3 * XHTML sanitizer for MediaWiki
5 * Copyright (C) 2002-2005 Brion Vibber <brion@pobox.com> et al
6 * http://www.mediawiki.org/
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
21 * http://www.gnu.org/copyleft/gpl.html
27 * Regular expression to match various types of character references in
28 * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
30 define( 'MW_CHAR_REFS_REGEX',
38 * Regular expression to match HTML/XML attribute pairs within a tag.
39 * Allows some... latitude.
40 * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
42 $attrib = '[A-Za-z0-9]';
43 $space = '[\x09\x0a\x0d\x20]';
44 define( 'MW_ATTRIBS_REGEX',
45 "/(?:^|$space)($attrib+)
48 # The attribute value: quoted or alone
51 | ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
52 | (\#[0-9a-fA-F]+) # Technically wrong, but lots of
53 # colors are specified like this.
54 # We'll be normalizing it.
56 )?(?=$space|\$)/sx" );
59 * List of all named character entities defined in HTML 4.01
60 * http://www.w3.org/TR/html4/sgml/entities.html
63 global $wgHtmlEntities;
64 $wgHtmlEntities = array(
320 * Cleans up HTML, removes dangerous tags and attributes, and
321 * removes HTML comments
323 * @param string $text
324 * @param callback $processCallback to do any variable or parameter replacements in HTML attribute values
325 * @param array $args for the processing callback
328 static function removeHTMLtags( $text, $processCallback = null, $args = array() ) {
329 global $wgUseTidy, $wgUserHtml;
331 static $htmlpairs, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
332 $htmllist, $listtags, $htmlsingleallowed, $htmlelements, $staticInitialised;
334 wfProfileIn( __METHOD__
);
336 if ( !$staticInitialised ) {
338 $htmlpairs = array( # Tags that must be closed
339 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
340 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
341 'strike', 'strong', 'tt', 'var', 'div', 'center',
342 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
343 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u'
346 'br', 'hr', 'li', 'dt', 'dd'
348 $htmlsingleonly = array( # Elements that cannot have close tags
351 $htmlnest = array( # Tags that can be nested--??
352 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
353 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
355 $tabletags = array( # Can only appear inside table, we will close them
358 $htmllist = array( # Tags used by list
361 $listtags = array( # Tags that can appear in a list
366 $htmlpairs = array();
367 $htmlsingle = array();
369 $tabletags = array();
372 $htmlsingleallowed = array_merge( $htmlsingle, $tabletags );
373 $htmlelements = array_merge( $htmlsingle, $htmlpairs, $htmlnest );
375 # Convert them all to hashtables for faster lookup
376 $vars = array( 'htmlpairs', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
377 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelements' );
378 foreach ( $vars as $var ) {
379 $
$var = array_flip( $
$var );
381 $staticInitialised = true;
384 # Remove HTML comments
385 $text = Sanitizer
::removeHTMLcomments( $text );
386 $bits = explode( '<', $text );
387 $text = str_replace( '>', '>', array_shift( $bits ) );
389 $tagstack = $tablestack = array();
390 foreach ( $bits as $x ) {
392 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
393 list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
395 $slash = $t = $params = $brace = $rest = null;
399 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
403 if( isset( $htmlsingleonly[$t] ) ) {
405 } elseif ( ( $ot = @array_pop
( $tagstack ) ) != $t ) {
406 if ( isset( $htmlsingleallowed[$ot] ) ) {
407 # Pop all elements with an optional close tag
408 # and see if we find a match below them
410 array_push ($optstack, $ot);
411 while ( ( ( $ot = @array_pop
( $tagstack ) ) != $t ) &&
412 isset( $htmlsingleallowed[$ot] ) )
414 array_push ($optstack, $ot);
417 # No match. Push the optinal elements back again
419 while ( $ot = @array_pop
( $optstack ) ) {
420 array_push( $tagstack, $ot );
424 @array_push
( $tagstack, $ot );
425 # <li> can be nested in <ul> or <ol>, skip those cases:
426 if(!(isset( $htmllist[$ot] ) && isset( $listtags[$t] ) )) {
431 if ( $t == 'table' ) {
432 $tagstack = array_pop( $tablestack );
437 # Keep track for later
438 if ( isset( $tabletags[$t] ) &&
439 ! in_array( 'table', $tagstack ) ) {
441 } else if ( in_array( $t, $tagstack ) &&
442 ! isset( $htmlnest [$t ] ) ) {
444 #Â Is it a self closed htmlpair ? (bug 5487)
445 } else if( $brace == '/>' &&
446 isset( $htmlpairs[$t] ) ) {
448 } elseif( isset( $htmlsingleonly[$t] ) ) {
449 # Hack to force empty tag for uncloseable elements
451 } else if( isset( $htmlsingle[$t] ) ) {
452 # Hack to not close $htmlsingle tags
454 } else if( isset( $tabletags[$t] )
455 && in_array($t ,$tagstack) ) {
456 // New table tag but forgot to close the previous one
459 if ( $t == 'table' ) {
460 array_push( $tablestack, $tagstack );
463 array_push( $tagstack, $t );
466 # Replace any variables or template parameters with
468 if( is_callable( $processCallback ) ) {
469 call_user_func_array( $processCallback, array( &$params, $args ) );
472 # Strip non-approved attributes from the tag
473 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
476 $rest = str_replace( '>', '>', $rest );
477 $close = ( $brace == '/>' && !$slash ) ?
