3 * XHTML sanitizer for MediaWiki
5 * Copyright (C) 2002-2005 Brion Vibber <brion@pobox.com> et al
6 * http://www.mediawiki.org/
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
21 * http://www.gnu.org/copyleft/gpl.html
28 * Regular expression to match various types of character references in
29 * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
31 define( 'MW_CHAR_REFS_REGEX',
39 * Regular expression to match HTML/XML attribute pairs within a tag.
40 * Allows some... latitude.
41 * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
43 $attrib = '[A-Za-z0-9]';
44 $space = '[\x09\x0a\x0d\x20]';
45 define( 'MW_ATTRIBS_REGEX',
46 "/(?:^|$space)($attrib+)
49 # The attribute value: quoted or alone
52 | ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
53 | (\#[0-9a-fA-F]+) # Technically wrong, but lots of
54 # colors are specified like this.
55 # We'll be normalizing it.
57 )?(?=$space|\$)/sx" );
60 * List of all named character entities defined in HTML 4.01
61 * http://www.w3.org/TR/html4/sgml/entities.html
64 global $wgHtmlEntities;
65 $wgHtmlEntities = array(
319 /** @package MediaWiki */
322 * Cleans up HTML, removes dangerous tags and attributes, and
323 * removes HTML comments
325 * @param string $text
326 * @param callback $processCallback to do any variable or parameter replacements in HTML attribute values
327 * @param array $args for the processing callback
330 static function removeHTMLtags( $text, $processCallback = null, $args = array() ) {
331 global $wgUseTidy, $wgUserHtml;
333 static $htmlpairs, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
334 $htmllist, $listtags, $htmlsingleallowed, $htmlelements, $staticInitialised;
336 wfProfileIn( __METHOD__
);
338 if ( !$staticInitialised ) {
340 $htmlpairs = array( # Tags that must be closed
341 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
342 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
343 'strike', 'strong', 'tt', 'var', 'div', 'center',
344 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
345 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u'
348 'br', 'hr', 'li', 'dt', 'dd'
350 $htmlsingleonly = array( # Elements that cannot have close tags
353 $htmlnest = array( # Tags that can be nested--??
354 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
355 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
357 $tabletags = array( # Can only appear inside table
360 $htmllist = array( # Tags used by list
363 $listtags = array( # Tags that can appear in a list
368 $htmlpairs = array();
369 $htmlsingle = array();
371 $tabletags = array();
374 $htmlsingleallowed = array_merge( $htmlsingle, $tabletags );
375 $htmlelements = array_merge( $htmlsingle, $htmlpairs, $htmlnest );
377 # Convert them all to hashtables for faster lookup
378 $vars = array( 'htmlpairs', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
379 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelements' );
380 foreach ( $vars as $var ) {
381 $
$var = array_flip( $
$var );
383 $staticInitialised = true;
386 # Remove HTML comments
387 $text = Sanitizer
::removeHTMLcomments( $text );
388 $bits = explode( '<', $text );
389 $text = array_shift( $bits );
391 $tagstack = $tablestack = array();
392 foreach ( $bits as $x ) {
394 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
395 list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
397 $slash = $t = $params = $brace = $rest = null;
401 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
405 if( isset( $htmlsingleonly[$t] ) ) {
407 } elseif ( ( $ot = @array_pop
( $tagstack ) ) != $t ) {
408 if ( isset( $htmlsingleallowed[$ot] ) ) {
409 # Pop all elements with an optional close tag
410 # and see if we find a match below them
412 array_push ($optstack, $ot);
413 while ( ( ( $ot = @array_pop
( $tagstack ) ) != $t ) &&
414 isset( $htmlsingleallowed[$ot] ) )
416 array_push ($optstack, $ot);
419 # No match. Push the optinal elements back again
421 while ( $ot = @array_pop
( $optstack ) ) {
422 array_push( $tagstack, $ot );
426 @array_push
( $tagstack, $ot );
427 # <li> can be nested in <ul> or <ol>, skip those cases:
428 if(!(isset( $htmllist[$ot] ) && isset( $listtags[$t] ) )) {
433 if ( $t == 'table' ) {
434 $tagstack = array_pop( $tablestack );
439 # Keep track for later
440 if ( isset( $tabletags[$t] ) &&
441 ! in_array( 'table', $tagstack ) ) {
443 } else if ( in_array( $t, $tagstack ) &&
444 ! isset( $htmlnest [$t ] ) ) {
446 #Â Is it a self closed htmlpair ? (bug 5487)
447 } else if( $brace == '/>' &&
448 isset( $htmlpairs[$t] ) ) {
450 } elseif( isset( $htmlsingleonly[$t] ) ) {
451 # Hack to force empty tag for uncloseable elements
453 } else if( isset( $htmlsingle[$t] ) ) {
454 # Hack to not close $htmlsingle tags
457 if ( $t == 'table' ) {
458 array_push( $tablestack, $tagstack );
461 array_push( $tagstack, $t );
464 # Replace any variables or template parameters with
466 if( is_callable( $processCallback ) ) {
467 call_user_func_array( $processCallback, array( &$params, $args ) );
470 # Strip non-approved attributes from the tag
471 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
474 $rest = str_replace( '>', '>', $rest );
475 $close = ( $brace == '/>' ) ?
