| Index: trunk/phase3/tests/parser/parserTests.txt |
| — | — | @@ -5420,6 +5420,26 @@ |
| 5421 | 5421 | !! end |
| 5422 | 5422 | |
| 5423 | 5423 | !! test |
| | 5424 | +Sanitizer: Validating that <meta> and <link> work, but only for Microdata |
| | 5425 | +!! input |
| | 5426 | +<div itemscope> |
| | 5427 | + <meta itemprop="hello" content="world"> |
| | 5428 | + <meta http-equiv="refresh" content="5"> |
| | 5429 | + <link itemprop="hello" href="{{SERVER}}"> |
| | 5430 | + <link rel="stylesheet" href="{{SERVER}}"> |
| | 5431 | +</div> |
| | 5432 | +!! result |
| | 5433 | +<div itemscope="itemscope"> |
| | 5434 | +<p> <meta itemprop="hello" content="world" /> |
| | 5435 | + <meta http-equiv="refresh" content="5"> |
| | 5436 | +</p> |
| | 5437 | + <link itemprop="hello" href="http://Britney-Spears" /> |
| | 5438 | + <link rel="stylesheet" href="<a rel="nofollow" class="external free" href="http://Britney-Spears">http://Britney-Spears</a>"> |
| | 5439 | +</div> |
| | 5440 | + |
| | 5441 | +!! end |
| | 5442 | + |
| | 5443 | +!! test |
| 5424 | 5444 | Language converter: output gets cut off unexpectedly (bug 5757) |
| 5425 | 5445 | !! options |
| 5426 | 5446 | language=zh |
| Index: trunk/phase3/includes/Sanitizer.php |
| — | — | @@ -364,7 +364,7 @@ |
| 365 | 365 | * @return string |
| 366 | 366 | */ |
| 367 | 367 | static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array(), $removetags = array() ) { |
| 368 | | - global $wgUseTidy; |
| | 368 | + global $wgUseTidy, $wgHtml5, $wgAllowMicrodataAttributes; |
| 369 | 369 | |
| 370 | 370 | static $htmlpairsStatic, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags, |
| 371 | 371 | $htmllist, $listtags, $htmlsingleallowed, $htmlelementsStatic, $staticInitialised; |
| — | — | @@ -381,12 +381,19 @@ |
| 382 | 382 | 'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'abbr', 'dfn', |
| 383 | 383 | 'kbd', 'samp' |
| 384 | 384 | ); |
| | 385 | + if ( $wgHtml5 ) { |
| | 386 | + $htmlpairsStatic = array_merge( $htmlpairsStatic, array( 'data', 'time' ) ); |
| | 387 | + } |
| 385 | 388 | $htmlsingle = array( |
| 386 | 389 | 'br', 'hr', 'li', 'dt', 'dd' |
| 387 | 390 | ); |
| 388 | 391 | $htmlsingleonly = array( # Elements that cannot have close tags |
| 389 | 392 | 'br', 'hr' |
| 390 | 393 | ); |
| | 394 | + if ( $wgHtml5 && $wgAllowMicrodataAttributes ) { |
| | 395 | + $htmlsingle[] = $htmlsingleonly[] = 'meta'; |
| | 396 | + $htmlsingle[] = $htmlsingleonly[] = 'link'; |
| | 397 | + } |
| 391 | 398 | $htmlnest = array( # Tags that can be nested--?? |
| 392 | 399 | 'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul', |
| 393 | 400 | 'dl', 'font', 'big', 'small', 'sub', 'sup', 'span' |
| — | — | @@ -528,6 +535,10 @@ |
| 529 | 536 | call_user_func_array( $processCallback, array( &$params, $args ) ); |
| 530 | 537 | } |
| 531 | 538 | |
| | 539 | + if ( !Sanitizer::validateTag( $params, $t ) ) { |
| | 540 | + $badtag = true; |
| | 541 | + } |
| | 542 | + |
| 532 | 543 | # Strip non-approved attributes from the tag |
| 533 | 544 | $newparams = Sanitizer::fixTagAttributes( $params, $t ); |
| 534 | 545 | } |
| — | — | @@ -709,6 +720,37 @@ |
| 710 | 721 | } |
| 711 | 722 | |
| 712 | 723 | /** |
| | 724 | + * Takes attribute names and values for a tag and the tah name and |
| | 725 | + * validates that the tag is allowed to be present. |
| | 726 | + * This DOES NOT validate the attributes, nor does it validate the |
| | 727 | + * tags themselves. This method only handles the special circumstances |
| | 728 | + * where we may want to allow a tag within content but ONLY when it has |