' /' : '';
478 $text .= "<$slash$t$newparams$close>$rest";
482 $text .= '<' . str_replace( '>', '>', $x);
484 # Close off any remaining tags
485 while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
487 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
490 # this might be possible using tidy itself
491 foreach ( $bits as $x ) {
492 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
494 @list
( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
495 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
496 if( is_callable( $processCallback ) ) {
497 call_user_func_array( $processCallback, array( &$params, $args ) );
499 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
500 $rest = str_replace( '>', '>', $rest );
501 $text .= "<$slash$t$newparams$brace$rest";
503 $text .= '<' . str_replace( '>', '>', $x);
507 wfProfileOut( __METHOD__
);
512 * Remove '<!--', '-->', and everything between.
513 * To avoid leaving blank lines, when a comment is both preceded
514 * and followed by a newline (ignoring spaces), trim leading and
515 * trailing spaces and one of the newlines.
518 * @param string $text
521 static function removeHTMLcomments( $text ) {
522 wfProfileIn( __METHOD__
);
523 while (($start = strpos($text, '<!--')) !== false) {
524 $end = strpos($text, '-->', $start +
4);
525 if ($end === false) {
526 # Unterminated comment; bail out
532 # Trim space and newline if the comment is both
533 # preceded and followed by a newline
534 $spaceStart = max($start - 1, 0);
535 $spaceLen = $end - $spaceStart;
536 while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
540 while (substr($text, $spaceStart +
$spaceLen, 1) === ' ')
542 if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart +
$spaceLen, 1) === "\n") {
543 # Remove the comment, leading and trailing
544 # spaces, and leave only one newline.
545 $text = substr_replace($text, "\n", $spaceStart, $spaceLen +
1);
548 # Remove just the comment.
549 $text = substr_replace($text, '', $start, $end - $start);
552 wfProfileOut( __METHOD__
);
557 * Take an array of attribute names and values and normalize or discard
558 * illegal values for the given element type.
560 * - Discards attributes not on a whitelist for the given element
561 * - Unsafe style attributes are discarded
563 * @param array $attribs
564 * @param string $element
567 * @todo Check for legal values where the DTD limits things.
568 * @todo Check for unique id attribute :P
570 static function validateTagAttributes( $attribs, $element ) {
571 $whitelist = array_flip( Sanitizer
::attributeWhitelist( $element ) );
573 foreach( $attribs as $attribute => $value ) {
574 if( !isset( $whitelist[$attribute] ) ) {
577 # Strip javascript "expression" from stylesheets.
578 # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
579 if( $attribute == 'style' ) {
580 $value = Sanitizer
::checkCss( $value );
581 if( $value === false ) {
587 if ( $attribute === 'id' )
588 $value = Sanitizer
::escapeId( $value );
590 // If this attribute was previously set, override it.
591 // Output should only have one attribute of each name.
592 $out[$attribute] = $value;
598 * Pick apart some CSS and check it for forbidden or unsafe structures.
599 * Returns a sanitized string, or false if it was just too evil.
601 * Currently URL references, 'expression', 'tps' are forbidden.
603 * @param string $value
606 static function checkCss( $value ) {
607 $stripped = Sanitizer
::decodeCharReferences( $value );
609 // Remove any comments; IE gets token splitting wrong
610 $stripped = StringUtils
::delimiterReplace( '/*', '*/', ' ', $stripped );
614 // ... and continue checks
615 $stripped = preg_replace( '!\\\\([0-9A-Fa-f]{1,6})[ \\n\\r\\t\\f]?!e',
616 'codepointToUtf8(hexdec("$1"))', $stripped );
617 $stripped = str_replace( '\\', '', $stripped );
618 if( preg_match( '/(expression|tps*:\/\/|url\\s*\().*/is',
628 * Take a tag soup fragment listing an HTML element's attributes
629 * and normalize it to well-formed XML, discarding unwanted attributes.