' /' : '';
476 $text .= "<$slash$t$newparams$close>$rest";
480 $text .= '<' . str_replace( '>', '>', $x);
482 # Close off any remaining tags
483 while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
485 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
488 # this might be possible using tidy itself
489 foreach ( $bits as $x ) {
490 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
492 @list
( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
493 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
494 if( is_callable( $processCallback ) ) {
495 call_user_func_array( $processCallback, array( &$params, $args ) );
497 $newparams = Sanitizer
::fixTagAttributes( $params, $t );
498 $rest = str_replace( '>', '>', $rest );
499 $text .= "<$slash$t$newparams$brace$rest";
501 $text .= '<' . str_replace( '>', '>', $x);
505 wfProfileOut( __METHOD__
);
510 * Remove '<!--', '-->', and everything between.
511 * To avoid leaving blank lines, when a comment is both preceded
512 * and followed by a newline (ignoring spaces), trim leading and
513 * trailing spaces and one of the newlines.
516 * @param string $text
519 static function removeHTMLcomments( $text ) {
520 wfProfileIn( __METHOD__
);
521 while (($start = strpos($text, '<!--')) !== false) {
522 $end = strpos($text, '-->', $start +
4);
523 if ($end === false) {
524 # Unterminated comment; bail out
530 # Trim space and newline if the comment is both
531 # preceded and followed by a newline
532 $spaceStart = max($start - 1, 0);
533 $spaceLen = $end - $spaceStart;
534 while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
538 while (substr($text, $spaceStart +
$spaceLen, 1) === ' ')
540 if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart +
$spaceLen, 1) === "\n") {
541 # Remove the comment, leading and trailing
542 # spaces, and leave only one newline.
543 $text = substr_replace($text, "\n", $spaceStart, $spaceLen +
1);
546 # Remove just the comment.
547 $text = substr_replace($text, '', $start, $end - $start);
550 wfProfileOut( __METHOD__
);
555 * Take an array of attribute names and values and normalize or discard
556 * illegal values for the given element type.
558 * - Discards attributes not on a whitelist for the given element
559 * - Unsafe style attributes are discarded
561 * @param array $attribs
562 * @param string $element
565 * @todo Check for legal values where the DTD limits things.
566 * @todo Check for unique id attribute :P
568 static function validateTagAttributes( $attribs, $element ) {
569 $whitelist = array_flip( Sanitizer
::attributeWhitelist( $element ) );
571 foreach( $attribs as $attribute => $value ) {
572 if( !isset( $whitelist[$attribute] ) ) {
575 # Strip javascript "expression" from stylesheets.
576 # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
577 if( $attribute == 'style' ) {
578 $value = Sanitizer
::checkCss( $value );
579 if( $value === false ) {
585 if ( $attribute === 'id' )
586 $value = Sanitizer
::escapeId( $value );
588 // If this attribute was previously set, override it.
589 // Output should only have one attribute of each name.
590 $out[$attribute] = $value;
596 * Pick apart some CSS and check it for forbidden or unsafe structures.
597 * Returns a sanitized string, or false if it was just too evil.
599 * Currently URL references, 'expression', 'tps' are forbidden.
601 * @param string $value
604 static function checkCss( $value ) {
605 $stripped = Sanitizer
::decodeCharReferences( $value );
607 // Remove any comments; IE gets token splitting wrong
608 $stripped = StringUtils
::delimiterReplace( '/*', '*/', ' ', $stripped );
612 // ... and continue checks
613 $stripped = preg_replace( '!\\\\([0-9A-Fa-f]{1,6})[ \\n\\r\\t\\f]?!e',
614 'codepointToUtf8(hexdec("$1"))', $stripped );
615 $stripped = str_replace( '\\', '', $stripped );
616 if( preg_match( '/(expression|tps*:\/\/|url\\s*\().*/is',
626 * Take a tag soup fragment listing an HTML element's attributes
627 * and normalize it to well-formed XML, discarding unwanted attributes.
