3 * XHTML sanitizer for MediaWiki
5 * Copyright (C) 2002-2005 Brion Vibber <brion@pobox.com> et al
6 * http://www.mediawiki.org/
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
21 * http://www.gnu.org/copyleft/gpl.html
28 * Regular expression to match various types of character references in
29 * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
31 define( 'MW_CHAR_REFS_REGEX',
32 '/&([A-Za-z0-9\x80-\xff]+);
39 * Regular expression to match HTML/XML attribute pairs within a tag.
40 * Allows some... latitude.
41 * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
43 $attrib = '[A-Za-z0-9]';
44 $space = '[\x09\x0a\x0d\x20]';
45 define( 'MW_ATTRIBS_REGEX',
46 "/(?:^|$space)((?:xml:|xmlns:)?$attrib+)
49 # The attribute value: quoted or alone
52 | ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
53 | (\#[0-9a-fA-F]+) # Technically wrong, but lots of
54 # colors are specified like this.
55 # We'll be normalizing it.
57 )?(?=$space|\$)/sx" );
60 * Regular expression to match URIs that could trigger script execution
62 define( 'MW_EVIL_URI_PATTERN', '!(^|\s|\*/\s*)(javascript|vbscript)([^\w]|$)!i' );
65 * Regular expression to match namespace attributes
67 define( 'MW_XMLNS_ATTRIBUTE_PATTRN', "/^xmlns:$attrib+$/" );
70 * List of all named character entities defined in HTML 4.01
71 * http://www.w3.org/TR/html4/sgml/entities.html
74 global $wgHtmlEntities;
75 $wgHtmlEntities = array(
330 * Character entity aliases accepted by MediaWiki
332 global $wgHtmlEntityAliases;
333 $wgHtmlEntityAliases = array(
340 * XHTML sanitizer for MediaWiki
345 * Cleans up HTML, removes dangerous tags and attributes, and
346 * removes HTML comments
348 * @param $text String
349 * @param $processCallback Callback to do any variable or parameter replacements in HTML attribute values
350 * @param $args Array for the processing callback
351 * @param $extratags Array for any extra tags to include
352 * @param $removetags Array for any tags (default or extra) to exclude
355 static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array(), $removetags = array() ) {
358 static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags,
359 $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised;
361 wfProfileIn( __METHOD__ );
363 if ( !$staticInitialised ) {
365 $htmlpairsStatic = array( # Tags that must be closed
366 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1',
367 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
368 'strike', 'strong', 'tt', 'var', 'div', 'center',
369 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
370 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u', 'abbr'
373 'br', 'hr', 'li', 'dt', 'dd'
375 $htmlsingleonly = array( # Elements that cannot have close tags
378 $htmlnest = array( # Tags that can be nested--??
379 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
380 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
382 $tabletags = array( # Can only appear inside table, we will close them
385 $htmllist = array( # Tags used by list
388 $listtags = array( # Tags that can appear in a list
392 $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
393 $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
395 # Convert them all to hashtables for faster lookup
396 $vars = array( 'htmlpairsStatic', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags',
397 'htmllist', 'listtags', 'htmlsingleallowed', 'htmlelementsStatic' );
398 foreach ( $vars as $var ) {
399 $$var = array_flip( $$var );
401 $staticInitialised = true;
403 # Populate $htmlpairs and $htmlelements with the $extratags and $removetags arrays
404 $extratags = array_flip( $extratags );
405 $removetags = array_flip( $removetags );
406 $htmlpairs = array_merge( $extratags, $htmlpairsStatic );
407 $htmlelements = array_diff_key( array_merge( $extratags, $htmlelementsStatic ) , $removetags );
409 # Remove HTML comments
410 $text = Sanitizer::removeHTMLcomments( $text );
411 $bits = explode( '<', $text );
412 $text = str_replace( '>', '>', array_shift( $bits ) );
414 $tagstack = $tablestack = array();
415 foreach ( $bits as $x ) {
417 # $slash: Does the current element start with a '/'?
418 # $t: Current element name
419 # $params: String between element name and >
420 # $brace: Ending '>' or '/>'
421 # $rest: Everything until the next element of $bits
422 if( preg_match( '!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs ) ) {
423 list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
425 $slash = $t = $params = $brace = $rest = null;
429 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
431 if ( $slash && isset( $htmlsingleonly[$t] ) ) {
433 } elseif ( $slash ) {
434 # Closing a tag... is it the one we just opened?
