'alt', 'src', 'width', 'height' ) ),
1430
1431                         # 15.2.1
1432                         'tt'         => $common,
1433                         'b'          => $common,
1434                         'i'          => $common,
1435                         'big'        => $common,
1436                         'small'      => $common,
1437                         'strike'     => $common,
1438                         's'          => $common,
1439                         'u'          => $common,
1440
1441                         # 15.2.2
1442                         'font'       => array_merge( $common, array( 'size', 'color', 'face' ) ),
1443                         # basefont
1444
1445                         # 15.3
1446                         'hr'         => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1447
1448                         # XHTML Ruby annotation text module, simple ruby only.
1449                         # http://www.w3c.org/TR/ruby/
1450                         'ruby'       => $common,
1451                         # rbc
1452                         # rtc
1453                         'rb'         => $common,
1454                         'rt'         => $common, #array_merge( $common, array( 'rbspan' ) ),
1455                         'rp'         => $common,
1456
1457                         # MathML root element, where used for extensions
1458                         # 'title' may not be 100% valid here; it's XHTML
1459                         # http://www.w3.org/TR/REC-MathML/
1460                         'math'       => array( 'class', 'style', 'id', 'title' ),
1461                         );
1462                 return $whitelist;
1463         }
1464
1465         /**
1466          * Take a fragment of (potentially invalid) HTML and return
1467          * a version with any tags removed, encoded as plain text.
1468          *
1469          * Warning: this return value must be further escaped for literal
1470          * inclusion in HTML output as of 1.10!
1471          *
1472          * @param $text String: HTML fragment
1473          * @return String
1474          */
1475         static function stripAllTags( $text ) {
1476                 # Actual <tags>
1477                 $text = StringUtils::delimiterReplace( '<', '>', '', $text );
1478
1479                 # Normalize &entities and whitespace
1480                 $text = self::decodeCharReferences( $text );
1481                 $text = self::normalizeWhitespace( $text );
1482
1483                 return $text;
1484         }
1485
1486         /**
1487          * Hack up a private DOCTYPE with HTML's standard entity declarations.
1488          * PHP 4 seemed to know these if you gave it an HTML doctype, but
1489          * PHP 5.1 doesn't.
1490          *
1491          * Use for passing XHTML fragments to PHP's XML parsing functions
1492          *
1493          * @return String
1494          */
1495         static function hackDocType() {
1496                 global $wgHtmlEntities;
1497                 $out = "<!DOCTYPE html [\n";
1498                 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1499                         $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1500                 }
1501                 $out .= "]>\n";
1502                 return $out;
1503         }
1504
1505         static function cleanUrl( $url ) {
1506                 # Normalize any HTML entities in input. They will be
1507                 # re-escaped by makeExternalLink().
1508                 $url = Sanitizer::decodeCharReferences( $url );
1509
1510                 # Escape any control characters introduced by the above step
1511                 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F\|]/e', "urlencode('\\0')", $url );
1512
1513                 # Validate hostname portion
1514                 $matches = array();
1515                 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1516                         list( /* $whole */, $protocol, $host, $rest ) = $matches;
1517
1518                         // Characters that will be ignored in IDNs.
1519                         // http://tools.ietf.org/html/3454#section-3.1
1520                         // Strip them before further processing so blacklists and such work.
1521                         $strip = "/
1522                                 \\s|          # general whitespace
1523                                 \xc2\xad|     # 00ad SOFT HYPHEN
1524                                 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1525                                 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1526                                 \xe2\x81\xa0| # 2060 WORD JOINER
1527                                 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1528                                 \xcd\x8f|     # 034f COMBINING GRAPHEME JOINER
1529                                 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1530                                 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1531                                 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1532                                 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1533                                 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1534                                 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1535                                 /xuD";
1536
1537                         $host = preg_replace( $strip, '', $host );
1538
1539                         // @todo Fixme: validate hostnames here
1540
1541                         return $protocol . $host . $rest;
1542                 } else {
1543                         return $url;
1544                 }
1545         }
1546
1547 }