630 * Output is safe for further wikitext processing, with escaping of
631 * values that could trigger problems.
633 * - Normalizes attribute names to lowercase
634 * - Discards attributes not on a whitelist for the given element
635 * - Turns broken or invalid entities into plaintext
636 * - Double-quotes all attribute values
637 * - Attributes without values are given the name as attribute
638 * - Double attributes are discarded
639 * - Unsafe style attributes are discarded
640 * - Prepends space if there are attributes.
642 * @param string $text
643 * @param string $element
646 static function fixTagAttributes( $text, $element ) {
647 if( trim( $text ) == '' ) {
651 $stripped = Sanitizer
::validateTagAttributes(
652 Sanitizer
::decodeTagAttributes( $text ), $element );
655 foreach( $stripped as $attribute => $value ) {
656 $encAttribute = htmlspecialchars( $attribute );
657 $encValue = Sanitizer
::safeEncodeAttribute( $value );
659 $attribs[] = "$encAttribute=\"$encValue\"";
661 return count( $attribs ) ?
' ' . implode( ' ', $attribs ) : '';
665 * Encode an attribute value for HTML output.
667 * @return HTML-encoded text fragment
669 static function encodeAttribute( $text ) {
670 $encValue = htmlspecialchars( $text );
672 // Whitespace is normalized during attribute decoding,
673 // so if we've been passed non-spaces we must encode them
674 // ahead of time or they won't be preserved.
675 $encValue = strtr( $encValue, array(
685 * Encode an attribute value for HTML tags, with extra armoring
686 * against further wiki processing.
688 * @return HTML-encoded text fragment
690 static function safeEncodeAttribute( $text ) {
691 $encValue = Sanitizer
::encodeAttribute( $text );
693 # Templates and links may be expanded in later parsing,
694 # creating invalid or dangerous output. Suppress this.
695 $encValue = strtr( $encValue, array(
696 '<' => '<', // This should never happen,
697 '>' => '>', // we've received invalid input
698 '"' => '"', // which should have been escaped.
701 "''" => '''',
702 'ISBN' => 'ISBN',
704 'PMID' => 'PMID',
710 $encValue = preg_replace_callback(
711 '/(' . wfUrlProtocols() . ')/',
712 array( 'Sanitizer', 'armorLinksCallback' ),
718 * Given a value escape it so that it can be used in an id attribute and
719 * return it, this does not validate the value however (see first link)
721 * @link http://www.w3.org/TR/html401/types.html#type-name Valid characters
724 * @link http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
733 static function escapeId( $id ) {
734 static $replace = array(
739 $id = urlencode( Sanitizer
::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
741 return str_replace( array_keys( $replace ), array_values( $replace ), $id );
745 * Given a value, escape it so that it can be used as a CSS class and
748 * @todo For extra validity, input should be validated UTF-8.
750 * @link http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
752 * @param string $class
755 static function escapeClass( $class ) {
756 // Convert ugly stuff to underscores and kill underscores in ugly places
757 return rtrim(preg_replace(
758 array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
764 * Regex replace callback for armoring links against further processing.
765 * @param array $matches
769 private static function armorLinksCallback( $matches ) {
770 return str_replace( ':', ':', $matches[1] );
774 * Return an associative array of attribute names and values from
775 * a partial tag string. Attribute names are forces to lowercase,
776 * character references are decoded to UTF-8 text.
781 static function decodeTagAttributes( $text ) {
784 if( trim( $text ) == '' ) {
797 foreach( $pairs as $set ) {
798 $attribute = strtolower( $set[1] );
799 $value = Sanitizer
::getTagAttributeCallback( $set );
801 // Normalize whitespace
802 $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
803 $value = trim( $value );
805 // Decode character references
806 $attribs[$attribute] = Sanitizer
::decodeCharReferences( $value );
812 * Pick the appropriate attribute value from a match set from the
813 * MW_ATTRIBS_REGEX matches.
819 private static function getTagAttributeCallback( $set ) {
820 if( isset( $set[6] ) ) {
821 # Illegal #XXXXXX color with no quotes.
823 } elseif( isset( $set[5] ) ) {
826 } elseif( isset( $set[4] ) ) {
829 } elseif( isset( $set[3] ) ) {
832 } elseif( !isset( $set[2] ) ) {
833 # In XHTML, attributes must have a value.