435 $ot = @array_pop( $tagstack );
437 if ( isset( $htmlsingleallowed[$ot] ) ) {
438 # Pop all elements with an optional close tag
439 # and see if we find a match below them
441 array_push( $optstack, $ot );
442 $ot = @array_pop( $tagstack );
443 while ( $ot != $t && isset( $htmlsingleallowed[$ot] ) ) {
444 array_push( $optstack, $ot );
445 $ot = @array_pop( $tagstack );
448 # No match. Push the optional elements back again
450 while ( $ot = @array_pop( $optstack ) ) {
451 array_push( $tagstack, $ot );
455 @array_push( $tagstack, $ot );
456 # <li> can be nested in <ul> or <ol>, skip those cases:
457 if ( !isset( $htmllist[$ot] ) || !isset( $listtags[$t] ) ) {
462 if ( $t == 'table' ) {
463 $tagstack = array_pop( $tablestack );
468 # Keep track for later
469 if ( isset( $tabletags[$t] ) &&
470 !in_array( 'table', $tagstack ) ) {
472 } elseif ( in_array( $t, $tagstack ) &&
473 !isset( $htmlnest [$t ] ) ) {
475 #Â Is it a self closed htmlpair ? (bug 5487)
476 } elseif ( $brace == '/>' &&
477 isset( $htmlpairs[$t] ) ) {
479 } elseif ( isset( $htmlsingleonly[$t] ) ) {
480 # Hack to force empty tag for uncloseable elements
482 } elseif ( isset( $htmlsingle[$t] ) ) {
483 # Hack to not close $htmlsingle tags
485 } elseif ( isset( $tabletags[$t] )
486 && in_array( $t, $tagstack ) ) {
487 // New table tag but forgot to close the previous one
490 if ( $t == 'table' ) {
491 array_push( $tablestack, $tagstack );
494 array_push( $tagstack, $t );
497 # Replace any variables or template parameters with
499 if( is_callable( $processCallback ) ) {
500 call_user_func_array( $processCallback, array( &$params, $args ) );
503 # Strip non-approved attributes from the tag
504 $newparams = Sanitizer::fixTagAttributes( $params, $t );
507 $rest = str_replace( '>', '>', $rest );
508 $close = ( $brace == '/>' && !$slash ) ? ' /' : '';
509 $text .= "<$slash$t$newparams$close>$rest";
513 $text .= '<' . str_replace( '>', '>', $x);
515 # Close off any remaining tags
516 while ( is_array( $tagstack ) && ($t = array_pop( $tagstack )) ) {
518 if ( $t == 'table' ) { $tagstack = array_pop( $tablestack ); }
521 # this might be possible using tidy itself
522 foreach ( $bits as $x ) {
523 preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
525 @list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
526 if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
527 if( is_callable( $processCallback ) ) {
528 call_user_func_array( $processCallback, array( &$params, $args ) );
530 $newparams = Sanitizer::fixTagAttributes( $params, $t );
531 $rest = str_replace( '>', '>', $rest );
532 $text .= "<$slash$t$newparams$brace$rest";
534 $text .= '<' . str_replace( '>', '>', $x);
538 wfProfileOut( __METHOD__ );
543 * Remove '<!--', '-->', and everything between.
544 * To avoid leaving blank lines, when a comment is both preceded
545 * and followed by a newline (ignoring spaces), trim leading and
546 * trailing spaces and one of the newlines.
549 * @param $text String
552 static function removeHTMLcomments( $text ) {
553 wfProfileIn( __METHOD__ );
554 while (($start = strpos($text, '<!--')) !== false) {
555 $end = strpos($text, '-->', $start + 4);
556 if ($end === false) {
557 # Unterminated comment; bail out
563 # Trim space and newline if the comment is both
564 # preceded and followed by a newline
565 $spaceStart = max($start - 1, 0);
566 $spaceLen = $end - $spaceStart;
567 while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0) {
571 while (substr($text, $spaceStart + $spaceLen, 1) === ' ')
573 if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart + $spaceLen, 1) === "\n") {
574 # Remove the comment, leading and trailing
575 # spaces, and leave only one newline.
576 $text = substr_replace($text, "\n", $spaceStart, $spaceLen + 1);
579 # Remove just the comment.