628 * Output is safe for further wikitext processing, with escaping of
629 * values that could trigger problems.
631 * - Normalizes attribute names to lowercase
632 * - Discards attributes not on a whitelist for the given element
633 * - Turns broken or invalid entities into plaintext
634 * - Double-quotes all attribute values
635 * - Attributes without values are given the name as attribute
636 * - Double attributes are discarded
637 * - Unsafe style attributes are discarded
638 * - Prepends space if there are attributes.
640 * @param string $text
641 * @param string $element
644 static function fixTagAttributes( $text, $element ) {
645 if( trim( $text ) == '' ) {
649 $stripped = Sanitizer
::validateTagAttributes(
650 Sanitizer
::decodeTagAttributes( $text ), $element );
653 foreach( $stripped as $attribute => $value ) {
654 $encAttribute = htmlspecialchars( $attribute );
655 $encValue = Sanitizer
::safeEncodeAttribute( $value );
657 $attribs[] = "$encAttribute=\"$encValue\"";
659 return count( $attribs ) ?
' ' . implode( ' ', $attribs ) : '';
663 * Encode an attribute value for HTML output.
665 * @return HTML-encoded text fragment
667 static function encodeAttribute( $text ) {
668 $encValue = htmlspecialchars( $text );
670 // Whitespace is normalized during attribute decoding,
671 // so if we've been passed non-spaces we must encode them
672 // ahead of time or they won't be preserved.
673 $encValue = strtr( $encValue, array(
683 * Encode an attribute value for HTML tags, with extra armoring
684 * against further wiki processing.
686 * @return HTML-encoded text fragment
688 static function safeEncodeAttribute( $text ) {
689 $encValue = Sanitizer
::encodeAttribute( $text );
691 # Templates and links may be expanded in later parsing,
692 # creating invalid or dangerous output. Suppress this.
693 $encValue = strtr( $encValue, array(
694 '<' => '<', // This should never happen,
695 '>' => '>', // we've received invalid input
696 '"' => '"', // which should have been escaped.
699 "''" => '''',
700 'ISBN' => 'ISBN',
702 'PMID' => 'PMID',
708 $encValue = preg_replace_callback(
709 '/(' . wfUrlProtocols() . ')/',
710 array( 'Sanitizer', 'armorLinksCallback' ),
716 * Given a value escape it so that it can be used in an id attribute and
717 * return it, this does not validate the value however (see first link)
719 * @link http://www.w3.org/TR/html401/types.html#type-name Valid characters
722 * @link http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
731 static function escapeId( $id ) {
732 static $replace = array(
737 $id = urlencode( Sanitizer
::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
739 return str_replace( array_keys( $replace ), array_values( $replace ), $id );
743 * Given a value, escape it so that it can be used as a CSS class and
746 * TODO: For extra validity, input should be validated UTF-8.
748 * @link http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
750 * @param string $class
753 static function escapeClass( $class ) {
754 // Convert ugly stuff to underscores and kill underscores in ugly places
755 return rtrim(preg_replace(
756 array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
762 * Regex replace callback for armoring links against further processing.
763 * @param array $matches
767 private static function armorLinksCallback( $matches ) {
768 return str_replace( ':', ':', $matches[1] );
772 * Return an associative array of attribute names and values from
773 * a partial tag string. Attribute names are forces to lowercase,
774 * character references are decoded to UTF-8 text.
779 static function decodeTagAttributes( $text ) {
782 if( trim( $text ) == '' ) {
795 foreach( $pairs as $set ) {
796 $attribute = strtolower( $set[1] );
797 $value = Sanitizer
::getTagAttributeCallback( $set );
799 // Normalize whitespace
800 $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
801 $value = trim( $value );
803 // Decode character references
804 $attribs[$attribute] = Sanitizer
::decodeCharReferences( $value );
810 * Pick the appropriate attribute value from a match set from the
811 * MW_ATTRIBS_REGEX matches.
817 private static function getTagAttributeCallback( $set ) {
818 if( isset( $set[6] ) ) {
819 # Illegal #XXXXXX color with no quotes.
821 } elseif( isset( $set[5] ) ) {
824 } elseif( isset( $set[4] ) ) {
827 } elseif( isset( $set[3] ) ) {
830 } elseif( !isset( $set[2] ) ) {
831 # In XHTML, attributes must have a value.
832 # For 'reduced' form, return explicitly the attribute name here.