834 # For 'reduced' form, return explicitly the attribute name here.
837 throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
842 * Normalize whitespace and character references in an XML source-
843 * encoded text for an attribute value.
845 * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
846 * but note that we're not returning the value, but are returning
847 * XML source fragments that will be slapped into output.
849 * @param string $text
853 private static function normalizeAttributeValue( $text ) {
854 return str_replace( '"', '"',
856 '/\r\n|[\x20\x0d\x0a\x09]/',
858 Sanitizer
::normalizeCharReferences( $text ) ) );
862 * Ensure that any entities and character references are legal
863 * for XML and XHTML specifically. Any stray bits will be
864 * &-escaped to result in a valid text fragment.
866 * a. any named char refs must be known in XHTML
867 * b. any numeric char refs must be legal chars, not invalid or forbidden
868 * c. use &#x, not &#X
869 * d. fix or reject non-valid attributes
871 * @param string $text
875 static function normalizeCharReferences( $text ) {
876 return preg_replace_callback(
878 array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
882 * @param string $matches
885 static function normalizeCharReferencesCallback( $matches ) {
887 if( $matches[1] != '' ) {
888 $ret = Sanitizer
::normalizeEntity( $matches[1] );
889 } elseif( $matches[2] != '' ) {
890 $ret = Sanitizer
::decCharReference( $matches[2] );
891 } elseif( $matches[3] != '' ) {
892 $ret = Sanitizer
::hexCharReference( $matches[3] );
893 } elseif( $matches[4] != '' ) {
894 $ret = Sanitizer
::hexCharReference( $matches[4] );
896 if( is_null( $ret ) ) {
897 return htmlspecialchars( $matches[0] );
904 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
905 * return the named entity reference as is. Otherwise, returns
906 * HTML-escaped text of pseudo-entity source (eg &foo;)
908 * @param string $name
912 static function normalizeEntity( $name ) {
913 global $wgHtmlEntities;
914 if( isset( $wgHtmlEntities[$name] ) ) {
917 return "&$name;";
921 static function decCharReference( $codepoint ) {
922 $point = intval( $codepoint );
923 if( Sanitizer
::validateCodepoint( $point ) ) {
924 return sprintf( '&#%d;', $point );
930 static function hexCharReference( $codepoint ) {
931 $point = hexdec( $codepoint );
932 if( Sanitizer
::validateCodepoint( $point ) ) {
933 return sprintf( '&#x%x;', $point );
940 * Returns true if a given Unicode codepoint is a valid character in XML.
941 * @param int $codepoint
944 private static function validateCodepoint( $codepoint ) {
945 return ($codepoint == 0x09)
946 ||
($codepoint == 0x0a)
947 ||
($codepoint == 0x0d)
948 ||
($codepoint >= 0x20 && $codepoint <= 0xd7ff)
949 ||
($codepoint >= 0xe000 && $codepoint <= 0xfffd)
950 ||
($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
954 * Decode any character references, numeric or named entities,
955 * in the text and return a UTF-8 string.
957 * @param string $text
962 public static function decodeCharReferences( $text ) {
963 return preg_replace_callback(
965 array( 'Sanitizer', 'decodeCharReferencesCallback' ),
970 * @param string $matches
973 static function decodeCharReferencesCallback( $matches ) {
974 if( $matches[1] != '' ) {
975 return Sanitizer
::decodeEntity( $matches[1] );
976 } elseif( $matches[2] != '' ) {
977 return Sanitizer
::decodeChar( intval( $matches[2] ) );
978 } elseif( $matches[3] != '' ) {
979 return Sanitizer
::decodeChar( hexdec( $matches[3] ) );
980 } elseif( $matches[4] != '' ) {
981 return Sanitizer
::decodeChar( hexdec( $matches[4] ) );
983 # Last case should be an ampersand by itself
988 * Return UTF-8 string for a codepoint if that is a valid
989 * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
990 * @param int $codepoint
994 static function decodeChar( $codepoint ) {
995 if( Sanitizer
::validateCodepoint( $codepoint ) ) {
996 return codepointToUtf8( $codepoint );
998 return UTF8_REPLACEMENT
;
1003 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1004 * return the UTF-8 encoding of that character. Otherwise, returns
1005 * pseudo-entity source (eg &foo;)
1007 * @param string $name
1010 static function decodeEntity( $name ) {
1011 global $wgHtmlEntities;
1012 if( isset( $wgHtmlEntities[$name] ) ) {
1013 return codepointToUtf8( $wgHtmlEntities[$name] );
1020 * Fetch the whitelist of acceptable attributes for a given
1023 * @param string $element
1026 static function attributeWhitelist( $element ) {
1028 if( !isset( $list ) ) {
1029 $list = Sanitizer
::setupAttributeWhitelist();
1031 return isset( $list[$element] )
1037 * @todo Document it a bit
1040 static function setupAttributeWhitelist() {
1041 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );
1042 $block = array_merge( $common, array( 'align' ) );
1043 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1044 $tablecell = array( 'abbr',
1050 'nowrap', # deprecated
1051 'width', # deprecated
1052 'height', # deprecated
1053 'bgcolor' # deprecated
1056 # Numbers refer to sections in HTML 4.01 standard describing the element.