580 $text = substr_replace($text, '', $start, $end - $start);
583 wfProfileOut( __METHOD__ );
588 * Take an array of attribute names and values and normalize or discard
589 * illegal values for the given element type.
591 * - Discards attributes not on a whitelist for the given element
592 * - Unsafe style attributes are discarded
593 * - Invalid id attributes are reencoded
595 * @param $attribs Array
596 * @param $element String
599 * @todo Check for legal values where the DTD limits things.
600 * @todo Check for unique id attribute :P
602 static function validateTagAttributes( $attribs, $element ) {
603 return Sanitizer::validateAttributes( $attribs,
604 Sanitizer::attributeWhitelist( $element ) );
608 * Take an array of attribute names and values and normalize or discard
609 * illegal values for the given whitelist.
611 * - Discards attributes not the given whitelist
612 * - Unsafe style attributes are discarded
613 * - Invalid id attributes are reencoded
615 * @param $attribs Array
616 * @param $whitelist Array: list of allowed attribute names
619 * @todo Check for legal values where the DTD limits things.
620 * @todo Check for unique id attribute :P
622 static function validateAttributes( $attribs, $whitelist ) {
623 global $wgAllowRdfaAttributes, $wgAllowMicrodataAttributes;
625 $whitelist = array_flip( $whitelist );
626 $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
629 foreach( $attribs as $attribute => $value ) {
630 #allow XML namespace declaration if RDFa is enabled
631 if ( $wgAllowRdfaAttributes && preg_match( MW_XMLNS_ATTRIBUTE_PATTRN, $attribute ) ) {
632 if ( !preg_match( MW_EVIL_URI_PATTERN, $value ) ) {
633 $out[$attribute] = $value;
639 if( !isset( $whitelist[$attribute] ) ) {
643 # Strip javascript "expression" from stylesheets.
644 # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
645 if( $attribute == 'style' ) {
646 $value = Sanitizer::checkCss( $value );
649 if ( $attribute === 'id' ) {
650 $value = Sanitizer::escapeId( $value, 'noninitial' );
653 //RDFa and microdata properties allow URLs, URIs and/or CURIs. check them for sanity
654 if ( $attribute === 'rel' || $attribute === 'rev' ||
655 $attribute === 'about' || $attribute === 'property' || $attribute === 'resource' || #RDFa
656 $attribute === 'datatype' || $attribute === 'typeof' || #RDFa
657 $attribute === 'itemid' || $attribute === 'itemprop' || $attribute === 'itemref' || #HTML5 microdata
658 $attribute === 'itemscope' || $attribute === 'itemtype' ) { #HTML5 microdata
660 //Paranoia. Allow "simple" values but suppress javascript
661 if ( preg_match( MW_EVIL_URI_PATTERN, $value ) ) {
666 # NOTE: even though elements using href/src are not allowed directly, supply
667 # validation code that can be used by tag hook handlers, etc
668 if ( $attribute === 'href' || $attribute === 'src' ) {
669 if ( !preg_match( $hrefExp, $value ) ) {
670 continue; //drop any href or src attributes not using an allowed protocol.
671 //NOTE: this also drops all relative URLs
675 // If this attribute was previously set, override it.
676 // Output should only have one attribute of each name.
677 $out[$attribute] = $value;
680 if ( $wgAllowMicrodataAttributes ) {
681 # There are some complicated validity constraints we need to
682 # enforce here. First of all, we don't want to allow non-standard
684 $allowedTypes = array(
685 'http://microformats.org/profile/hcard',
686 'http://microformats.org/profile/hcalendar#vevent',
687 'http://n.whatwg.org/work',
689 if ( isset( $out['itemtype'] ) && !in_array( $out['itemtype'],
692 unset( $out['itemscope'] );
694 # itemtype, itemid, itemref don't make sense without itemscope
695 if ( !array_key_exists( 'itemscope', $out ) ) {
696 unset( $out['itemtype'] );
697 unset( $out['itemid'] );
698 unset( $out['itemref'] );
700 # TODO: Strip itemprop if we aren't descendants of an itemscope.
706 * Merge two sets of HTML attributes. Conflicting items in the second set
707 * will override those in the first, except for 'class' attributes which
708 * will be combined (if they're both strings).
