3 * XHTML sanitizer for MediaWiki
5 * Copyright (C) 2002-2005 Brion Vibber <brion@pobox.com> et al
6 * http://www.mediawiki.org/
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
21 * http://www.gnu.org/copyleft/gpl.html
27 * Regular expression to match various types of character references in
28 * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
30 define( 'MW_CHAR_REFS_REGEX',
31 '/&([A-Za-z0-9\x80-\xff]+);
38 * Regular expression to match HTML/XML attribute pairs within a tag.
39 * Allows some... latitude.
40 * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
42 $attrib = '[A-Za-z0-9]';
43 $space = '[\x09\x0a\x0d\x20]';
44 define( 'MW_ATTRIBS_REGEX',
45 "/(?:^|$space)($attrib+)
48 # The attribute value: quoted or alone
51 | ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
52 | (\#[0-9a-fA-F]+) # Technically wrong, but lots of
53 # colors are specified like this.
54 # We'll be normalizing it.
56 )?(?=$space|\$)/sx" );
59 * List of all named character entities defined in HTML 4.01
60 * http://www.w3.org/TR/html4/sgml/entities.html
63 global $wgHtmlEntities;
64 $wgHtmlEntities = array(
319 * Character entity aliases accepted by MediaWiki
321 global $wgHtmlEntityAliases;
322 $wgHtmlEntityAliases = array(
329 * XHTML sanitizer for MediaWiki
334 * Cleans up HTML, removes dangerous tags and attributes, and
335 * removes HTML comments
337 * @param string $text
338 * @param callback $processCallback to do any variable or parameter replacements in HTML attribute values
339 * @param array $args for the processing callback
342 static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array() ) {
345 static $htmlpairs, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
346 $htmllist, $listtags, $htmlsingleallowed, $htmlelements, $staticInitialised;
348 wfProfileIn( __METHOD__
);
350 if ( !$staticInitialised ) {
352 $htmlpairs = array_merge( $extratags, array( # Tags that must be closed
353 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
354 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
355 'strike', 'strong', 'tt', 'var', 'div', 'center',
356 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
357 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u'
360 'br', 'hr', 'li', 'dt', 'dd'
362 $htmlsingleonly = array( # Elements that cannot have close tags
365 $htmlnest = array( # Tags that can be nested--??
366 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
367 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
369 $tabletags = array( # Can only appear inside table, we will close them
372 $htmllist = array( # Tags used by list
375 $listtags = array( # Tags that can appear in a list
379 $htmlsingleallowed = array_merge( $htmlsingle, $tabletags );
380 $htmlelements = array_merge( $htmlsingle, $htmlpairs, $htmlnest );
382 # Convert them all to hashtables for faster lookup
383 $vars = array( 'htmlpairs', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
384 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelements' );
385 foreach ( $vars as $var ) {
386 $
$var = array_flip( $
$var );
388 $staticInitialised = true;
391 # Remove HTML comments
392 $text = Sanitizer
::removeHTMLcomments( $text );
393 $bits = explode( '<', $text );
394 $text = str_replace( '>', '>', array_shift( $bits ) );
396 $tagstack = $tablestack = array();
397 foreach ( $bits as $x ) {
399 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
400 list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
402 $slash = $t = $params = $brace = $rest = null;
406 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
410 if( isset( $htmlsingleonly[$t] ) ) {
412 } elseif ( ( $ot = @array_pop
( $tagstack ) ) != $t ) {
413 if ( isset( $htmlsingleallowed[$ot] ) ) {
414 # Pop all elements with an optional close tag
415 # and see if we find a match below them
417 array_push ($optstack, $ot);
418 while ( ( ( $ot = @array_pop
( $tagstack ) ) != $t ) &&
419 isset( $htmlsingleallowed[$ot] ) )
421 array_push ($optstack, $ot);
424 # No match. Push the optinal elements back again
426 while ( $ot = @array_pop
( $optstack ) ) {
427 array_push( $tagstack, $ot );
431 @array_push
( $tagstack, $ot );
432 # <li> can be nested in <ul> or <ol>, skip those cases:
433 if(!(isset( $htmllist[$ot] ) && isset( $listtags[$t] ) )) {
