PageRenderTime 48ms CodeModel.GetById 18ms RepoModel.GetById 0ms app.codeStats 1ms

/common/libraries/plugin/wiki/mediawiki/Sanitizer.php

https://bitbucket.org/renaatdemuynck/chamilo
PHP | 1271 lines | 1217 code | 12 blank | 42 comment | 1 complexity | bede5880d4db9185511589f62b2d8b88 MD5 | raw file
Possible License(s): BSD-3-Clause, LGPL-2.1, LGPL-3.0, GPL-3.0, MIT, GPL-2.0 
    

  1. <?php

    2. 

  2. 

    3. 

  3. /**
    4. 

  4.  * XHTML sanitizer for MediaWiki
    5. 

  5.  *
    6. 

  6.  * Copyright (C) 2002-2005 Brion Vibber <brion@pobox.com> et al
    7. 

  7.  * http://www.mediawiki.org/
    8. 

  8.  *
    9. 

  9.  * This program is free software; you can redistribute it and/or modify
    10. 

  10.  * it under the terms of the GNU General Public License as published by
    11. 

  11.  * the Free Software Foundation; either version 2 of the License, or
    12. 

  12.  * (at your option) any later version.
    13. 

  13.  *
    14. 

  14.  * This program is distributed in the hope that it will be useful,
    15. 

  15.  * but WITHOUT ANY WARRANTY; without even the implied warranty of
    16. 

  16.  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    17. 

  17.  * GNU General Public License for more details.
    18. 

  18.  *
    19. 

  19.  * You should have received a copy of the GNU General Public License along
    20. 

  20.  * with this program; if not, write to the Free Software Foundation, Inc.,
    21. 

  21.  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
    22. 

  22.  * http://www.gnu.org/copyleft/gpl.html
    23. 

  23.  *
    24. 

  24.  * @file
    25. 

  25.  * @ingroup Parser
    26. 

  26.  */

    27. 

  27. 

    28. 

  28. /**
    29. 

  29.  * Regular expression to match various types of character references in
    30. 

  30.  * Sanitizer::normalizeCharReferences and Sanitizer::decodeCharReferences
    31. 

  31.  */

    32. 

  32. define('MW_CHAR_REFS_REGEX', '/&([A-Za-z0-9\x80-\xff]+);
    33. 

  33. 	 |&\#([0-9]+);
    34. 

  34. 	 |&\#x([0-9A-Za-z]+);
    35. 

  35. 	 |&\#X([0-9A-Za-z]+);
    36. 

  36. 	 |(&)/x');

    37. 

  37. 

    38. 

  38. /**
    39. 

  39.  * Regular expression to match HTML/XML attribute pairs within a tag.
    40. 

  40.  * Allows some... latitude.
    41. 

  41.  * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
    42. 

  42.  */

    43. 

  43. $attrib = '[A-Za-z0-9]';

    44. 

  44. $space = '[\x09\x0a\x0d\x20]';

    45. 

  45. define('MW_ATTRIBS_REGEX', "/(?:^|$space)($attrib+)
    46. 

  46. 	  ($space*=$space*
    47. 

  47. 		(?:
    48. 

  48. 		 # The attribute value: quoted or alone
    49. 

  49. 		  \"([^<\"]*)\"
    50. 

  50. 		 | '([^<']*)'
    51. 

  51. 		 |  ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
    52. 

  52. 		 |  (\#[0-9a-fA-F]+) # Technically wrong, but lots of
    53. 

  53. 							 # colors are specified like this.
    54. 

  54. 							 # We'll be normalizing it.
    55. 

  55. 		)
    56. 

  56. 	   )?(?=$space|\$)/sx");

    57. 

  57. 

    58. 

  58. /**
    59. 

  59.  * List of all named character entities defined in HTML 4.01
    60. 

  60.  * http://www.w3.org/TR/html4/sgml/entities.html
    61. 

  61.  * @private
    62. 

  62.  */

    63. 

  63. global $wgHtmlEntities;

    64. 

  64. $wgHtmlEntities = array('Aacute' => 193, 'aacute' => 225, 'Acirc' => 194, 'acirc' => 226, 'acute' => 180, 

    65. 

  65.         'AElig' => 198, 'aelig' => 230, 'Agrave' => 192, 'agrave' => 224, 'alefsym' => 8501, 'Alpha' => 913, 

    66. 

  66.         'alpha' => 945, 'amp' => 38, 'and' => 8743, 'ang' => 8736, 'Aring' => 197, 'aring' => 229, 'asymp' => 8776, 

    67. 

  67.         'Atilde' => 195, 'atilde' => 227, 'Auml' => 196, 'auml' => 228, 'bdquo' => 8222, 'Beta' => 914, 'beta' => 946, 

    68. 

  68.         'brvbar' => 166, 'bull' => 8226, 'cap' => 8745, 'Ccedil' => 199, 'ccedil' => 231, 'cedil' => 184, 'cent' => 162, 

    69. 

  69.         'Chi' => 935, 'chi' => 967, 'circ' => 710, 'clubs' => 9827, 'cong' => 8773, 'copy' => 169, 'crarr' => 8629, 

    70. 

  70.         'cup' => 8746, 'curren' => 164, 'dagger' => 8224, 'Dagger' => 8225, 'darr' => 8595, 'dArr' => 8659, 'deg' => 176, 

    71. 

  71.         'Delta' => 916, 'delta' => 948, 'diams' => 9830, 'divide' => 247, 'Eacute' => 201, 'eacute' => 233, 

    72. 

  72.         'Ecirc' => 202, 'ecirc' => 234, 'Egrave' => 200, 'egrave' => 232, 'empty' => 8709, 'emsp' => 8195, 

    73. 

  73.         'ensp' => 8194, 'Epsilon' => 917, 'epsilon' => 949, 'equiv' => 8801, 'Eta' => 919, 'eta' => 951, 'ETH' => 208, 

    74. 

  74.         'eth' => 240, 'Euml' => 203, 'euml' => 235, 'euro' => 8364, 'exist' => 8707, 'fnof' => 402, 'forall' => 8704, 

    75. 

  75.         'frac12' => 189, 'frac14' => 188, 'frac34' => 190, 'frasl' => 8260, 'Gamma' => 915, 'gamma' => 947, 'ge' => 8805, 

    76. 

  76.         'gt' => 62, 'harr' => 8596, 'hArr' => 8660, 'hearts' => 9829, 'hellip' => 8230, 'Iacute' => 205, 'iacute' => 237, 

    77. 

  77.         'Icirc' => 206, 'icirc' => 238, 'iexcl' => 161, 'Igrave' => 204, 'igrave' => 236, 'image' => 8465, 

    78. 

  78.         'infin' => 8734, 'int' => 8747, 'Iota' => 921, 'iota' => 953, 'iquest' => 191, 'isin' => 8712, 'Iuml' => 207, 

    79. 

  79.         'iuml' => 239, 'Kappa' => 922, 'kappa' => 954, 'Lambda' => 923, 'lambda' => 955, 'lang' => 9001, 'laquo' => 171, 

    80. 

  80.         'larr' => 8592, 'lArr' => 8656, 'lceil' => 8968, 'ldquo' => 8220, 'le' => 8804, 'lfloor' => 8970, 

    81. 

  81.         'lowast' => 8727, 'loz' => 9674, 'lrm' => 8206, 'lsaquo' => 8249, 'lsquo' => 8216, 'lt' => 60, 'macr' => 175, 

    82. 

  82.         'mdash' => 8212, 'micro' => 181, 'middot' => 183, 'minus' => 8722, 'Mu' => 924, 'mu' => 956, 'nabla' => 8711, 

    83. 

  83.         'nbsp' => 160, 'ndash' => 8211, 'ne' => 8800, 'ni' => 8715, 'not' => 172, 'notin' => 8713, 'nsub' => 8836, 

    84. 

  84.         'Ntilde' => 209, 'ntilde' => 241, 'Nu' => 925, 'nu' => 957, 'Oacute' => 211, 'oacute' => 243, 'Ocirc' => 212, 

    85. 

  85.         'ocirc' => 244, 'OElig' => 338, 'oelig' => 339, 'Ograve' => 210, 'ograve' => 242, 'oline' => 8254, 

    86. 

  86.         'Omega' => 937, 'omega' => 969, 'Omicron' => 927, 'omicron' => 959, 'oplus' => 8853, 'or' => 8744, 'ordf' => 170, 

    87. 

  87.         'ordm' => 186, 'Oslash' => 216, 'oslash' => 248, 'Otilde' => 213, 'otilde' => 245, 'otimes' => 8855, 

    88. 

  88.         'Ouml' => 214, 'ouml' => 246, 'para' => 182, 'part' => 8706, 'permil' => 8240, 'perp' => 8869, 'Phi' => 934, 

    89. 

  89.         'phi' => 966, 'Pi' => 928, 'pi' => 960, 'piv' => 982, 'plusmn' => 177, 'pound' => 163, 'prime' => 8242, 

    90. 