710 * @todo implement merging for other attributes such as style
715 static function mergeAttributes( $a, $b ) {
716 $out = array_merge( $a, $b );
717 if( isset( $a['class'] ) && isset( $b['class'] )
718 && is_string( $a['class'] ) && is_string( $b['class'] )
719 && $a['class'] !== $b['class'] ) {
720 $classes = preg_split( '/\s+/', "{$a['class']} {$b['class']}",
721 -1, PREG_SPLIT_NO_EMPTY );
722 $out['class'] = implode( ' ', array_unique( $classes ) );
728 * Pick apart some CSS and check it for forbidden or unsafe structures.
729 * Returns a sanitized string, or false if it was just too evil.
731 * Currently URL references, 'expression', 'tps' are forbidden.
733 * @param $value String
736 static function checkCss( $value ) {
737 $value = Sanitizer::decodeCharReferences( $value );
739 // Remove any comments; IE gets token splitting wrong
740 $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value );
742 // Remove anything after a comment-start token, to guard against
743 // incorrect client implementations.
744 $commentPos = strpos( $value, '/*' );
745 if ( $commentPos !== false ) {
746 $value = substr( $value, 0, $commentPos );
749 // Decode escape sequences and line continuation
750 // See the grammar in the CSS 2 spec, appendix D.
751 static $decodeRegex, $reencodeTable;
752 if ( !$decodeRegex ) {
753 $space = '[\\x20\\t\\r\\n\\f]';
754 $nl = '(?:\\n|\\r\\n|\\r|\\f)';
756 $decodeRegex = "/ $backslash
758 ($nl) | # 1. Line continuation
759 ([0-9A-Fa-f]{1,6})$space? | # 2. character number
760 (.) | # 3. backslash cancelling special meaning
761 () | # 4. backslash at end of string
764 $value = preg_replace_callback( $decodeRegex,
765 array( __CLASS__, 'cssDecodeCallback' ), $value );
767 // Reject problematic keywords and control characters
768 if ( preg_match( '/[\000-\010\016-\037\177]/', $value ) ) {
769 return '/* invalid control char */';
770 } elseif ( preg_match( '! expression | filter\s*: | accelerator\s*: | url\s*\( !ix', $value ) ) {
771 return '/* insecure input */';
776 static function cssDecodeCallback( $matches ) {
777 if ( $matches[1] !== '' ) {
780 } elseif ( $matches[2] !== '' ) {
781 $char = codepointToUtf8( hexdec( $matches[2] ) );
782 } elseif ( $matches[3] !== '' ) {
787 if ( $char == "\n" || $char == '"' || $char == "'" || $char == '\\' ) {
788 // These characters need to be escaped in strings
789 // Clean up the escape sequence to avoid parsing errors by clients
790 return '\\' . dechex( ord( $char ) ) . ' ';
792 // Decode unnecessary escape
798 * Take a tag soup fragment listing an HTML element's attributes
799 * and normalize it to well-formed XML, discarding unwanted attributes.
800 * Output is safe for further wikitext processing, with escaping of
801 * values that could trigger problems.
803 * - Normalizes attribute names to lowercase
804 * - Discards attributes not on a whitelist for the given element
805 * - Turns broken or invalid entities into plaintext
806 * - Double-quotes all attribute values
807 * - Attributes without values are given the name as attribute
808 * - Double attributes are discarded
809 * - Unsafe style attributes are discarded
810 * - Prepends space if there are attributes.
812 * @param $text String
813 * @param $element String
816 static function fixTagAttributes( $text, $element ) {
817 if( trim( $text ) == '' ) {
821 $stripped = Sanitizer::validateTagAttributes(
822 Sanitizer::decodeTagAttributes( $text ), $element );
825 foreach( $stripped as $attribute => $value ) {
826 $encAttribute = htmlspecialchars( $attribute );
827 $encValue = Sanitizer::safeEncodeAttribute( $value );
829 $attribs[] = "$encAttribute=\"$encValue\"";
831 return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : '';
835 * Encode an attribute value for HTML output.
836 * @param $text String
837 * @return HTML-encoded text fragment
839 static function encodeAttribute( $text ) {
840 $encValue = htmlspecialchars( $text, ENT_QUOTES );
842 // Whitespace is normalized during attribute decoding,
843 // so if we've been passed non-spaces we must encode them
844 // ahead of time or they won't be preserved.