438 if ( $t == 'table' ) {
439 $tagstack = array_pop( $tablestack );
444 # Keep track for later
445 if ( isset( $tabletags[$t] ) &&
446 ! in_array( 'table', $tagstack ) ) {
448 } else if ( in_array( $t, $tagstack ) &&
449 ! isset( $htmlnest [$t ] ) ) {
451 #Â Is it a self closed htmlpair ? (bug 5487)
452 } else if( $brace == '/>' &&
453 isset( $htmlpairs[$t] ) ) {
455 } elseif( isset( $htmlsingleonly[$t] ) ) {
456 # Hack to force empty tag for uncloseable elements
458 } else if( isset( $htmlsingle[$t] ) ) {
459 # Hack to not close $htmlsingle tags
461 } else if( isset( $tabletags[$t] )
462 && in_array($t ,$tagstack) ) {
463 // New table tag but forgot to close the previous one
466 if ( $t == 'table' ) {
467 array_push( $tablestack, $tagstack );
470 array_push( $tagstack, $t );
473 # Replace any variables or template parameters with
475 if( is_callable( $processCallback ) ) {
476 call_user_func_array( $processCallback, array( &$params, $args ) );
479 # Strip non-approved attributes from the tag
480 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
483 $rest = str_replace( '>', '>', $rest );
484 $close = ( $brace == '/>' && !$slash ) ?
' /' : '';
485 $text .= "<$slash$t$newparams$close>$rest";
489 $text .= '<' . str_replace( '>', '>', $x);
491 # Close off any remaining tags
492 while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
494 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
497 # this might be possible using tidy itself
498 foreach ( $bits as $x ) {
499 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
501 @list
( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
502 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
503 if( is_callable( $processCallback ) ) {
504 call_user_func_array( $processCallback, array( &$params, $args ) );
506 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
507 $rest = str_replace( '>', '>', $rest );
508 $text .= "<$slash$t$newparams$brace$rest";
510 $text .= '<' . str_replace( '>', '>', $x);
514 wfProfileOut( __METHOD__
);
519 * Remove '<!--', '-->', and everything between.
520 * To avoid leaving blank lines, when a comment is both preceded
521 * and followed by a newline (ignoring spaces), trim leading and
522 * trailing spaces and one of the newlines.
525 * @param string $text
528 static function removeHTMLcomments( $text ) {
529 wfProfileIn( __METHOD__
);
530 while (($start = strpos($text, '<!--')) !== false) {
531 $end = strpos($text, '-->', $start +
4);
532 if ($end === false) {
533 # Unterminated comment; bail out
539 # Trim space and newline if the comment is both
540 # preceded and followed by a newline
541 $spaceStart = max($start - 1, 0);
542 $spaceLen = $end - $spaceStart;
543 while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
547 while (substr($text, $spaceStart +
$spaceLen, 1) === ' ')
549 if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart +
$spaceLen, 1) === "\n") {
550 # Remove the comment, leading and trailing
551 # spaces, and leave only one newline.
552 $text = substr_replace($text, "\n", $spaceStart, $spaceLen +
1);
555 # Remove just the comment.
556 $text = substr_replace($text, '', $start, $end - $start);
559 wfProfileOut( __METHOD__
);
564 * Take an array of attribute names and values and normalize or discard
565 * illegal values for the given element type.
567 * - Discards attributes not on a whitelist for the given element
568 * - Unsafe style attributes are discarded
569 * - Invalid id attributes are reencoded
571 * @param array $attribs
572 * @param string $element
575 * @todo Check for legal values where the DTD limits things.
576 * @todo Check for unique id attribute :P
578 static function validateTagAttributes( $attribs, $element ) {
579 return Sanitizer
::validateAttributes( $attribs,
580 Sanitizer
::attributeWhitelist( $element ) );
584 * Take an array of attribute names and values and normalize or discard
585 * illegal values for the given whitelist.
587 * - Discards attributes not the given whitelist
588 * - Unsafe style attributes are discarded
589 * - Invalid id attributes are reencoded
591 * @param array $attribs
592 * @param array $whitelist list of allowed attribute names
595 * @todo Check for legal values where the DTD limits things.