  90.         'Prime' => 8243, 'prod' => 8719, 'prop' => 8733, 'Psi' => 936, 'psi' => 968, 'quot' => 34, 'radic' => 8730, 

    91. 

  91.         'rang' => 9002, 'raquo' => 187, 'rarr' => 8594, 'rArr' => 8658, 'rceil' => 8969, 'rdquo' => 8221, 'real' => 8476, 

    92. 

  92.         'reg' => 174, 'rfloor' => 8971, 'Rho' => 929, 'rho' => 961, 'rlm' => 8207, 'rsaquo' => 8250, 'rsquo' => 8217, 

    93. 

  93.         'sbquo' => 8218, 'Scaron' => 352, 'scaron' => 353, 'sdot' => 8901, 'sect' => 167, 'shy' => 173, 'Sigma' => 931, 

    94. 

  94.         'sigma' => 963, 'sigmaf' => 962, 'sim' => 8764, 'spades' => 9824, 'sub' => 8834, 'sube' => 8838, 'sum' => 8721, 

    95. 

  95.         'sup' => 8835, 'sup1' => 185, 'sup2' => 178, 'sup3' => 179, 'supe' => 8839, 'szlig' => 223, 'Tau' => 932, 

    96. 

  96.         'tau' => 964, 'there4' => 8756, 'Theta' => 920, 'theta' => 952, 'thetasym' => 977, 'thinsp' => 8201, 

    97. 

  97.         'THORN' => 222, 'thorn' => 254, 'tilde' => 732, 'times' => 215, 'trade' => 8482, 'Uacute' => 218, 

    98. 

  98.         'uacute' => 250, 'uarr' => 8593, 'uArr' => 8657, 'Ucirc' => 219, 'ucirc' => 251, 'Ugrave' => 217, 

    99. 

  99.         'ugrave' => 249, 'uml' => 168, 'upsih' => 978, 'Upsilon' => 933, 'upsilon' => 965, 'Uuml' => 220, 'uuml' => 252, 

    100. 

  100.         'weierp' => 8472, 'Xi' => 926, 'xi' => 958, 'Yacute' => 221, 'yacute' => 253, 'yen' => 165, 'Yuml' => 376, 

    101. 

  101.         'yuml' => 255, 'Zeta' => 918, 'zeta' => 950, 'zwj' => 8205, 'zwnj' => 8204);

    102. 

  102. 

    103. 

  103. /**
    104. 

  104.  * Character entity aliases accepted by MediaWiki
    105. 

  105.  */

    106. 

  106. global $wgHtmlEntityAliases;

    107. 

  107. $wgHtmlEntityAliases = array('רלמ' => 'rlm', 'رلم' => 'rlm');

    108. 

  108. 

    109. 

  109. /**
    110. 

  110.  * XHTML sanitizer for MediaWiki
    111. 

  111.  * @ingroup Parser
    112. 

  112.  */

    113. 

  113. class MediawikiSanitizer

    114. 

  114. {

    115. 

  115. 

    116. 

  116.     /**
    117. 

  117.      * Cleans up HTML, removes dangerous tags and attributes, and
    118. 

  118.      * removes HTML comments
    119. 

  119.      * @private
    120. 

  120.      * @param string $text
    121. 

  121.      * @param callback $processCallback to do any variable or parameter replacements in HTML attribute values
    122. 

  122.      * @param array $args for the processing callback
    123. 

  123.      * @return string
    124. 

  124.      */

    125. 

  125.     static function removeHTMLtags($text, $processCallback = null, $args = array(), $extratags = array())

    126. 

  126.     {

    127. 

  127.         global $wgUseTidy;

    128. 

  128.         

    129. 

  129.         static $htmlpairs, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags, $htmllist, $listtags, $htmlsingleallowed, $htmlelements, $staticInitialised;

    130. 

  130.         

    131. 

  131.         wfProfileIn(__METHOD__);

    132. 

  132.         

    133. 

  133.         if (! $staticInitialised)

    134. 

  134.         {

    135. 

  135.             

    136. 

  136.             $htmlpairs = array_merge($extratags, array(# Tags that must be closed
    137. 

  137. 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 

    138. 

  138.                     'sup', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's', 'strike', 'strong', 'tt', 

    139. 

  139.                     'var', 'div', 'center', 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre', 'ruby', 'rt', 

    140. 

  140.                     'rb', 'rp', 'p', 'span', 'u'));

    141. 

  141.             $htmlsingle = array('br', 'hr', 'li', 'dt', 'dd');

    142. 

  142.             $htmlsingleonly = array(# Elements that cannot have close tags
    143. 

  143. 'br', 'hr');

    144. 

  144.             $htmlnest = array(# Tags that can be nested--??
    145. 

  145. 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul', 'dl', 'font', 'big', 'small', 

    146. 

  146.                     'sub', 'sup', 'span');

    147. 

  147.             $tabletags = array(# Can only appear inside table, we will close them
    148. 

  148. 'td', 'th', 'tr');

    149. 

  149.             $htmllist = array(# Tags used by list
    150. 

  150. 'ul', 'ol');

    151. 

  151.             $listtags = array(# Tags that can appear in a list
    152. 

  152. 'li');

    153. 

  153.             

    154. 

  154.             $htmlsingleallowed = array_merge($htmlsingle, $tabletags);

    155. 

  155.             $htmlelements = array_merge($htmlsingle, $htmlpairs, $htmlnest);

    156. 

  156.             

    157. 

  157.             # Convert them all to hashtables for faster lookup
    158. 

  158.             $vars = array('htmlpairs', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags', 'htmllist', 

    159. 

  159.                     'listtags', 'htmlsingleallowed', 'htmlelements');

    160. 

  160.             foreach ($vars as $var)

    161. 

  161.             {

    162. 

  162.                 $$var = array_flip($$var);

    163. 

  163.             }

    164. 

  164.             $staticInitialised = true;

    165. 

  165.         }

    166. 

  166.         

    167. 

  167.         # Remove HTML comments
    168. 

  168.         $text = self :: removeHTMLcomments($text);

    169. 

  169.         $bits = explode('<', $text);

    170. 

  170.         $text = str_replace('>', '&gt;', array_shift($bits));

    171. 

  171.         if (! $wgUseTidy)

    172. 

  172.         {

    173. 

  173.             $tagstack = $tablestack = array();

    174. 

  174.             foreach ($bits as $x)

    175. 

  175.             {

    176. 

  176.                 $regs = array();

    177. 

  177.                 if (preg_match('!^(/?)(\\w+)([^>]*?)(/{0,1}>)([^<]*)$!', $x, $regs))

    178. 

  178.                 {

    179. 

  179.                     list( /* $qbar */, $slash, $t, $params, $brace, $rest) = $regs;

    180. 

  180.                 }

    181. 

  181.                 else

    182. 

  182.                 {

    183. 

  183.                     $slash = $t = $params = $brace = $rest = null;

    184. 

  184.                 }

    185. 

  185.                 

    186. 

  186.                 $badtag = 0;

    187. 

  187.                 if (isset($htmlelements[$t = strtolower($t)]))

    188. 

  188.                 {

    189. 

  189.                     # Check our stack
    190. 

  190.                     if ($slash)

    191. 

  191.                     {

    192. 

  192.                         # Closing a tag...
    193. 

  193.                         if (isset($htmlsingleonly[$t]))

    194. 

  194.                         {

    195. 

  195.                             $badtag = 1;

    196. 

  196.                         }

    197. 

  197.                         elseif (($ot = @array_pop($tagstack)) != $t)

    198. 

  198.                         {

    199. 

  199.                             if (isset($htmlsingleallowed[$ot]))

    200. 

  200.                             {

    201. 

  201.                                 # Pop all elements with an optional close tag
    202. 

  202.                                 # and see if we find a match below them
    203. 

  203.                                 $optstack = array();

    204. 

  204.                                 array_push($optstack, $ot);

    205. 

  205.                                 while ((($ot = @array_pop($tagstack)) != $t) && isset($htmlsingleallowed[$ot]))

    206. 

  206.                                 {

    207. 

  207.                                     array_push($optstack, $ot);

    208. 

  208.                                 }

    209. 

  209.                                 if ($t != $ot)

    210. 

  210.                                 {

    211. 

  211.                                     # No match. Push the optinal elements back again
    212. 

  212.                                     $badtag = 1;

    213. 

  213.                                     while ($ot = @array_pop($optstack))

    214. 

  214.                                     {

    215. 

  215.                                         array_push($tagstack, $ot);

    216. 

  216.                                     }

    217. 

  217.                                 }

    218. 

  218.                             }

    219. 

  219.                             else

    220. 

  220.                             {

    221. 

  221.                                 @array_push($tagstack, $ot);

    222. 

  222.                                 # <li> can be nested in <ul> or <ol>, skip those cases:
    223. 

  223.                                 if (! (isset($htmllist[$ot]) && isset($listtags[$t])))

    224. 

  224.                                 {

    225. 

  225.                                     $badtag = 1;

    226. 