845 $encValue = strtr( $encValue, array(
855 * Encode an attribute value for HTML tags, with extra armoring
856 * against further wiki processing.
857 * @param $text String
858 * @return HTML-encoded text fragment
860 static function safeEncodeAttribute( $text ) {
861 $encValue = Sanitizer::encodeAttribute( $text );
863 # Templates and links may be expanded in later parsing,
864 # creating invalid or dangerous output. Suppress this.
865 $encValue = strtr( $encValue, array(
866 '<' => '<', // This should never happen,
867 '>' => '>', // we've received invalid input
868 '"' => '"', // which should have been escaped.
871 "''" => '''',
872 'ISBN' => 'ISBN',
874 'PMID' => 'PMID',
880 $encValue = preg_replace_callback(
881 '/(' . wfUrlProtocols() . ')/',
882 array( 'Sanitizer', 'armorLinksCallback' ),
888 * Given a value, escape it so that it can be used in an id attribute and
889 * return it. This will use HTML5 validation if $wgExperimentalHtmlIds is
890 * true, allowing anything but ASCII whitespace. Otherwise it will use
891 * HTML 4 rules, which means a narrow subset of ASCII, with bad characters
892 * escaped with lots of dots.
894 * To ensure we don't have to bother escaping anything, we also strip ', ",
895 * & even if $wgExperimentalIds is true. TODO: Is this the best tactic?
896 * We also strip # because it upsets IE6.
898 * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters
901 * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
902 * @see http://www.whatwg.org/specs/web-apps/current-work/multipage/elements.html#the-id-attribute
903 * HTML5 definition of id attribute
905 * @param $id String: id to escape
906 * @param $options Mixed: string or array of strings (default is array()):
907 * 'noninitial': This is a non-initial fragment of an id, not a full id,
908 * so don't pay attention if the first character isn't valid at the
909 * beginning of an id. Only matters if $wgExperimentalHtmlIds is
911 * 'legacy': Behave the way the old HTML 4-based ID escaping worked even
912 * if $wgExperimentalHtmlIds is used, so we can generate extra
913 * anchors and links won't break.
916 static function escapeId( $id, $options = array() ) {
917 global $wgHtml5, $wgExperimentalHtmlIds;
918 $options = (array)$options;
920 if ( $wgHtml5 && $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) {
921 $id = Sanitizer::decodeCharReferences( $id );
922 $id = preg_replace( '/[ \t\n\r\f_\'"&#]+/', '_', $id );
923 $id = trim( $id, '_' );
925 # Must have been all whitespace to start with.
932 # HTML4-style escaping
933 static $replace = array(
938 $id = urlencode( Sanitizer::decodeCharReferences( strtr( $id, ' ', '_' ) ) );
939 $id = str_replace( array_keys( $replace ), array_values( $replace ), $id );
941 if ( !preg_match( '/^[a-zA-Z]/', $id )
942 && !in_array( 'noninitial', $options ) ) {
943 // Initial character must be a letter!
950 * Given a value, escape it so that it can be used as a CSS class and
953 * @todo For extra validity, input should be validated UTF-8.
955 * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
957 * @param $class String
960 static function escapeClass( $class ) {
961 // Convert ugly stuff to underscores and kill underscores in ugly places
962 return rtrim(preg_replace(
963 array('/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/','/_+/'),
969 * Given HTML input, escape with htmlspecialchars but un-escape entites.
970 * This allows (generally harmless) entities like to survive.
972 * @param $html String to escape
973 * @return String: escaped input
975 static function escapeHtmlAllowEntities( $html ) {
976 # It seems wise to escape ' as well as ", as a matter of course. Can't
978 $html = htmlspecialchars( $html, ENT_QUOTES );
979 $html = str_replace( '&', '&', $html );
980 $html = Sanitizer::normalizeCharReferences( $html );
985 * Regex replace callback for armoring links against further processing.
986 * @param $matches Array
989 private static function armorLinksCallback( $matches ) {
990 return str_replace( ':', ':', $matches[1] );
994 * Return an associative array of attribute names and values from
995 * a partial tag string. Attribute names are forces to lowercase,
996 * character references are decoded to UTF-8 text.