596 * @todo Check for unique id attribute :P
598 static function validateAttributes( $attribs, $whitelist ) {
599 $whitelist = array_flip( $whitelist );
601 foreach( $attribs as $attribute => $value ) {
602 if( !isset( $whitelist[$attribute] ) ) {
605 # Strip javascript "expression" from stylesheets.
606 # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
607 if( $attribute == 'style' ) {
608 $value = Sanitizer
::checkCss( $value );
609 if( $value === false ) {
615 if ( $attribute === 'id' )
616 $value = Sanitizer
::escapeId( $value );
618 // If this attribute was previously set, override it.
619 // Output should only have one attribute of each name.
620 $out[$attribute] = $value;
626 * Merge two sets of HTML attributes.
627 * Conflicting items in the second set will override those
628 * in the first, except for 'class' attributes which will be
631 * @todo implement merging for other attributes such as style
636 static function mergeAttributes( $a, $b ) {
637 $out = array_merge( $a, $b );
638 if( isset( $a['class'] )
639 && isset( $b['class'] )
640 && $a['class'] !== $b['class'] ) {
642 $out['class'] = implode( ' ',
645 $a['class'] . ' ' . $b['class'],
647 PREG_SPLIT_NO_EMPTY
) ) );
653 * Pick apart some CSS and check it for forbidden or unsafe structures.
654 * Returns a sanitized string, or false if it was just too evil.
656 * Currently URL references, 'expression', 'tps' are forbidden.
658 * @param string $value
661 static function checkCss( $value ) {
662 $stripped = Sanitizer
::decodeCharReferences( $value );
664 // Remove any comments; IE gets token splitting wrong
665 $stripped = StringUtils
::delimiterReplace( '/*', '*/', ' ', $stripped );
669 // ... and continue checks
670 $stripped = preg_replace( '!\\\\([0-9A-Fa-f]{1,6})[ \\n\\r\\t\\f]?!e',
671 'codepointToUtf8(hexdec("$1"))', $stripped );
672 $stripped = str_replace( '\\', '', $stripped );
673 if( preg_match( '/(?:expression|tps*:\/\/|url\\s*\().*/is',
683 * Take a tag soup fragment listing an HTML element's attributes
684 * and normalize it to well-formed XML, discarding unwanted attributes.
685 * Output is safe for further wikitext processing, with escaping of
686 * values that could trigger problems.
688 * - Normalizes attribute names to lowercase
689 * - Discards attributes not on a whitelist for the given element
690 * - Turns broken or invalid entities into plaintext
691 * - Double-quotes all attribute values
692 * - Attributes without values are given the name as attribute
693 * - Double attributes are discarded
694 * - Unsafe style attributes are discarded
695 * - Prepends space if there are attributes.
697 * @param string $text
698 * @param string $element
701 static function fixTagAttributes( $text, $element ) {
702 if( trim( $text ) == '' ) {
706 $stripped = Sanitizer
::validateTagAttributes(
707 Sanitizer
::decodeTagAttributes( $text ), $element );
710 foreach( $stripped as $attribute => $value ) {
711 $encAttribute = htmlspecialchars( $attribute );
712 $encValue = Sanitizer
::safeEncodeAttribute( $value );
714 $attribs[] = "$encAttribute=\"$encValue\"";
716 return count( $attribs ) ?
' ' . implode( ' ', $attribs ) : '';
720 * Encode an attribute value for HTML output.
722 * @return HTML-encoded text fragment
724 static function encodeAttribute( $text ) {
725 $encValue = htmlspecialchars( $text );
727 // Whitespace is normalized during attribute decoding,
728 // so if we've been passed non-spaces we must encode them
729 // ahead of time or they won't be preserved.
730 $encValue = strtr( $encValue, array(
740 * Encode an attribute value for HTML tags, with extra armoring
741 * against further wiki processing.
743 * @return HTML-encoded text fragment
745 static function safeEncodeAttribute( $text ) {
746 $encValue = Sanitizer
::encodeAttribute( $text );
748 # Templates and links may be expanded in later parsing,
749 # creating invalid or dangerous output. Suppress this.