| | 729 | + * specific attributes set. |
| | 730 | + * |
| | 731 | + * @param $ |
| | 732 | + */ |
| | 733 | + static function validateTag( $params, $element ) { |
| | 734 | + $params = Sanitizer::decodeTagAttributes( $params ); |
| | 735 | + |
| | 736 | + if ( $element == 'meta' || $element == 'link' ) { |
| | 737 | + if ( !isset( $params['itemprop'] ) ) { |
| | 738 | + // <meta> and <link> must have an itemprop="" otherwise they are not valid or safe in content |
| | 739 | + return false; |
| | 740 | + } |
| | 741 | + if ( $element == 'meta' && !isset( $params['content'] ) ) { |
| | 742 | + // <meta> must have a content="" for the itemprop |
| | 743 | + return false; |
| | 744 | + } |
| | 745 | + if ( $element == 'link' && !isset( $params['href'] ) ) { |
| | 746 | + // <link> must have an associated href="" |
| | 747 | + return false; |
| | 748 | + } |
| | 749 | + } |
| | 750 | + |
| | 751 | + return true; |
| | 752 | + } |
| | 753 | + |
| | 754 | + /** |
| 713 | 755 | * Take an array of attribute names and values and normalize or discard |
| 714 | 756 | * illegal values for the given element type. |
| 715 | 757 | * |
| — | — | @@ -809,7 +851,7 @@ |
| 810 | 852 | unset( $out['itemid'] ); |
| 811 | 853 | unset( $out['itemref'] ); |
| 812 | 854 | } |
| 813 | | - # TODO: Strip itemprop if we aren't descendants of an itemscope. |
| | 855 | + # TODO: Strip itemprop if we aren't descendants of an itemscope or pointed to by an itemref. |
| 814 | 856 | } |
| 815 | 857 | return $out; |
| 816 | 858 | } |
| — | — | @@ -1483,7 +1525,7 @@ |
| 1484 | 1526 | |
| 1485 | 1527 | # Numbers refer to sections in HTML 4.01 standard describing the element. |
| 1486 | 1528 | # See: http://www.w3.org/TR/html4/ |
| 1487 | | - $whitelist = array ( |
| | 1529 | + $whitelist = array( |
| 1488 | 1530 | # 7.5.4 |
| 1489 | 1531 | 'div' => $block, |
| 1490 | 1532 | 'center' => $common, # deprecated |
| — | — | @@ -1611,7 +1653,24 @@ |
| 1612 | 1654 | # 'title' may not be 100% valid here; it's XHTML |
| 1613 | 1655 | # http://www.w3.org/TR/REC-MathML/ |
| 1614 | 1656 | 'math' => array( 'class', 'style', 'id', 'title' ), |
| | 1657 | + ); |
| | 1658 | + |
| | 1659 | + if ( $wgHtml5 ) { |
| | 1660 | + # HTML5 elements, defined by: |
| | 1661 | + # http://www.whatwg.org/specs/web-apps/current-work/multipage/ |
| | 1662 | + $whitelist += array( |
| | 1663 | + 'data' => array_merge( $common, array( 'value' ) ), |
| | 1664 | + 'time' => array_merge( $common, array( 'datetime' ) ), |
| | 1665 | + |
| | 1666 | + // meta and link are only present when Microdata is allowed anyways |
| | 1667 | + // so we don't bother adding another condition here |
| | 1668 | + // meta and link are only valid for use as Microdata so we do not |
| | 1669 | + // allow the common attributes here. |
| | 1670 | + 'meta' => array( 'itemprop', 'content' ), |
| | 1671 | + 'link' => array( 'itemprop', 'href' ), |
| 1615 | 1672 | ); |
| | 1673 | + } |
| | 1674 | + |
| 1616 | 1675 | return $whitelist; |
| 1617 | 1676 | } |
| 1618 | 1677 | |
| Index: trunk/phase3/RELEASE-NOTES-1.20 |
| — | — | @@ -22,6 +22,8 @@ |
| 23 | 23 | * (bug 34475) Add support for IP/CIDR notation to tablesorter |
| 24 | 24 | * (bug 27619) Remove preference option to display broken links as link? |
| 25 | 25 | * (bug 15404) Add support for sorting fractions in jquery.tablesorter |
| | 26 | +* The <data>, <time>, <meta>, and <link> elements are allowed within WikiText for use |
| | 27 | + with Microdata. |
| 26 | 28 | |
| 27 | 29 | === Bug fixes in 1.20 === |
| 28 | 30 | * (bug 30245) Use the correct way to construct a log page title. |