998 * @param $text String
1001 public static function decodeTagAttributes( $text ) {
1002 if( trim( $text ) == '' ) {
1008 if( !preg_match_all(
1012 PREG_SET_ORDER ) ) {
1016 foreach( $pairs as $set ) {
1017 $attribute = strtolower( $set[1] );
1018 $value = Sanitizer::getTagAttributeCallback( $set );
1020 // Normalize whitespace
1021 $value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
1022 $value = trim( $value );
1024 // Decode character references
1025 $attribs[$attribute] = Sanitizer::decodeCharReferences( $value );
1031 * Pick the appropriate attribute value from a match set from the
1032 * MW_ATTRIBS_REGEX matches.
1037 private static function getTagAttributeCallback( $set ) {
1038 if( isset( $set[6] ) ) {
1039 # Illegal #XXXXXX color with no quotes.
1041 } elseif( isset( $set[5] ) ) {
1044 } elseif( isset( $set[4] ) ) {
1047 } elseif( isset( $set[3] ) ) {
1050 } elseif( !isset( $set[2] ) ) {
1051 # In XHTML, attributes must have a value.
1052 # For 'reduced' form, return explicitly the attribute name here.
1055 throw new MWException( "Tag conditions not met. This should never happen and is a bug." );
1060 * Normalize whitespace and character references in an XML source-
1061 * encoded text for an attribute value.
1063 * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
1064 * but note that we're not returning the value, but are returning
1065 * XML source fragments that will be slapped into output.
1067 * @param $text String
1070 private static function normalizeAttributeValue( $text ) {
1071 return str_replace( '"', '"',
1072 self::normalizeWhitespace(
1073 Sanitizer::normalizeCharReferences( $text ) ) );
1076 private static function normalizeWhitespace( $text ) {
1077 return preg_replace(
1078 '/\r\n|[\x20\x0d\x0a\x09]/',
1084 * Ensure that any entities and character references are legal
1085 * for XML and XHTML specifically. Any stray bits will be
1086 * &-escaped to result in a valid text fragment.
1088 * a. any named char refs must be known in XHTML
1089 * b. any numeric char refs must be legal chars, not invalid or forbidden
1090 * c. use &#x, not &#X
1091 * d. fix or reject non-valid attributes
1093 * @param $text String
1097 static function normalizeCharReferences( $text ) {
1098 return preg_replace_callback(
1100 array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
1104 * @param $matches String
1107 static function normalizeCharReferencesCallback( $matches ) {
1109 if( $matches[1] != '' ) {
1110 $ret = Sanitizer::normalizeEntity( $matches[1] );
1111 } elseif( $matches[2] != '' ) {
1112 $ret = Sanitizer::decCharReference( $matches[2] );
1113 } elseif( $matches[3] != '' ) {
1114 $ret = Sanitizer::hexCharReference( $matches[3] );
1115 } elseif( $matches[4] != '' ) {
1116 $ret = Sanitizer::hexCharReference( $matches[4] );
1118 if( is_null( $ret ) ) {
1119 return htmlspecialchars( $matches[0] );
1126 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1127 * return the named entity reference as is. If the entity is a
1128 * MediaWiki-specific alias, returns the HTML equivalent. Otherwise,
1129 * returns HTML-escaped text of pseudo-entity source (eg &foo;)
1131 * @param $name String
1134 static function normalizeEntity( $name ) {
1135 global $wgHtmlEntities, $wgHtmlEntityAliases;
1136 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1137 return "&{$wgHtmlEntityAliases[$name]};";
1138 } elseif( isset( $wgHtmlEntities[$name] ) ) {
1141 return "&$name;";
1145 static function decCharReference( $codepoint ) {
1146 $point = intval( $codepoint );
1147 if( Sanitizer::validateCodepoint( $point ) ) {
1148 return sprintf( '&#%d;', $point );
1154 static function hexCharReference( $codepoint ) {
1155 $point = hexdec( $codepoint );
1156 if( Sanitizer::validateCodepoint( $point ) ) {
1157 return sprintf( '&#x%x;', $point );
1164 * Returns true if a given Unicode codepoint is a valid character in XML.
1165 * @param $codepoint Integer
1168 private static function validateCodepoint( $codepoint ) {
1169 return ($codepoint == 0x09)
1170 || ($codepoint == 0x0a)
1171 || ($codepoint == 0x0d)
1172 || ($codepoint >= 0x20 && $codepoint <= 0xd7ff)
1173 || ($codepoint >= 0xe000 && $codepoint <= 0xfffd)
1174 || ($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
1178 * Decode any character references, numeric or named entities,
1179 * in the text and return a UTF-8 string.