  226.                                 }

    227. 

  227.                             }

    228. 

  228.                         }

    229. 

  229.                         else

    230. 

  230.                         {

    231. 

  231.                             if ($t == 'table')

    232. 

  232.                             {

    233. 

  233.                                 $tagstack = array_pop($tablestack);

    234. 

  234.                             }

    235. 

  235.                         }

    236. 

  236.                         $newparams = '';

    237. 

  237.                     }

    238. 

  238.                     else

    239. 

  239.                     {

    240. 

  240.                         # Keep track for later
    241. 

  241.                         if (isset($tabletags[$t]) && ! in_array('table', $tagstack))

    242. 

  242.                         {

    243. 

  243.                             $badtag = 1;

    244. 

  244.                         }

    245. 

  245.                         else 

    246. 

  246.                             if (in_array($t, $tagstack) && ! isset($htmlnest[$t]))

    247. 

  247.                             {

    248. 

  248.                                 $badtag = 1;

    249. 

  249.                             

    250. 

  250.      # Is it a self closed htmlpair ? (bug 5487)
    251. 

  251.                             }

    252. 

  252.                             else 

    253. 

  253.                                 if ($brace == '/>' && isset($htmlpairs[$t]))

    254. 

  254.                                 {

    255. 

  255.                                     $badtag = 1;

    256. 

  256.                                 }

    257. 

  257.                                 elseif (isset($htmlsingleonly[$t]))

    258. 

  258.                                 {

    259. 

  259.                                     # Hack to force empty tag for uncloseable elements
    260. 

  260.                                     $brace = '/>';

    261. 

  261.                                 }

    262. 

  262.                                 else 

    263. 

  263.                                     if (isset($htmlsingle[$t]))

    264. 

  264.                                     {

    265. 

  265.                                         # Hack to not close $htmlsingle tags
    266. 

  266.                                         $brace = NULL;

    267. 

  267.                                     }

    268. 

  268.                                     else 

    269. 

  269.                                         if (isset($tabletags[$t]) && in_array($t, $tagstack))

    270. 

  270.                                         {

    271. 

  271.                                             // New table tag but forgot to close the previous one
    272. 

  272.                                             $text .= "</$t>";

    273. 

  273.                                         }

    274. 

  274.                                         else

    275. 

  275.                                         {

    276. 

  276.                                             if ($t == 'table')

    277. 

  277.                                             {

    278. 

  278.                                                 array_push($tablestack, $tagstack);

    279. 

  279.                                                 $tagstack = array();

    280. 

  280.                                             }

    281. 

  281.                                             array_push($tagstack, $t);

    282. 

  282.                                         }

    283. 

  283.                         

    284. 

  284.                         # Replace any variables or template parameters with
    285. 

  285.                         # plaintext results.
    286. 

  286.                         if (is_callable($processCallback))

    287. 

  287.                         {

    288. 

  288.                             call_user_func_array($processCallback, array(&$params, $args));

    289. 

  289.                         }

    290. 

  290.                         

    291. 

  291.                         # Strip non-approved attributes from the tag
    292. 

  292.                         $newparams = self :: fixTagAttributes($params, $t);

    293. 

  293.                     }

    294. 

  294.                     if (! $badtag)

    295. 

  295.                     {

    296. 

  296.                         $rest = str_replace('>', '&gt;', $rest);

    297. 

  297.                         $close = ($brace == '/>' && ! $slash) ? ' /' : '';

    298. 

  298.                         $text .= "<$slash$t$newparams$close>$rest";

    299. 

  299.                         continue;

    300. 

  300.                     }

    301. 

  301.                 }

    302. 

  302.                 $text .= '&lt;' . str_replace('>', '&gt;', $x);

    303. 

  303.             }

    304. 

  304.             # Close off any remaining tags
    305. 

  305.             while (is_array($tagstack) && ($t = array_pop($tagstack)))

    306. 

  306.             {

    307. 

  307.                 $text .= "</$t>\n";

    308. 

  308.                 if ($t == 'table')

    309. 

  309.                 {

    310. 

  310.                     $tagstack = array_pop($tablestack);

    311. 

  311.                 }

    312. 

  312.             }

    313. 

  313.         }

    314. 

  314.         else

    315. 

  315.         {

    316. 

  316.             # this might be possible using tidy itself
    317. 

  317.             foreach ($bits as $x)

    318. 

  318.             {

    319. 

  319.                 preg_match('/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/', $x, $regs);

    320. 

  320.                 @list( /* $qbar */, $slash, $t, $params, $brace, $rest) = $regs;

    321. 

  321.                 if (isset($htmlelements[$t = strtolower($t)]))

    322. 

  322.                 {

    323. 

  323.                     if (is_callable($processCallback))

    324. 

  324.                     {

    325. 

  325.                         call_user_func_array($processCallback, array(&$params, $args));

    326. 

  326.                     }

    327. 

  327.                     $newparams = self :: fixTagAttributes($params, $t);

    328. 

  328.                     $rest = str_replace('>', '&gt;', $rest);

    329. 

  329.                     $text .= "<$slash$t$newparams$brace$rest";

    330. 

  330.                 }

    331. 

  331.                 else

    332. 

  332.                 {

    333. 

  333.                     $text .= '&lt;' . str_replace('>', '&gt;', $x);

    334. 

  334.                 }

    335. 

  335.             }

    336. 

  336.         }

    337. 

  337.         wfProfileOut(__METHOD__);

    338. 

  338.         return $text;

    339. 

  339.     }

    340. 

  340. 

    341. 

  341.     /**
    342. 

  342.      * Remove '<!--', '-->', and everything between.
    343. 

  343.      * To avoid leaving blank lines, when a comment is both preceded
    344. 

  344.      * and followed by a newline (ignoring spaces), trim leading and
    345. 

  345.      * trailing spaces and one of the newlines.
    346. 

  346.      *
    347. 

  347.      * @private
    348. 

  348.      * @param string $text
    349. 

  349.      * @return string
    350. 

  350.      */

    351. 

  351.     static function removeHTMLcomments($text)

    352. 

  352.     {

    353. 

  353.         wfProfileIn(__METHOD__);

    354. 

  354.         while (($start = strpos($text, '<!--')) !== false)

    355. 

  355.         {

    356. 

  356.             $end = strpos($text, '-->', $start + 4);

    357. 

  357.             if ($end === false)

    358. 

  358.             {

    359. 

  359.                 # Unterminated comment; bail out
    360. 

  360.                 break;

    361. 

  361.             }

    362. 

  362.             

    363. 

  363.             $end += 3;

    364. 

  364.             

    365. 

  365.             # Trim space and newline if the comment is both
    366. 

  366.             # preceded and followed by a newline
    367. 

  367.             $spaceStart = max($start - 1, 0);

    368. 

  368.             $spaceLen = $end - $spaceStart;

    369. 

  369.             while (substr($text, $spaceStart, 1) === ' ' && $spaceStart > 0)

    370. 

  370.             {

    371. 

  371.                 $spaceStart --;

    372. 

  372.                 $spaceLen ++;

    373. 

  373.             }

    374. 

  374.             while (substr($text, $spaceStart + $spaceLen, 1) === ' ')

    375. 

  375.                 $spaceLen ++;

    376. 

  376.             if (substr($text, $spaceStart, 1) === "\n" and substr($text, $spaceStart + $spaceLen, 1) === "\n")

    377. 

  377.             {

    378. 

  378.                 # Remove the comment, leading and trailing
    379. 

  379.                 # spaces, and leave only one newline.
    380. 

  380.                 $text = substr_replace($text, "\n", $spaceStart, $spaceLen + 1);

    381. 

  381.             }

    382. 

  382.             else

    383. 

  383.             {

    384. 

  384.                 # Remove just the comment.
    385. 

  385.                 $text = substr_replace($text, '', $start, $end - $start);

    386. 

  386.             }

    387. 

  387.         }

    388. 

  388.         wfProfileOut(__METHOD__);

    389. 

  389.         return $text;

    390. 

  390.     }

    391. 

  391. 

    392. 

  392.     /**
    393. 

  393.      * Take an array of attribute names and values and normalize or discard
    394. 

  394.      * illegal values for the given element type.
    395. 

  395.      *
    396. 

  396.      * - Discards attributes not on a whitelist for the given element
    397. 

  397.      * - Unsafe style attributes are discarded
    398. 

  398.      * - Invalid id attributes are reencoded
    399. 

  399.      *
    400. 

  400.      * @param array $attribs
    401. 

  401.      * @param string $element
    402. 

  402.      * @return array
    403. 

  403.      *
    404. 

  404.      * @todo Check for legal values where the DTD limits things.
    405. 

  405.      * @todo Check for unique id attribute :P
    406. 

  406.      */

    407. 

  407.     static function validateTagAttributes($attribs, $element)

    408. 

  408.     {

    409. 

  409.         return self :: validateAttributes($attribs, self :: attributeWhitelist($element));

    410. 

  410.     }

    411. 

  411. 