750 $encValue = strtr( $encValue, array(
751 '<' => '<', // This should never happen,
752 '>' => '>', // we've received invalid input
753 '"' => '"', // which should have been escaped.
756 "''" => '''',
757 'ISBN' => 'ISBN',
759 'PMID' => 'PMID',
765 $encValue = preg_replace_callback(
766 '/(' . wfUrlProtocols() . ')/',
767 array( 'Sanitizer', 'armorLinksCallback' ),
773 * Given a value escape it so that it can be used in an id attribute and
774 * return it, this does not validate the value however (see first link)
776 * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters
779 * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
786 static function escapeId( $id ) {
787 static $replace = array(
792 $id = urlencode( Sanitizer
::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
794 return str_replace( array_keys( $replace ), array_values( $replace ), $id );
798 * Given a value, escape it so that it can be used as a CSS class and
801 * @todo For extra validity, input should be validated UTF-8.
803 * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
805 * @param string $class
808 static function escapeClass( $class ) {
809 // Convert ugly stuff to underscores and kill underscores in ugly places
810 return rtrim(preg_replace(
811 array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
817 * Regex replace callback for armoring links against further processing.
818 * @param array $matches
822 private static function armorLinksCallback( $matches ) {
823 return str_replace( ':', ':', $matches[1] );
827 * Return an associative array of attribute names and values from
828 * a partial tag string. Attribute names are forces to lowercase,
829 * character references are decoded to UTF-8 text.
834 static function decodeTagAttributes( $text ) {
837 if( trim( $text ) == '' ) {
850 foreach( $pairs as $set ) {
851 $attribute = strtolower( $set[1] );
852 $value = Sanitizer
::getTagAttributeCallback( $set );
854 // Normalize whitespace
855 $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
856 $value = trim( $value );
858 // Decode character references
859 $attribs[$attribute] = Sanitizer
::decodeCharReferences( $value );
865 * Pick the appropriate attribute value from a match set from the
866 * MW_ATTRIBS_REGEX matches.
872 private static function getTagAttributeCallback( $set ) {
873 if( isset( $set[6] ) ) {
874 # Illegal #XXXXXX color with no quotes.
876 } elseif( isset( $set[5] ) ) {
879 } elseif( isset( $set[4] ) ) {
882 } elseif( isset( $set[3] ) ) {
885 } elseif( !isset( $set[2] ) ) {
886 # In XHTML, attributes must have a value.
887 # For 'reduced' form, return explicitly the attribute name here.
890 throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
895 * Normalize whitespace and character references in an XML source-
896 * encoded text for an attribute value.
898 * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
899 * but note that we're not returning the value, but are returning
900 * XML source fragments that will be slapped into output.
902 * @param string $text
906 private static function normalizeAttributeValue( $text ) {
907 return str_replace( '"', '"',
908 self
::normalizeWhitespace(
909 Sanitizer
::normalizeCharReferences( $text ) ) );
912 private static function normalizeWhitespace( $text ) {
914 '/\r\n|[\x20\x0d\x0a\x09]/',
920 * Ensure that any entities and character references are legal
921 * for XML and XHTML specifically. Any stray bits will be
922 * &-escaped to result in a valid text fragment.