1181 * @param $text String
1184 public static function decodeCharReferences( $text ) {
1185 return preg_replace_callback(
1187 array( 'Sanitizer', 'decodeCharReferencesCallback' ),
1192 * @param $matches String
1195 static function decodeCharReferencesCallback( $matches ) {
1196 if( $matches[1] != '' ) {
1197 return Sanitizer::decodeEntity( $matches[1] );
1198 } elseif( $matches[2] != '' ) {
1199 return Sanitizer::decodeChar( intval( $matches[2] ) );
1200 } elseif( $matches[3] != '' ) {
1201 return Sanitizer::decodeChar( hexdec( $matches[3] ) );
1202 } elseif( $matches[4] != '' ) {
1203 return Sanitizer::decodeChar( hexdec( $matches[4] ) );
1205 # Last case should be an ampersand by itself
1210 * Return UTF-8 string for a codepoint if that is a valid
1211 * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
1212 * @param $codepoint Integer
1216 static function decodeChar( $codepoint ) {
1217 if( Sanitizer::validateCodepoint( $codepoint ) ) {
1218 return codepointToUtf8( $codepoint );
1220 return UTF8_REPLACEMENT;
1225 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
1226 * return the UTF-8 encoding of that character. Otherwise, returns
1227 * pseudo-entity source (eg &foo;)
1229 * @param $name Strings
1232 static function decodeEntity( $name ) {
1233 global $wgHtmlEntities, $wgHtmlEntityAliases;
1234 if ( isset( $wgHtmlEntityAliases[$name] ) ) {
1235 $name = $wgHtmlEntityAliases[$name];
1237 if( isset( $wgHtmlEntities[$name] ) ) {
1238 return codepointToUtf8( $wgHtmlEntities[$name] );
1245 * Fetch the whitelist of acceptable attributes for a given element name.
1247 * @param $element String
1250 static function attributeWhitelist( $element ) {
1252 if( !isset( $list ) ) {
1253 $list = Sanitizer::setupAttributeWhitelist();
1255 return isset( $list[$element] )
1261 * Foreach array key (an allowed HTML element), return an array
1262 * of allowed attributes
1265 static function setupAttributeWhitelist() {
1266 global $wgAllowRdfaAttributes, $wgHtml5, $wgAllowMicrodataAttributes;
1268 $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );
1270 if ( $wgAllowRdfaAttributes ) {
1271 #RDFa attributes as specified in section 9 of http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014
1272 $common = array_merge( $common, array(
1273 'about', 'property', 'resource', 'datatype', 'typeof',
1277 if ( $wgHtml5 && $wgAllowMicrodataAttributes ) {
1278 # add HTML5 microdata tages as pecified by http://www.whatwg.org/specs/web-apps/current-work/multipage/microdata.html#the-microdata-model
1279 $common = array_merge( $common, array(
1280 'itemid', 'itemprop', 'itemref', 'itemscope', 'itemtype'
1284 $block = array_merge( $common, array( 'align' ) );
1285 $tablealign = array( 'align', 'char', 'charoff', 'valign' );
1286 $tablecell = array( 'abbr',
1292 'nowrap', # deprecated
1293 'width', # deprecated
1294 'height', # deprecated
1295 'bgcolor' # deprecated
1298 # Numbers refer to sections in HTML 4.01 standard describing the element.
1299 # See: http://www.w3.org/TR/html4/
1300 $whitelist = array (
1303 'center' => $common, # deprecated
1304 'span' => $block, # ??