    412. 

  412.     /**
    413. 

  413.      * Take an array of attribute names and values and normalize or discard
    414. 

  414.      * illegal values for the given whitelist.
    415. 

  415.      *
    416. 

  416.      * - Discards attributes not the given whitelist
    417. 

  417.      * - Unsafe style attributes are discarded
    418. 

  418.      * - Invalid id attributes are reencoded
    419. 

  419.      *
    420. 

  420.      * @param array $attribs
    421. 

  421.      * @param array $whitelist list of allowed attribute names
    422. 

  422.      * @return array
    423. 

  423.      *
    424. 

  424.      * @todo Check for legal values where the DTD limits things.
    425. 

  425.      * @todo Check for unique id attribute :P
    426. 

  426.      */

    427. 

  427.     static function validateAttributes($attribs, $whitelist)

    428. 

  428.     {

    429. 

  429.         $whitelist = array_flip($whitelist);

    430. 

  430.         $out = array();

    431. 

  431.         foreach ($attribs as $attribute => $value)

    432. 

  432.         {

    433. 

  433.             if (! isset($whitelist[$attribute]))

    434. 

  434.             {

    435. 

  435.                 continue;

    436. 

  436.             }

    437. 

  437.             # Strip javascript "expression" from stylesheets.
    438. 

  438.             # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
    439. 

  439.             if ($attribute == 'style')

    440. 

  440.             {

    441. 

  441.                 $value = self :: checkCss($value);

    442. 

  442.             }

    443. 

  443.             

    444. 

  444.             if ($attribute === 'id')

    445. 

  445.             {

    446. 

  446.                 global $wgEnforceHtmlIds;

    447. 

  447.                 $value = self :: escapeId($value, $wgEnforceHtmlIds ? 'noninitial' : 'xml');

    448. 

  448.             }

    449. 

  449.             

    450. 

  450.             // If this attribute was previously set, override it.
    451. 

  451.             // Output should only have one attribute of each name.
    452. 

  452.             $out[$attribute] = $value;

    453. 

  453.         }

    454. 

  454.         return $out;

    455. 

  455.     }

    456. 

  456. 

    457. 

  457.     /**
    458. 

  458.      * Merge two sets of HTML attributes.  Conflicting items in the second set
    459. 

  459.      * will override those in the first, except for 'class' attributes which
    460. 

  460.      * will be combined (if they're both strings).
    461. 

  461.      *
    462. 

  462.      * @todo implement merging for other attributes such as style
    463. 

  463.      * @param array $a
    464. 

  464.      * @param array $b
    465. 

  465.      * @return array
    466. 

  466.      */

    467. 

  467.     static function mergeAttributes($a, $b)

    468. 

  468.     {

    469. 

  469.         $out = array_merge($a, $b);

    470. 

  470.         if (isset($a['class']) && isset($b['class']) && is_string($a['class']) && is_string($b['class']) && $a['class'] !== $b['class'])

    471. 

  471.         {

    472. 

  472.             $classes = preg_split('/\s+/', "{$a['class']} {$b['class']}", - 1, PREG_SPLIT_NO_EMPTY);

    473. 

  473.             $out['class'] = implode(' ', array_unique($classes));

    474. 

  474.         }

    475. 

  475.         return $out;

    476. 

  476.     }

    477. 

  477. 

    478. 

  478.     /**
    479. 

  479.      * Pick apart some CSS and check it for forbidden or unsafe structures.
    480. 

  480.      * Returns a sanitized string, or false if it was just too evil.
    481. 

  481.      *
    482. 

  482.      * Currently URL references, 'expression', 'tps' are forbidden.
    483. 

  483.      *
    484. 

  484.      * @param string $value
    485. 

  485.      * @return mixed
    486. 

  486.      */

    487. 

  487.     static function checkCss($value)

    488. 

  488.     {

    489. 

  489.         $value = self :: decodeCharReferences($value);

    490. 

  490.         

    491. 

  491.         // Remove any comments; IE gets token splitting wrong
    492. 

  492.         $value = MediawikiStringUtils :: delimiterReplace('/*', '*/', ' ', $value);

    493. 

  493.         

    494. 

  494.         // Decode escape sequences and line continuation
    495. 

  495.         // See the grammar in the CSS 2 spec, appendix D.
    496. 

  496.         static $decodeRegex, $reencodeTable;

    497. 

  497.         if (! $decodeRegex)

    498. 

  498.         {

    499. 

  499.             $space = '[\\x20\\t\\r\\n\\f]';

    500. 

  500.             $nl = '(?:\\n|\\r\\n|\\r|\\f)';

    501. 

  501.             $backslash = '\\\\';

    502. 

  502.             $decodeRegex = "/ $backslash
    503. 

  503. 				(?:
    504. 

  504. 					($nl) |  # 1. Line continuation
    505. 

  505. 					([0-9A-Fa-f]{1,6})$space? |  # 2. character number
    506. 

  506. 					(.) | # 3. backslash cancelling special meaning
    507. 

  507. 					() | # 4. backslash at end of string
    508. 

  508. 				)/xu";

    509. 

  509.         }

    510. 

  510.         $value = preg_replace_callback($decodeRegex, array(__CLASS__, 'cssDecodeCallback'), $value);

    511. 

  511.         

    512. 

  512.         // Reject problematic keywords and control characters
    513. 

  513.         if (preg_match('/[\000-\010\016-\037\177]/', $value))

    514. 

  514.         {

    515. 

  515.             return '/* invalid control char */';

    516. 

  516.         }

    517. 

  517.         elseif (preg_match('! expression | filter\s*: | accelerator\s*: | url\s*\( !ix', $value))

    518. 

  518.         {

    519. 

  519.             return '/* insecure input */';

    520. 

  520.         }

    521. 

  521.         return $value;

    522. 

  522.     }

    523. 

  523. 

    524. 

  524.     static function cssDecodeCallback($matches)

    525. 

  525.     {

    526. 

  526.         if ($matches[1] !== '')

    527. 

  527.         {

    528. 

  528.             // Line continuation
    529. 

  529.             return '';

    530. 

  530.         }

    531. 

  531.         elseif ($matches[2] !== '')

    532. 

  532.         {

    533. 

  533.             $char = codepointToUtf8(hexdec($matches[2]));

    534. 

  534.         }

    535. 

  535.         elseif ($matches[3] !== '')

    536. 

  536.         {

    537. 

  537.             $char = $matches[3];

    538. 

  538.         }

    539. 

  539.         else

    540. 

  540.         {

    541. 

  541.             $char = '\\';

    542. 

  542.         }

    543. 

  543.         if ($char == "\n" || $char == '"' || $char == "'" || $char == '\\')

    544. 

  544.         {

    545. 

  545.             // These characters need to be escaped in strings
    546. 

  546.             // Clean up the escape sequence to avoid parsing errors by clients
    547. 

  547.             return '\\' . dechex(ord($char)) . ' ';

    548. 

  548.         }

    549. 

  549.         else

    550. 

  550.         {

    551. 

  551.             // Decode unnecessary escape
    552. 

  552.             return $char;

    553. 

  553.         }

    554. 

  554.     }

    555. 

  555. 

    556. 

  556.     /**
    557. 

  557.      * Take a tag soup fragment listing an HTML element's attributes
    558. 

  558.      * and normalize it to well-formed XML, discarding unwanted attributes.
    559. 

  559.      * Output is safe for further wikitext processing, with escaping of
    560. 

  560.      * values that could trigger problems.
    561. 

  561.      *
    562. 

  562.      * - Normalizes attribute names to lowercase
    563. 

  563.      * - Discards attributes not on a whitelist for the given element
    564. 

  564.      * - Turns broken or invalid entities into plaintext
    565. 

  565.      * - Double-quotes all attribute values
    566. 

  566.      * - Attributes without values are given the name as attribute
    567. 

  567.      * - Double attributes are discarded
    568. 

  568.      * - Unsafe style attributes are discarded
    569. 

  569.      * - Prepends space if there are attributes.
    570. 

  570.      *
    571. 

  571.      * @param string $text
    572. 

  572.      * @param string $element
    573. 

  573.      * @return string
    574. 

  574.      */

    575. 

  575.     static function fixTagAttributes($text, $element)

    576. 

  576.     {

    577. 

  577.         if (trim($text) == '')

    578. 

  578.         {

    579. 

  579.             return '';

    580. 

  580.         }

    581. 

  581.         

    582. 

  582.         $stripped = self :: validateTagAttributes(self :: decodeTagAttributes($text), $element);

    583. 

  583.         

    584. 

  584.         $attribs = array();

    585. 

  585.         foreach ($stripped as $attribute => $value)

    586. 

  586.         {

    587. 

  587.             $encAttribute = htmlspecialchars($attribute);

    588. 

  588.             $encValue = self :: safeEncodeAttribute($value);

    589. 

  589.             

    590. 

  590.             $attribs[] = "$encAttribute=\"$encValue\"";

    591. 

  591.         }

    592. 