835 throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
840 * Normalize whitespace and character references in an XML source-
841 * encoded text for an attribute value.
843 * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
844 * but note that we're not returning the value, but are returning
845 * XML source fragments that will be slapped into output.
847 * @param string $text
851 private static function normalizeAttributeValue( $text ) {
852 return str_replace( '"', '"',
854 '/\r\n|[\x20\x0d\x0a\x09]/',
856 Sanitizer
::normalizeCharReferences( $text ) ) );
860 * Ensure that any entities and character references are legal
861 * for XML and XHTML specifically. Any stray bits will be
862 * &-escaped to result in a valid text fragment.
864 * a. any named char refs must be known in XHTML
865 * b. any numeric char refs must be legal chars, not invalid or forbidden
866 * c. use &#x, not &#X
867 * d. fix or reject non-valid attributes
869 * @param string $text
873 static function normalizeCharReferences( $text ) {
874 return preg_replace_callback(
876 array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
880 * @param string $matches
883 static function normalizeCharReferencesCallback( $matches ) {
885 if( $matches[1] != '' ) {
886 $ret = Sanitizer
::normalizeEntity( $matches[1] );
887 } elseif( $matches[2] != '' ) {
888 $ret = Sanitizer
::decCharReference( $matches[2] );
889 } elseif( $matches[3] != '' ) {
890 $ret = Sanitizer
::hexCharReference( $matches[3] );
891 } elseif( $matches[4] != '' ) {
892 $ret = Sanitizer
::hexCharReference( $matches[4] );
894 if( is_null( $ret ) ) {
895 return htmlspecialchars( $matches[0] );
902 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
903 * return the named entity reference as is. Otherwise, returns
904 * HTML-escaped text of pseudo-entity source (eg &foo;)
906 * @param string $name
910 static function normalizeEntity( $name ) {
911 global $wgHtmlEntities;
912 if( isset( $wgHtmlEntities[$name] ) ) {
915 return "&$name;";
919 static function decCharReference( $codepoint ) {
920 $point = intval( $codepoint );
921 if( Sanitizer
::validateCodepoint( $point ) ) {
922 return sprintf( '&#%d;', $point );
928 static function hexCharReference( $codepoint ) {
929 $point = hexdec( $codepoint );
930 if( Sanitizer
::validateCodepoint( $point ) ) {
931 return sprintf( '&#x%x;', $point );
938 * Returns true if a given Unicode codepoint is a valid character in XML.
939 * @param int $codepoint
942 private static function validateCodepoint( $codepoint ) {
943 return ($codepoint == 0x09)
944 ||
($codepoint == 0x0a)
945 ||
($codepoint == 0x0d)
946 ||
($codepoint >= 0x20 && $codepoint <= 0xd7ff)
947 ||
($codepoint >= 0xe000 && $codepoint <= 0xfffd)
948 ||
($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
952 * Decode any character references, numeric or named entities,
953 * in the text and return a UTF-8 string.
955 * @param string $text
960 public static function decodeCharReferences( $text ) {
961 return preg_replace_callback(
963 array( 'Sanitizer', 'decodeCharReferencesCallback' ),
968 * @param string $matches
971 static function decodeCharReferencesCallback( $matches ) {
972 if( $matches[1] != '' ) {
973 return Sanitizer
::decodeEntity( $matches[1] );
974 } elseif( $matches[2] != '' ) {
975 return Sanitizer
::decodeChar( intval( $matches[2] ) );
976 } elseif( $matches[3] != '' ) {
977 return Sanitizer
::decodeChar( hexdec( $matches[3] ) );
978 } elseif( $matches[4] != '' ) {
979 return Sanitizer
::decodeChar( hexdec( $matches[4] ) );
981 # Last case should be an ampersand by itself
986 * Return UTF-8 string for a codepoint if that is a valid
987 * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
988 * @param int $codepoint
992 static function decodeChar( $codepoint ) {
993 if( Sanitizer
::validateCodepoint( $codepoint ) ) {
994 return codepointToUtf8( $codepoint );
996 return UTF8_REPLACEMENT
;
1001 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1002 * return the UTF-8 encoding of that character. Otherwise, returns
1003 * pseudo-entity source (eg &foo;)
1005 * @param string $name
1008 static function decodeEntity( $name ) {
1009 global $wgHtmlEntities;
1010 if( isset( $wgHtmlEntities[$name] ) ) {
1011 return codepointToUtf8( $wgHtmlEntities[$name] );
1018 * Fetch the whitelist of acceptable attributes for a given
1021 * @param string $element
1024 static function attributeWhitelist( $element ) {
1026 if( !isset( $list ) ) {
1027 $list = Sanitizer
::setupAttributeWhitelist();
1029 return isset( $list[$element] )
1035 * @todo Document it a bit
1038 static function setupAttributeWhitelist() {
1039 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );
1040 $block = array_merge( $common, array( 'align' ) );
1041 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1042 $tablecell = array( 'abbr',
1048 'nowrap', # deprecated
1049 'width', # deprecated
1050 'height', # deprecated
1051 'bgcolor' # deprecated
1054 # Numbers refer to sections in HTML 4.01 standard describing the element.