924 * a. any named char refs must be known in XHTML
925 * b. any numeric char refs must be legal chars, not invalid or forbidden
926 * c. use &#x, not &#X
927 * d. fix or reject non-valid attributes
929 * @param string $text
933 static function normalizeCharReferences( $text ) {
934 return preg_replace_callback(
936 array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
940 * @param string $matches
943 static function normalizeCharReferencesCallback( $matches ) {
945 if( $matches[1] != '' ) {
946 $ret = Sanitizer
::normalizeEntity( $matches[1] );
947 } elseif( $matches[2] != '' ) {
948 $ret = Sanitizer
::decCharReference( $matches[2] );
949 } elseif( $matches[3] != '' ) {
950 $ret = Sanitizer
::hexCharReference( $matches[3] );
951 } elseif( $matches[4] != '' ) {
952 $ret = Sanitizer
::hexCharReference( $matches[4] );
954 if( is_null( $ret ) ) {
955 return htmlspecialchars( $matches[0] );
962 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
963 * return the named entity reference as is. If the entity is a
964 * MediaWiki-specific alias, returns the HTML equivalent. Otherwise,
965 * returns HTML-escaped text of pseudo-entity source (eg &foo;)
967 * @param string $name
971 static function normalizeEntity( $name ) {
972 global $wgHtmlEntities, $wgHtmlEntityAliases;
973 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
974 return "&{$wgHtmlEntityAliases[$name]};";
975 } elseif( isset( $wgHtmlEntities[$name] ) ) {
978 return "&$name;";
982 static function decCharReference( $codepoint ) {
983 $point = intval( $codepoint );
984 if( Sanitizer
::validateCodepoint( $point ) ) {
985 return sprintf( '&#%d;', $point );
991 static function hexCharReference( $codepoint ) {
992 $point = hexdec( $codepoint );
993 if( Sanitizer
::validateCodepoint( $point ) ) {
994 return sprintf( '&#x%x;', $point );
1001 * Returns true if a given Unicode codepoint is a valid character in XML.
1002 * @param int $codepoint
1005 private static function validateCodepoint( $codepoint ) {
1006 return ($codepoint == 0x09)
1007 ||
($codepoint == 0x0a)
1008 ||
($codepoint == 0x0d)
1009 ||
($codepoint >= 0x20 && $codepoint <= 0xd7ff)
1010 ||
($codepoint >= 0xe000 && $codepoint <= 0xfffd)
1011 ||
($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
1015 * Decode any character references, numeric or named entities,
1016 * in the text and return a UTF-8 string.
1018 * @param string $text
1023 public static function decodeCharReferences( $text ) {
1024 return preg_replace_callback(
1026 array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1031 * @param string $matches
1034 static function decodeCharReferencesCallback( $matches ) {
1035 if( $matches[1] != '' ) {
1036 return Sanitizer
::decodeEntity( $matches[1] );
1037 } elseif( $matches[2] != '' ) {
1038 return Sanitizer
::decodeChar( intval( $matches[2] ) );
1039 } elseif( $matches[3] != '' ) {
1040 return Sanitizer
::decodeChar( hexdec( $matches[3] ) );
1041 } elseif( $matches[4] != '' ) {
1042 return Sanitizer
::decodeChar( hexdec( $matches[4] ) );
1044 # Last case should be an ampersand by itself
1049 * Return UTF-8 string for a codepoint if that is a valid
1050 * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
1051 * @param int $codepoint
1055 static function decodeChar( $codepoint ) {
1056 if( Sanitizer
::validateCodepoint( $codepoint ) ) {
1057 return codepointToUtf8( $codepoint );
1059 return UTF8_REPLACEMENT
;
1064 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1065 * return the UTF-8 encoding of that character. Otherwise, returns
1066 * pseudo-entity source (eg &foo;)
1068 * @param string $name
1071 static function decodeEntity( $name ) {
1072 global $wgHtmlEntities, $wgHtmlEntityAliases;
1073 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1074 $name = $wgHtmlEntityAliases[$name];
1076 if( isset( $wgHtmlEntities[$name] ) ) {
1077 return codepointToUtf8( $wgHtmlEntities[$name] );
1084 * Fetch the whitelist of acceptable attributes for a given
1087 * @param string $element
1090 static function attributeWhitelist( $element ) {
1092 if( !isset( $list ) ) {
1093 $list = Sanitizer
::setupAttributeWhitelist();
1095 return isset( $list[$element] )
1101 * @todo Document it a bit
1104 static function setupAttributeWhitelist() {
1105 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );
1106 $block = array_merge( $common, array( 'align' ) );
1107 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1108 $tablecell = array( 'abbr',
1114 'nowrap', # deprecated
1115 'width', # deprecated
1116 'height', # deprecated
1117 'bgcolor' # deprecated
1120 # Numbers refer to sections in HTML 4.01 standard describing the element.