  592.         return count($attribs) ? ' ' . implode(' ', $attribs) : '';

    593. 

  593.     }

    594. 

  594. 

    595. 

  595.     /**
    596. 

  596.      * Encode an attribute value for HTML output.
    597. 

  597.      * @param $text
    598. 

  598.      * @return HTML-encoded text fragment
    599. 

  599.      */

    600. 

  600.     static function encodeAttribute($text)

    601. 

  601.     {

    602. 

  602.         $encValue = htmlspecialchars($text, ENT_QUOTES);

    603. 

  603.         

    604. 

  604.         // Whitespace is normalized during attribute decoding,
    605. 

  605.         // so if we've been passed non-spaces we must encode them
    606. 

  606.         // ahead of time or they won't be preserved.
    607. 

  607.         $encValue = strtr($encValue, array("\n" => '&#10;', "\r" => '&#13;', "\t" => '&#9;'));

    608. 

  608.         

    609. 

  609.         return $encValue;

    610. 

  610.     }

    611. 

  611. 

    612. 

  612.     /**
    613. 

  613.      * Encode an attribute value for HTML tags, with extra armoring
    614. 

  614.      * against further wiki processing.
    615. 

  615.      * @param $text
    616. 

  616.      * @return HTML-encoded text fragment
    617. 

  617.      */

    618. 

  618.     static function safeEncodeAttribute($text)

    619. 

  619.     {

    620. 

  620.         $encValue = self :: encodeAttribute($text);

    621. 

  621.         

    622. 

  622.         # Templates and links may be expanded in later parsing,
    623. 

  623.         # creating invalid or dangerous output. Suppress this.
    624. 

  624.         $encValue = strtr($encValue, array('<' => '&lt;', // This should never happen,
    625. 

  625. '>' => '&gt;', // we've received invalid input
    626. 

  626. '"' => '&quot;',  // which should have been escaped.
    627. 

  627.                 '{' => '&#123;', '[' => '&#91;', "''" => '&#39;&#39;', 'ISBN' => '&#73;SBN', 

    628. 

  628.                 'RFC' => '&#82;FC', 'PMID' => '&#80;MID', '|' => '&#124;', '__' => '&#95;_'));

    629. 

  629.         

    630. 

  630.         # Stupid hack
    631. 

  631.         $encValue = preg_replace_callback('/(' . wfUrlProtocols() . ')/', array('MediawikiSanitizer', 

    632. 

  632.                 'armorLinksCallback'), $encValue);

    633. 

  633.         return $encValue;

    634. 

  634.     }

    635. 

  635. 

    636. 

  636.     /**
    637. 

  637.      * Given a value escape it so that it can be used in an id attribute and
    638. 

  638.      * return it, this does not validate the value however (see first link)
    639. 

  639.      *
    640. 

  640.      * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters
    641. 

  641.      * in the id and
    642. 

  642.      * name attributes
    643. 

  643.      * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
    644. 

  644.      *
    645. 

  645.      * @param string $id      Id to validate
    646. 

  646.      * @param mixed  $options String or array of strings (default is array()):
    647. 

  647.      * 'noninitial': This is a non-initial fragment of an id, not a full id,
    648. 

  648.      * so don't pay attention if the first character isn't valid at the
    649. 

  649.      * beginning of an id.
    650. 

  650.      * 'xml': Don't restrict the id to be HTML4-compatible.  This option
    651. 

  651.      * allows any alphabetic character to be used, per the XML standard.
    652. 

  652.      * Therefore, it also completely changes the type of escaping: instead
    653. 

  653.      * of weird dot-encoding, runs of invalid characters (mostly
    654. 

  654.      * whitespace) are just compressed into a single underscore.
    655. 

  655.      * @return string
    656. 

  656.      */

    657. 

  657.     static function escapeId($id, $options = array())

    658. 

  658.     {

    659. 

  659.         $options = (array) $options;

    660. 

  660.         

    661. 

  661.         if (! in_array('xml', $options))

    662. 

  662.         {

    663. 

  663.             # HTML4-style escaping
    664. 

  664.             static $replace = array('%3A' => ':', '%' => '.');

    665. 

  665.             

    666. 

  666.             $id = urlencode(self :: decodeCharReferences(strtr($id, ' ', '_')));

    667. 

  667.             $id = str_replace(array_keys($replace), array_values($replace), $id);

    668. 

  668.             

    669. 

  669.             if (! preg_match('/^[a-zA-Z]/', $id) && ! in_array('noninitial', $options))

    670. 

  670.             {

    671. 

  671.                 // Initial character must be a letter!
    672. 

  672.                 $id = "x$id";

    673. 

  673.             }

    674. 

  674.             return $id;

    675. 

  675.         }

    676. 

  676.         

    677. 

  677.         # XML-style escaping.  For the patterns used, see the XML 1.0 standard,
    678. 

  678.         # 5th edition, NameStartChar and NameChar: <http://www.w3.org/TR/REC-xml/>
    679. 

  679.         $nameStartChar = ':a-zA-Z_\xC0-\xD6\xD8-\xF6\xF8-\x{2FF}\x{370}-\x{37D}' . '\x{37F}-\x{1FFF}\x{200C}-\x{200D}\x{2070}-\x{218F}\x{2C00}-\x{2FEF}' . '\x{3001}-\x{D7FF}\x{F900}-\x{FDCF}\x{FDF0}-\x{FFFD}\x{10000}-\x{EFFFF}';

    680. 

  680.         $nameChar = $nameStartChar . '.\-0-9\xB7\x{0300}-\x{036F}' . '\x{203F}-\x{2040}';

    681. 

  681.         # Replace _ as well so we don't get multiple consecutive underscores
    682. 

  682.         $id = preg_replace("/([^$nameChar]|_)+/u", '_', $id);

    683. 

  683.         $id = trim($id, '_');

    684. 

  684.         

    685. 

  685.         if (! preg_match("/^[$nameStartChar]/u", $id) && ! in_array('noninitial', $options))

    686. 

  686.         {

    687. 

  687.             $id = "_$id";

    688. 

  688.         }

    689. 

  689.         

    690. 

  690.         return $id;

    691. 

  691.     }

    692. 

  692. 

    693. 

  693.     /**
    694. 

  694.      * Given a value, escape it so that it can be used as a CSS class and
    695. 

  695.      * return it.
    696. 

  696.      *
    697. 

  697.      * @todo For extra validity, input should be validated UTF-8.
    698. 

  698.      *
    699. 

  699.      * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format
    700. 

  700.      *
    701. 

  701.      * @param string $class
    702. 

  702.      * @return string
    703. 

  703.      */

    704. 

  704.     static function escapeClass($class)

    705. 

  705.     {

    706. 

  706.         // Convert ugly stuff to underscores and kill underscores in ugly places
    707. 

  707.         return rtrim(preg_replace(array(

    708. 

  708.                 '/(^[0-9\\-])|[\\x00-\\x20!"#$%&\'()*+,.\\/:;<=>?@[\\]^`{|}~]|\\xC2\\xA0/', '/_+/'), '_', $class), '_');

    709. 

  709.     }

    710. 

  710. 

    711. 

  711.     /**
    712. 

  712.      * Given HTML input, escape with htmlspecialchars but un-escape entites.
    713. 

  713.      * This allows (generally harmless) entities like &nbsp; to survive.
    714. 

  714.      *
    715. 

  715.      * @param  string $html String to escape
    716. 

  716.      * @return string Escaped input
    717. 

  717.      */

    718. 

  718.     static function escapeHtmlAllowEntities($html)

    719. 

  719.     {

    720. 

  720.         # It seems wise to escape ' as well as ", as a matter of course.  Can't
    721. 

  721.         # hurt.
    722. 

  722.         $html = htmlspecialchars($html, ENT_QUOTES);

    723. 

  723.         $html = str_replace('&amp;', '&', $html);

    724. 

  724.         $html = self :: normalizeCharReferences($html);

    725. 

  725.         return $html;

    726. 

  726.     }

    727. 

  727. 

    728. 

  728.     /**
    729. 

  729.      * Regex replace callback for armoring links against further processing.
    730. 

  730.      * @param array $matches
    731. 

  731.      * @return string
    732. 

  732.      * @private
    733. 

  733.      */

    734. 

  734.     private static function armorLinksCallback($matches)

    735. 

  735.     {

    736. 

  736.         return str_replace(':', '&#58;', $matches[1]);

    737. 

  737.     }

    738. 

  738. 

    739. 

  739.     /**
    740. 

  740.      * Return an associative array of attribute names and values from
    741. 

  741.      * a partial tag string. Attribute names are forces to lowercase,
    742. 

  742.      * character references are decoded to UTF-8 text.
    743. 

  743.      *
    744. 

  744.      * @param string
    745. 

  745.      * @return array
    746. 

  746.      */

    747. 

  747.     public static function decodeTagAttributes($text)

    748. 

  748.     {

    749. 

  749.         $attribs = array();

    750. 

  750.         

    751. 

  751.         if (trim($text) == '')

    752. 