1055 # See: http://www.w3.org/TR/html4/
1056 $whitelist = array (
1059 'center' => $common, # deprecated
1060 'span' => $block, # ??
1078 'strong' => $common,
1089 'blockquote' => array_merge( $common, array( 'cite' ) ),
1100 'br' => array( 'id', 'class', 'title', 'style', 'clear' ),
1103 'pre' => array_merge( $common, array( 'width' ) ),
1106 'ins' => array_merge( $common, array( 'cite', 'datetime' ) ),
1107 'del' => array_merge( $common, array( 'cite', 'datetime' ) ),
1110 'ul' => array_merge( $common, array( 'type' ) ),
1111 'ol' => array_merge( $common, array( 'type', 'start' ) ),
1112 'li' => array_merge( $common, array( 'type', 'value' ) ),
1120 'table' => array_merge( $common,
1121 array( 'summary', 'width', 'border', 'frame',
1122 'rules', 'cellspacing', 'cellpadding',
1127 'caption' => array_merge( $common, array( 'align' ) ),
1130 'thead' => array_merge( $common, $tablealign ),
1131 'tfoot' => array_merge( $common, $tablealign ),
1132 'tbody' => array_merge( $common, $tablealign ),
1135 'colgroup' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1136 'col' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1139 'tr' => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1142 'td' => array_merge( $common, $tablecell, $tablealign ),
1143 'th' => array_merge( $common, $tablecell, $tablealign ),
1151 'strike' => $common,
1156 'font' => array_merge( $common, array( 'size', 'color', 'face' ) ),
1160 'hr' => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1162 # XHTML Ruby annotation text module, simple ruby only.
1163 # http://www.w3c.org/TR/ruby/
1168 'rt' => $common, #array_merge( $common, array( 'rbspan' ) ),
1175 * Take a fragment of (potentially invalid) HTML and return
1176 * a version with any tags removed, encoded suitably for literal
1177 * inclusion in an attribute value.
1179 * @param string $text HTML fragment
1182 static function stripAllTags( $text ) {
1184 $text = StringUtils
::delimiterReplace( '<', '>', '', $text );
1186 # Normalize &entities and whitespace
1187 $text = Sanitizer
::normalizeAttributeValue( $text );
1189 # Will be placed into "double-quoted" attributes,
1190 # make sure remaining bits are safe.
1191 $text = str_replace(
1192 array('<', '>', '"'),
1193 array('<', '>', '"'),
1200 * Hack up a private DOCTYPE with HTML's standard entity declarations.
1201 * PHP 4 seemed to know these if you gave it an HTML doctype, but
1204 * Use for passing XHTML fragments to PHP's XML parsing functions
1209 static function hackDocType() {
1210 global $wgHtmlEntities;
1211 $out = "<!DOCTYPE html [\n";
1212 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1213 $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1219 static function cleanUrl( $url, $hostname=true ) {
1220 # Normalize any HTML entities in input. They will be
1221 # re-escaped by makeExternalLink().
1222 $url = Sanitizer
::decodeCharReferences( $url );
1224 # Escape any control characters introduced by the above step
1225 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F]/e', "urlencode('\\0')", $url );
1227 # Validate hostname portion
1229 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1230 list( /* $whole */, $protocol, $host, $rest ) = $matches;
1232 // Characters that will be ignored in IDNs.
1233 // http://tools.ietf.org/html/3454#section-3.1
1234 // Strip them before further processing so blacklists and such work.
1236 \\s| # general whitespace
1237 \xc2\xad| # 00ad SOFT HYPHEN
1238 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1239 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1240 \xe2\x81\xa0| # 2060 WORD JOINER
1241 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1242 \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
1243 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1244 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1245 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1246 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1247 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1248 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1251 $host = preg_replace( $strip, '', $host );
1253 // @fixme: validate hostnames here
1255 return $protocol . $host . $rest;