1057 # See: http://www.w3.org/TR/html4/
1058 $whitelist = array (
1061 'center' => $common, # deprecated
1062 'span' => $block, # ??
1080 'strong' => $common,
1091 'blockquote' => array_merge( $common, array( 'cite' ) ),
1102 'br' => array( 'id', 'class', 'title', 'style', 'clear' ),
1105 'pre' => array_merge( $common, array( 'width' ) ),
1108 'ins' => array_merge( $common, array( 'cite', 'datetime' ) ),
1109 'del' => array_merge( $common, array( 'cite', 'datetime' ) ),
1112 'ul' => array_merge( $common, array( 'type' ) ),
1113 'ol' => array_merge( $common, array( 'type', 'start' ) ),
1114 'li' => array_merge( $common, array( 'type', 'value' ) ),
1122 'table' => array_merge( $common,
1123 array( 'summary', 'width', 'border', 'frame',
1124 'rules', 'cellspacing', 'cellpadding',
1129 'caption' => array_merge( $common, array( 'align' ) ),
1132 'thead' => array_merge( $common, $tablealign ),
1133 'tfoot' => array_merge( $common, $tablealign ),
1134 'tbody' => array_merge( $common, $tablealign ),
1137 'colgroup' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1138 'col' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1141 'tr' => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1144 'td' => array_merge( $common, $tablecell, $tablealign ),
1145 'th' => array_merge( $common, $tablecell, $tablealign ),
1153 'strike' => $common,
1158 'font' => array_merge( $common, array( 'size', 'color', 'face' ) ),
1162 'hr' => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1164 # XHTML Ruby annotation text module, simple ruby only.
1165 # http://www.w3c.org/TR/ruby/
1170 'rt' => $common, #array_merge( $common, array( 'rbspan' ) ),
1177 * Take a fragment of (potentially invalid) HTML and return
1178 * a version with any tags removed, encoded suitably for literal
1179 * inclusion in an attribute value.
1181 * @param string $text HTML fragment
1184 static function stripAllTags( $text ) {
1186 $text = StringUtils
::delimiterReplace( '<', '>', '', $text );
1188 # Normalize &entities and whitespace
1189 $text = Sanitizer
::normalizeAttributeValue( $text );
1191 # Will be placed into "double-quoted" attributes,
1192 # make sure remaining bits are safe.
1193 $text = str_replace(
1194 array('<', '>', '"'),
1195 array('<', '>', '"'),
1202 * Hack up a private DOCTYPE with HTML's standard entity declarations.
1203 * PHP 4 seemed to know these if you gave it an HTML doctype, but
1206 * Use for passing XHTML fragments to PHP's XML parsing functions
1211 static function hackDocType() {
1212 global $wgHtmlEntities;
1213 $out = "<!DOCTYPE html [\n";
1214 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1215 $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1221 static function cleanUrl( $url, $hostname=true ) {
1222 # Normalize any HTML entities in input. They will be
1223 # re-escaped by makeExternalLink().
1224 $url = Sanitizer
::decodeCharReferences( $url );
1226 # Escape any control characters introduced by the above step
1227 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F]/e', "urlencode('\\0')", $url );
1229 # Validate hostname portion
1231 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1232 list( /* $whole */, $protocol, $host, $rest ) = $matches;
1234 // Characters that will be ignored in IDNs.
1235 // http://tools.ietf.org/html/3454#section-3.1
1236 // Strip them before further processing so blacklists and such work.
1238 \\s| # general whitespace
1239 \xc2\xad| # 00ad SOFT HYPHEN
1240 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1241 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1242 \xe2\x81\xa0| # 2060 WORD JOINER
1243 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1244 \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
1245 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1246 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1247 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1248 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1249 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1250 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1253 $host = preg_replace( $strip, '', $host );
1255 // @fixme: validate hostnames here
1257 return $protocol . $host . $rest;