  752.         {

    753. 

  753.             return $attribs;

    754. 

  754.         }

    755. 

  755.         

    756. 

  756.         $pairs = array();

    757. 

  757.         if (! preg_match_all(MW_ATTRIBS_REGEX, $text, $pairs, PREG_SET_ORDER))

    758. 

  758.         {

    759. 

  759.             return $attribs;

    760. 

  760.         }

    761. 

  761.         

    762. 

  762.         foreach ($pairs as $set)

    763. 

  763.         {

    764. 

  764.             $attribute = strtolower($set[1]);

    765. 

  765.             $value = self :: getTagAttributeCallback($set);

    766. 

  766.             

    767. 

  767.             // Normalize whitespace
    768. 

  768.             $value = preg_replace('/[\t\r\n ]+/', ' ', $value);

    769. 

  769.             $value = trim($value);

    770. 

  770.             

    771. 

  771.             // Decode character references
    772. 

  772.             $attribs[$attribute] = self :: decodeCharReferences($value);

    773. 

  773.         }

    774. 

  774.         return $attribs;

    775. 

  775.     }

    776. 

  776. 

    777. 

  777.     /**
    778. 

  778.      * Pick the appropriate attribute value from a match set from the
    779. 

  779.      * MW_ATTRIBS_REGEX matches.
    780. 

  780.      *
    781. 

  781.      * @param array $set
    782. 

  782.      * @return string
    783. 

  783.      * @private
    784. 

  784.      */

    785. 

  785.     private static function getTagAttributeCallback($set)

    786. 

  786.     {

    787. 

  787.         if (isset($set[6]))

    788. 

  788.         {

    789. 

  789.             # Illegal #XXXXXX color with no quotes.
    790. 

  790.             return $set[6];

    791. 

  791.         }

    792. 

  792.         elseif (isset($set[5]))

    793. 

  793.         {

    794. 

  794.             # No quotes.
    795. 

  795.             return $set[5];

    796. 

  796.         }

    797. 

  797.         elseif (isset($set[4]))

    798. 

  798.         {

    799. 

  799.             # Single-quoted
    800. 

  800.             return $set[4];

    801. 

  801.         }

    802. 

  802.         elseif (isset($set[3]))

    803. 

  803.         {

    804. 

  804.             # Double-quoted
    805. 

  805.             return $set[3];

    806. 

  806.         }

    807. 

  807.         elseif (! isset($set[2]))

    808. 

  808.         {

    809. 

  809.             # In XHTML, attributes must have a value.
    810. 

  810.             # For 'reduced' form, return explicitly the attribute name here.
    811. 

  811.             return $set[1];

    812. 

  812.         }

    813. 

  813.         else

    814. 

  814.         {

    815. 

  815.             throw new MWException("Tag conditions not met. This should never happen and is a bug.");

    816. 

  816.         }

    817. 

  817.     }

    818. 

  818. 

    819. 

  819.     /**
    820. 

  820.      * Normalize whitespace and character references in an XML source-
    821. 

  821.      * encoded text for an attribute value.
    822. 

  822.      *
    823. 

  823.      * See http://www.w3.org/TR/REC-xml/#AVNormalize for background,
    824. 

  824.      * but note that we're not returning the value, but are returning
    825. 

  825.      * XML source fragments that will be slapped into output.
    826. 

  826.      *
    827. 

  827.      * @param string $text
    828. 

  828.      * @return string
    829. 

  829.      * @private
    830. 

  830.      */

    831. 

  831.     private static function normalizeAttributeValue($text)

    832. 

  832.     {

    833. 

  833.         return str_replace('"', '&quot;', self :: normalizeWhitespace(self :: normalizeCharReferences($text)));

    834. 

  834.     }

    835. 

  835. 

    836. 

  836.     private static function normalizeWhitespace($text)

    837. 

  837.     {

    838. 

  838.         return preg_replace('/\r\n|[\x20\x0d\x0a\x09]/', ' ', $text);

    839. 

  839.     }

    840. 

  840. 

    841. 

  841.     /**
    842. 

  842.      * Ensure that any entities and character references are legal
    843. 

  843.      * for XML and XHTML specifically. Any stray bits will be
    844. 

  844.      * &amp;-escaped to result in a valid text fragment.
    845. 

  845.      *
    846. 

  846.      * a. any named char refs must be known in XHTML
    847. 

  847.      * b. any numeric char refs must be legal chars, not invalid or forbidden
    848. 

  848.      * c. use &#x, not &#X
    849. 

  849.      * d. fix or reject non-valid attributes
    850. 

  850.      *
    851. 

  851.      * @param string $text
    852. 

  852.      * @return string
    853. 

  853.      * @private
    854. 

  854.      */

    855. 

  855.     static function normalizeCharReferences($text)

    856. 

  856.     {

    857. 

  857.         return preg_replace_callback(MW_CHAR_REFS_REGEX, array('Sanitizer', 'normalizeCharReferencesCallback'), $text);

    858. 

  858.     }

    859. 

  859. 

    860. 

  860.     /**
    861. 

  861.      * @param string $matches
    862. 

  862.      * @return string
    863. 

  863.      */

    864. 

  864.     static function normalizeCharReferencesCallback($matches)

    865. 

  865.     {

    866. 

  866.         $ret = null;

    867. 

  867.         if ($matches[1] != '')

    868. 

  868.         {

    869. 

  869.             $ret = self :: normalizeEntity($matches[1]);

    870. 

  870.         }

    871. 

  871.         elseif ($matches[2] != '')

    872. 

  872.         {

    873. 

  873.             $ret = self :: decCharReference($matches[2]);

    874. 

  874.         }

    875. 

  875.         elseif ($matches[3] != '')

    876. 

  876.         {

    877. 

  877.             $ret = self :: hexCharReference($matches[3]);

    878. 

  878.         }

    879. 

  879.         elseif ($matches[4] != '')

    880. 

  880.         {

    881. 

  881.             $ret = self :: hexCharReference($matches[4]);

    882. 

  882.         }

    883. 

  883.         if (is_null($ret))

    884. 

  884.         {

    885. 

  885.             return htmlspecialchars($matches[0]);

    886. 

  886.         }

    887. 

  887.         else

    888. 

  888.         {

    889. 

  889.             return $ret;

    890. 

  890.         }

    891. 

  891.     }

    892. 

  892. 

    893. 

  893.     /**
    894. 

  894.      * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
    895. 

  895.      * return the named entity reference as is. If the entity is a
    896. 

  896.      * MediaWiki-specific alias, returns the HTML equivalent. Otherwise,
    897. 

  897.      * returns HTML-escaped text of pseudo-entity source (eg &amp;foo;)
    898. 

  898.      *
    899. 

  899.      * @param string $name
    900. 

  900.      * @return string
    901. 

  901.      * @static
    902. 

  902.      */

    903. 

  903.     static function normalizeEntity($name)

    904. 

  904.     {

    905. 

  905.         global $wgHtmlEntities, $wgHtmlEntityAliases;

    906. 

  906.         if (isset($wgHtmlEntityAliases[$name]))

    907. 

  907.         {

    908. 

  908.             return "&{$wgHtmlEntityAliases[$name]};";

    909. 

  909.         }

    910. 

  910.         elseif (isset($wgHtmlEntities[$name]))

    911. 

  911.         {

    912. 

  912.             return "&$name;";

    913. 

  913.         }

    914. 

  914.         else

    915. 

  915.         {

    916. 

  916.             return "&amp;$name;";

    917. 

  917.         }

    918. 

  918.     }

    919. 

  919. 

    920. 

  920.     static function decCharReference($codepoint)

    921. 

  921.     {

    922. 

  922.         $point = intval($codepoint);

    923. 

  923.         if (self :: validateCodepoint($point))

    924. 

  924.         {

    925. 

  925.             return sprintf('&#%d;', $point);

    926. 

  926.         }

    927. 

  927.         else

    928. 

  928.         {

    929. 

  929.             return null;

    930. 

  930.         }

    931. 

  931.     }

    932. 

  932. 

    933. 

  933.     static function hexCharReference($codepoint)

    934. 

  934.     {

    935. 

  935.         $point = hexdec($codepoint);

    936. 

  936.         if (self :: validateCodepoint($point))

    937. 

  937.         {

    938. 

  938.             return sprintf('&#x%x;', $point);

    939. 

  939.         }

    940. 

  940.         else

    941. 

  941.         {

    942. 

  942.             return null;

    943. 

  943.         }

    944. 

  944.     }

    945. 

  945. 

    946. 

  946.     /**
    947. 

  947.      * Returns true if a given Unicode codepoint is a valid character in XML.
    948. 

  948.      * @param int $codepoint
    949. 

  949.      * @return bool
    950. 

  950.      */

    951. 

  951.     private static function validateCodepoint($codepoint)

    952. 

  952.     {

    953. 