1322 'strong' => $common,
1333 'blockquote' => array_merge( $common, array( 'cite' ) ),
1344 'br' => array( 'id', 'class', 'title', 'style', 'clear' ),
1347 'pre' => array_merge( $common, array( 'width' ) ),
1350 'ins' => array_merge( $common, array( 'cite', 'datetime' ) ),
1351 'del' => array_merge( $common, array( 'cite', 'datetime' ) ),
1354 'ul' => array_merge( $common, array( 'type' ) ),
1355 'ol' => array_merge( $common, array( 'type', 'start' ) ),
1356 'li' => array_merge( $common, array( 'type', 'value' ) ),
1364 'table' => array_merge( $common,
1365 array( 'summary', 'width', 'border', 'frame',
1366 'rules', 'cellspacing', 'cellpadding',
1371 'caption' => array_merge( $common, array( 'align' ) ),
1374 'thead' => array_merge( $common, $tablealign ),
1375 'tfoot' => array_merge( $common, $tablealign ),
1376 'tbody' => array_merge( $common, $tablealign ),
1379 'colgroup' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1380 'col' => array_merge( $common, array( 'span', 'width' ), $tablealign ),
1383 'tr' => array_merge( $common, array( 'bgcolor' ), $tablealign ),
1386 'td' => array_merge( $common, $tablecell, $tablealign ),
1387 'th' => array_merge( $common, $tablecell, $tablealign ),
1389 # 12.2 # NOTE: <a> is not allowed directly, but the attrib whitelist is used from the Parser object
1390 'a' => array_merge( $common, array( 'href', 'rel', 'rev' ) ), # rel/rev esp. for RDFa
1393 # Not usually allowed, but may be used for extension-style hooks
1394 # such as <math> when it is rasterized
1395 'img' => array_merge( $common, array( 'alt' ) ),
1403 'strike' => $common,
1408 'font' => array_merge( $common, array( 'size', 'color', 'face' ) ),
1412 'hr' => array_merge( $common, array( 'noshade', 'size', 'width' ) ),
1414 # XHTML Ruby annotation text module, simple ruby only.
1415 # http://www.w3c.org/TR/ruby/
1420 'rt' => $common, #array_merge( $common, array( 'rbspan' ) ),
1423 # MathML root element, where used for extensions
1424 # 'title' may not be 100% valid here; it's XHTML
1425 # http://www.w3.org/TR/REC-MathML/
1426 'math' => array( 'class', 'style', 'id', 'title' ),
1432 * Take a fragment of (potentially invalid) HTML and return
1433 * a version with any tags removed, encoded as plain text.
1435 * Warning: this return value must be further escaped for literal
1436 * inclusion in HTML output as of 1.10!
1438 * @param $text String: HTML fragment
1441 static function stripAllTags( $text ) {
1443 $text = StringUtils::delimiterReplace( '<', '>', '', $text );
1445 # Normalize &entities and whitespace
1446 $text = self::decodeCharReferences( $text );
1447 $text = self::normalizeWhitespace( $text );
1453 * Hack up a private DOCTYPE with HTML's standard entity declarations.
1454 * PHP 4 seemed to know these if you gave it an HTML doctype, but
1457 * Use for passing XHTML fragments to PHP's XML parsing functions
1461 static function hackDocType() {
1462 global $wgHtmlEntities;
1463 $out = "<!DOCTYPE html [\n";
1464 foreach( $wgHtmlEntities as $entity => $codepoint ) {
1465 $out .= "<!ENTITY $entity \"&#$codepoint;\">";
1471 static function cleanUrl( $url ) {
1472 # Normalize any HTML entities in input. They will be
1473 # re-escaped by makeExternalLink().
1474 $url = Sanitizer::decodeCharReferences( $url );
1476 # Escape any control characters introduced by the above step
1477 $url = preg_replace( '/[\][<>"\\x00-\\x20\\x7F]/e', "urlencode('\\0')", $url );
1479 # Validate hostname portion
1481 if( preg_match( '!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches ) ) {
1482 list( /* $whole */, $protocol, $host, $rest ) = $matches;
1484 // Characters that will be ignored in IDNs.
1485 // http://tools.ietf.org/html/3454#section-3.1
1486 // Strip them before further processing so blacklists and such work.
1488 \\s| # general whitespace
1489 \xc2\xad| # 00ad SOFT HYPHEN
1490 \xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
1491 \xe2\x80\x8b| # 200b ZERO WIDTH SPACE
1492 \xe2\x81\xa0| # 2060 WORD JOINER
1493 \xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
1494 \xcd\x8f| # 034f COMBINING GRAPHEME JOINER
1495 \xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
1496 \xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
1497 \xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
1498 \xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
1499 \xe2\x80\x8d| # 200d ZERO WIDTH JOINER
1500 [\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
1503 $host = preg_replace( $strip, '', $host );
1505 // @todo Fixme: validate hostnames here
1507 return $protocol . $host . $rest;