1121 # See: http://www.w3.org/TR/html4/
1122 $whitelist = array (
1125 'center' => $common, # deprecated
1126 'span' => $block, # ??
1144 'strong' => $common,
1155 'blockquote' => array_merge( $common, array( 'cite' ) ),
1166 'br' => array( 'id', 'class', 'title', 'style', 'clear' ),
1169 'pre' => array_merge( $common, array( 'width' ) ),
1172 'ins' => array_merge( $common, array( 'cite', 'datetime' ) ),
1173 'del' => array_merge( $common, array( 'cite', 'datetime' ) ),
1176 'ul' => array_merge( $common, array( 'type' ) ),
1177 'ol' => array_merge( $common, array( 'type', 'start' ) ),
1178 'li' => array_merge( $common, array( 'type', 'value' ) ),
1186 'table' => array_merge( $common,
1187 array( 'summary', 'width', 'border', 'frame',
1188 'rules', 'cellspacing', 'cellpadding',
1193 'caption' => array_merge( $common, array( 'align' ) ),
1196 'thead' => array_merge( $common, $tablealign ),
1197 'tfoot' => array_merge( $common, $tablealign ),
1198 'tbody' => array_merge( $common, $tablealign ),
1201 'colgroup' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1202 'col' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1205 'tr' => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1208 'td' => array_merge( $common, $tablecell, $tablealign ),
1209 'th' => array_merge( $common, $tablecell, $tablealign ),
1212 # Not usually allowed, but may be used for extension-style hooks
1213 # such as <math> when it is rasterized
1214 'img' => array_merge( $common, array( 'alt' ) ),
1222 'strike' => $common,
1227 'font' => array_merge( $common, array( 'size', 'color', 'face' ) ),
1231 'hr' => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1233 # XHTML Ruby annotation text module, simple ruby only.
1234 # http://www.w3c.org/TR/ruby/
1239 'rt' => $common, #array_merge( $common, array( 'rbspan' ) ),
1242 # MathML root element, where used for extensions
1243 # 'title' may not be 100% valid here; it's XHTML
1244 # http://www.w3.org/TR/REC-MathML/
1245 'math' => array( 'class', 'style', 'id', 'title' ),
1251 * Take a fragment of (potentially invalid) HTML and return
1252 * a version with any tags removed, encoded as plain text.
1254 * Warning: this return value must be further escaped for literal
1255 * inclusion in HTML output as of 1.10!
1257 * @param string $text HTML fragment
1260 static function stripAllTags( $text ) {
1262 $text = StringUtils
::delimiterReplace( '<', '>', '', $text );
1264 # Normalize &entities and whitespace
1265 $text = self
::decodeCharReferences( $text );
1266 $text = self
::normalizeWhitespace( $text );
1272 * Hack up a private DOCTYPE with HTML's standard entity declarations.
1273 * PHP 4 seemed to know these if you gave it an HTML doctype, but
1276 * Use for passing XHTML fragments to PHP's XML parsing functions
1281 static function hackDocType() {
1282 global $wgHtmlEntities;
1283 $out = "<!DOCTYPE html [\n";
1284 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1285 $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1291 static function cleanUrl( $url, $hostname=true ) {
1292 # Normalize any HTML entities in input. They will be
1293 # re-escaped by makeExternalLink().
1294 $url = Sanitizer
::decodeCharReferences( $url );
1296 # Escape any control characters introduced by the above step
1297 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F]/e', "urlencode('\\0')", $url );
1299 # Validate hostname portion
1301 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1302 list( /* $whole */, $protocol, $host, $rest ) = $matches;
1304 // Characters that will be ignored in IDNs.
1305 // http://tools.ietf.org/html/3454#section-3.1
1306 // Strip them before further processing so blacklists and such work.
1308 \\s| # general whitespace
1309 \xc2\xad| # 00ad SOFT HYPHEN
1310 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1311 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1312 \xe2\x81\xa0| # 2060 WORD JOINER
1313 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1314 \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
1315 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1316 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1317 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1318 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1319 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1320 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1323 $host = preg_replace( $strip, '', $host );
1325 // @fixme: validate hostnames here
1327 return $protocol . $host . $rest;