  953.         return ($codepoint == 0x09) || ($codepoint == 0x0a) || ($codepoint == 0x0d) || ($codepoint >= 0x20 && $codepoint <= 0xd7ff) || ($codepoint >= 0xe000 && $codepoint <= 0xfffd) || ($codepoint >= 0x10000 && $codepoint <= 0x10ffff);

    954. 

  954.     }

    955. 

  955. 

    956. 

  956.     /**
    957. 

  957.      * Decode any character references, numeric or named entities,
    958. 

  958.      * in the text and return a UTF-8 string.
    959. 

  959.      *
    960. 

  960.      * @param string $text
    961. 

  961.      * @return string
    962. 

  962.      * @public
    963. 

  963.      * @static
    964. 

  964.      */

    965. 

  965.     public static function decodeCharReferences($text)

    966. 

  966.     {

    967. 

  967.         return preg_replace_callback(MW_CHAR_REFS_REGEX, array('MediawikiSanitizer', 'decodeCharReferencesCallback'), $text);

    968. 

  968.     }

    969. 

  969. 

    970. 

  970.     /**
    971. 

  971.      * @param string $matches
    972. 

  972.      * @return string
    973. 

  973.      */

    974. 

  974.     static function decodeCharReferencesCallback($matches)

    975. 

  975.     {

    976. 

  976.         if ($matches[1] != '')

    977. 

  977.         {

    978. 

  978.             return self :: decodeEntity($matches[1]);

    979. 

  979.         }

    980. 

  980.         elseif ($matches[2] != '')

    981. 

  981.         {

    982. 

  982.             return self :: decodeChar(intval($matches[2]));

    983. 

  983.         }

    984. 

  984.         elseif ($matches[3] != '')

    985. 

  985.         {

    986. 

  986.             return self :: decodeChar(hexdec($matches[3]));

    987. 

  987.         }

    988. 

  988.         elseif ($matches[4] != '')

    989. 

  989.         {

    990. 

  990.             return self :: decodeChar(hexdec($matches[4]));

    991. 

  991.         }

    992. 

  992.         # Last case should be an ampersand by itself
    993. 

  993.         return $matches[0];

    994. 

  994.     }

    995. 

  995. 

    996. 

  996.     /**
    997. 

  997.      * Return UTF-8 string for a codepoint if that is a valid
    998. 

  998.      * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
    999. 

  999.      * @param int $codepoint
    1000. 

  1000.      * @return string
    1001. 

  1001.      * @private
    1002. 

  1002.      */

    1003. 

  1003.     static function decodeChar($codepoint)

    1004. 

  1004.     {

    1005. 

  1005.         if (self :: validateCodepoint($codepoint))

    1006. 

  1006.         {

    1007. 

  1007.             return MediawikiUtilities :: codepointToUtf8($codepoint);

    1008. 

  1008.         }

    1009. 

  1009.         else

    1010. 

  1010.         {

    1011. 

  1011.             return UTF8_REPLACEMENT;

    1012. 

  1012.         }

    1013. 

  1013.     }

    1014. 

  1014. 

    1015. 

  1015.     /**
    1016. 

  1016.      * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
    1017. 

  1017.      * return the UTF-8 encoding of that character. Otherwise, returns
    1018. 

  1018.      * pseudo-entity source (eg &foo;)
    1019. 

  1019.      *
    1020. 

  1020.      * @param string $name
    1021. 

  1021.      * @return string
    1022. 

  1022.      */

    1023. 

  1023.     static function decodeEntity($name)

    1024. 

  1024.     {

    1025. 

  1025.         global $wgHtmlEntities, $wgHtmlEntityAliases;

    1026. 

  1026.         if (isset($wgHtmlEntityAliases[$name]))

    1027. 

  1027.         {

    1028. 

  1028.             $name = $wgHtmlEntityAliases[$name];

    1029. 

  1029.         }

    1030. 

  1030.         if (isset($wgHtmlEntities[$name]))

    1031. 

  1031.         {

    1032. 

  1032.             return MediawikiUtilities :: codepointToUtf8($wgHtmlEntities[$name]);

    1033. 

  1033.         }

    1034. 

  1034.         else

    1035. 

  1035.         {

    1036. 

  1036.             return "&$name;";

    1037. 

  1037.         }

    1038. 

  1038.     }

    1039. 

  1039. 

    1040. 

  1040.     /**
    1041. 

  1041.      * Fetch the whitelist of acceptable attributes for a given
    1042. 

  1042.      * element name.
    1043. 

  1043.      *
    1044. 

  1044.      * @param string $element
    1045. 

  1045.      * @return array
    1046. 

  1046.      */

    1047. 

  1047.     static function attributeWhitelist($element)

    1048. 

  1048.     {

    1049. 

  1049.         static $list;

    1050. 

  1050.         if (! isset($list))

    1051. 

  1051.         {

    1052. 

  1052.             $list = self :: setupAttributeWhitelist();

    1053. 

  1053.         }

    1054. 

  1054.         return isset($list[$element]) ? $list[$element] : array();

    1055. 

  1055.     }

    1056. 

  1056. 

    1057. 

  1057.     /**
    1058. 

  1058.      * Foreach array key (an allowed HTML element), return an array
    1059. 

  1059.      * of allowed attributes
    1060. 

  1060.      * @return array
    1061. 

  1061.      */

    1062. 

  1062.     static function setupAttributeWhitelist()

    1063. 

  1063.     {

    1064. 

  1064.         $common = array('id', 'class', 'lang', 'dir', 'title', 'style');

    1065. 

  1065.         $block = array_merge($common, array('align'));

    1066. 

  1066.         $tablealign = array('align', 'char', 'charoff', 'valign');

    1067. 

  1067.         $tablecell = array('abbr', 'axis', 'headers', 'scope', 'rowspan', 'colspan', 'nowrap', # deprecated
    1068. 

  1068. 'width', # deprecated
    1069. 

  1069. 'height',  # deprecated
    1070. 

  1070.                 'bgcolor'); # deprecated
    1071. 

  1071.         

    1072. 

  1072. 

    1073. 

  1073.         # Numbers refer to sections in HTML 4.01 standard describing the element.
    1074. 

  1074.         # See: http://www.w3.org/TR/html4/
    1075. 

  1075.         $whitelist = array(# 7.5.4
    1076. 

  1076. 'div' => $block, 'center' => $common, # deprecated
    1077. 

  1077. 'span' => $block, # ??
    1078. 

  1078. 

    1079. 

  1079. 

    1080. 

  1080.         # 7.5.5
    1081. 

  1081.         'h1' => $block, 'h2' => $block, 'h3' => $block, 'h4' => $block, 'h5' => $block, 'h6' => $block, 

    1082. 

  1082.                 

    1083. 

  1083.                 # 7.5.6
    1084. 

  1084.                 # address
    1085. 

  1085.                 

    1086. 

  1086. 

    1087. 

  1087.                 # 8.2.4
    1088. 

  1088.                 # bdo
    1089. 

  1089.                 

    1090. 

  1090. 

    1091. 

  1091.                 # 9.2.1
    1092. 

  1092.                 'em' => $common, 'strong' => $common, 'cite' => $common, # dfn
    1093. 

  1093. 'code' => $common, 

    1094. 

  1094.                 # samp
    1095. 

  1095.                 # kbd
    1096. 

  1096.                 'var' => $common, # abbr
    1097. 

  1097. # acronym
    1098. 

  1098.                 

    1099. 

  1099. 

    1100. 

  1100.                 # 9.2.2
    1101. 

  1101.                 'blockquote' => array_merge($common, array('cite')), # q
    1102. 

  1102. 

    1103. 

  1103. 

    1104. 

  1104.                 # 9.2.3
    1105. 

  1105.                 'sub' => $common, 'sup' => $common, 

    1106. 

  1106. 

    1107. 

  1107.                 # 9.3.1
    1108. 

  1108.                 'p' => $block, 

    1109. 

  1109. 

    1110. 

  1110.                 # 9.3.2
    1111. 

  1111.                 'br' => array('id', 'class', 'title', 'style', 'clear'), 

    1112. 

  1112.                 

    1113. 

  1113.                 # 9.3.4
    1114. 

  1114.                 'pre' => array_merge($common, array('width')), 

    1115. 

  1115.                 

    1116. 

  1116.                 # 9.4
    1117. 

  1117.                 'ins' => array_merge($common, array('cite', 'datetime')), 

    1118. 

  1118.                 'del' => array_merge($common, array('cite', 'datetime')), 

    1119. 

  1119. 

    1120. 

  1120.                 # 10.2
    1121. 

  1121.                 'ul' => array_merge($common, array('type')), 

    1122. 

  1122.                 'ol' => array_merge($common, array('type', 'start')), 

    1123. 

  1123.                 'li' => array_merge($common, array('type', 'value')), 

    1124. 

  1124. 

    1125. 

  1125.                 # 10.3
    1126. 

  1126.                 'dl' => $common, 'dd' => $common, 'dt' => $common, 

    1127. 

  1127.                 

    1128. 

  1128.                 # 11.2.1
    1129. 

  1129.                 'table' => array_merge($common, array('summary', 'width', 'border', 'frame', 'rules', 

    1130. 

  1130.                         'cellspacing', 'cellpadding', 'align', 'bgcolor')), 

    1131. 

  1131.                 

    1132. 

  1132.                 # 11.2.2
    1133. 

  1133.                 'caption' => array_merge($common, array('align')), 

    1134. 

  1134.                 

    1135. 

  1135.                 # 11.2.3
    1136. 

  1136.                 'thead' => array_merge($common, $tablealign), 

    1137. 

  1137.                 'tfoot' => array_merge($common, $tablealign), 'tbody' => array_merge($common, $tablealign), 

    1138. 

  1138.                 

    1139. 

  1139.                 # 11.2.4
    1140. 

  1140.                 'colgroup' => array_merge($common, array('span', 'width'), $tablealign), 

    1141. 

  1141.                 'col' => array_merge($common, array('span', 'width'), $tablealign), 

    1142. 

  1142.                 

    1143. 

  1143.                 # 11.2.5
    1144. 

  1144.                 'tr' => array_merge($common, array('bgcolor'), $tablealign), 

    1145. 

  1145.                 

    1146. 

  1146.                 # 11.2.6
    1147. 

  1147.                 'td' => array_merge($common, $tablecell, $tablealign), 

    1148. 

  1148.                 'th' => array_merge($common, $tablecell, $tablealign), 

    1149. 

  1149. 

    1150. 

  1150.                 # 13.2
    1151. 

  1151.                 # Not usually allowed, but may be used for extension-style hooks
    1152. 

  1152.                 # such as <math> when it is rasterized
    1153. 

  1153.                 'img' => array_merge($common, array('alt')), 

    1154. 

  1154.                 

    1155. 

  1155.                 # 15.2.1
    1156. 

  1156.                 'tt' => $common, 'b' => $common, 'i' => $common, 'big' => $common, 'small' => $common, 

    1157. 

  1157.                 'strike' => $common, 's' => $common, 'u' => $common, 

    1158. 

  1158.                 

    1159. 

  1159.                 # 15.2.2
    1160. 

  1160.                 'font' => array_merge($common, array('size', 'color', 'face')),  # basefont
    1161. 

  1161.                 

    1162. 

  1162. 

    1163. 

  1163.                 # 15.3
    1164. 

  1164.                 'hr' => array_merge($common, array('noshade', 'size', 'width')), 

    1165. 

  1165. 

    1166. 

  1166.                 # XHTML Ruby annotation text module, simple ruby only.
    1167. 

  1167.                 # http://www.w3c.org/TR/ruby/
    1168. 

  1168.                 'ruby' => $common, # rbc
    1169. 

  1169. # rtc
    1170. 

  1170.                 'rb' => $common, 'rt' => $common,  #array_merge( $common, array( 'rbspan' ) ),
    1171. 

  1171.                 'rp' => $common, 

    1172. 

  1172. 

    1173. 

  1173.                 # MathML root element, where used for extensions
    1174. 

  1174.                 # 'title' may not be 100% valid here; it's XHTML
    1175. 

  1175.                 # http://www.w3.org/TR/REC-MathML/
    1176. 

  1176.                 'math' => array('class', 'style', 'id', 'title'));

    1177. 

  1177.         return $whitelist;

    1178. 

  1178.     }

    1179. 

  1179. 

    1180. 

  1180.     /**
    1181. 

  1181.      * Take a fragment of (potentially invalid) HTML and return
    1182. 

  1182.      * a version with any tags removed, encoded as plain text.
    1183. 

  1183.      *
    1184. 

  1184.      * Warning: this return value must be further escaped for literal
    1185. 

  1185.      * inclusion in HTML output as of 1.10!
    1186. 

  1186.      *
    1187. 

  1187.      * @param string $text HTML fragment
    1188. 

  1188.      * @return string
    1189. 

  1189.      */

    1190. 

  1190.     static function stripAllTags($text)

    1191. 

  1191.     {

    1192. 

  1192.         # Actual <tags>
    1193. 

  1193.         $text = StringUtils :: delimiterReplace('<', '>', '', $text);

    1194. 

  1194.         

    1195. 

  1195.         # Normalize &entities and whitespace
    1196. 

  1196.         $text = self :: decodeCharReferences($text);

    1197. 

  1197.         $text = self :: normalizeWhitespace($text);

    1198. 

  1198.         

    1199. 

  1199.         return $text;

    1200. 

  1200.     }

    1201. 

  1201. 

    1202. 

  1202.     /**
    1203. 

  1203.      * Hack up a private DOCTYPE with HTML's standard entity declarations.
    1204. 

  1204.      * PHP 4 seemed to know these if you gave it an HTML doctype, but
    1205. 

  1205.      * PHP 5.1 doesn't.
    1206. 

  1206.      *
    1207. 

  1207.      * Use for passing XHTML fragments to PHP's XML parsing functions
    1208. 

  1208.      *
    1209. 

  1209.      * @return string
    1210. 

  1210.      * @static
    1211. 

  1211.      */

    1212. 

  1212.     static function hackDocType()

    1213. 

  1213.     {

    1214. 

  1214.         global $wgHtmlEntities;

    1215. 

  1215.         $out = "<!DOCTYPE html [\n";

    1216. 

  1216.         foreach ($wgHtmlEntities as $entity => $codepoint)

    1217. 

  1217.         {

    1218. 

  1218.             $out .= "<!ENTITY $entity \"&#$codepoint;\">";

    1219. 

  1219.         }

    1220. 

  1220.         $out .= "]>\n";

    1221. 

  1221.         return $out;

    1222. 

  1222.     }

    1223. 

  1223. 

    1224. 

  1224.     static function cleanUrl($url)

    1225. 

  1225.     {

    1226. 

  1226.         # Normalize any HTML entities in input. They will be
    1227. 

  1227.         # re-escaped by makeExternalLink().
    1228. 

  1228.         $url = self :: decodeCharReferences($url);

    1229. 

  1229.         

    1230. 

  1230.         # Escape any control characters introduced by the above step
    1231. 

  1231.         $url = preg_replace('/[\][<>"\\x00-\\x20\\x7F]/e', "urlencode('\\0')", $url);

    1232. 

  1232.         

    1233. 

  1233.         # Validate hostname portion
    1234. 

  1234.         $matches = array();

    1235. 

  1235.         if (preg_match('!^([^:]+:)(//[^/]+)?(.*)$!iD', $url, $matches))

    1236. 

  1236.         {

    1237. 

  1237.             list( /* $whole */, $protocol, $host, $rest) = $matches;

    1238. 

  1238.             

    1239. 

  1239.             // Characters that will be ignored in IDNs.
    1240. 

  1240.             // http://tools.ietf.org/html/3454#section-3.1
    1241. 

  1241.             // Strip them before further processing so blacklists and such work.
    1242. 

  1242.             $strip = "/
    1243. 

  1243. 				\\s|          # general whitespace
    1244. 

  1244. 				\xc2\xad|     # 00ad SOFT HYPHEN
    1245. 

  1245. 				\xe1\xa0\x86| # 1806 MONGOLIAN TODO SOFT HYPHEN
    1246. 

  1246. 				\xe2\x80\x8b| # 200b ZERO WIDTH SPACE
    1247. 

  1247. 				\xe2\x81\xa0| # 2060 WORD JOINER
    1248. 

  1248. 				\xef\xbb\xbf| # feff ZERO WIDTH NO-BREAK SPACE
    1249. 

  1249. 				\xcd\x8f|     # 034f COMBINING GRAPHEME JOINER
    1250. 

  1250. 				\xe1\xa0\x8b| # 180b MONGOLIAN FREE VARIATION SELECTOR ONE
    1251. 

  1251. 				\xe1\xa0\x8c| # 180c MONGOLIAN FREE VARIATION SELECTOR TWO
    1252. 

  1252. 				\xe1\xa0\x8d| # 180d MONGOLIAN FREE VARIATION SELECTOR THREE
    1253. 

  1253. 				\xe2\x80\x8c| # 200c ZERO WIDTH NON-JOINER
    1254. 

  1254. 				\xe2\x80\x8d| # 200d ZERO WIDTH JOINER
    1255. 

  1255. 				[\xef\xb8\x80-\xef\xb8\x8f] # fe00-fe00f VARIATION SELECTOR-1-16
    1256. 

  1256. 				/xuD";

    1257. 

  1257.             

    1258. 

  1258.             $host = preg_replace($strip, '', $host);

    1259. 

  1259.             

    1260. 

  1260.             // @fixme: validate hostnames here
    1261. 

  1261.             

    1262. 

  1262. 

    1263. 

  1263.             return $protocol . $host . $rest;

    1264. 

  1264.         }

    1265. 

  1265.         else

    1266. 

  1266.         {

    1267. 

  1267.             return $url;

    1268. 

  1268.         }

    1269. 

  1269.     }

    1270. 

  1270. 

    1271. 

  1271. }
    1272. 

  1272.