| Index: trunk/phase3/maintenance/parserTests.txt |
| — | — | @@ -3497,7 +3497,7 @@ |
| 3498 | 3498 | !! input |
| 3499 | 3499 | {{div style|" ><script>alert(document.cookie)</script>}} |
| 3500 | 3500 | !! result |
| 3501 | | -<div style="float: right; ">Magic div</div> |
| | 3501 | +<div style="float: right;">Magic div</div> |
| 3502 | 3502 | |
| 3503 | 3503 | !! end |
| 3504 | 3504 | |
| — | — | @@ -3668,6 +3668,42 @@ |
| 3669 | 3669 | |
| 3670 | 3670 | !! end |
| 3671 | 3671 | |
| | 3672 | + |
| | 3673 | +!! article |
| | 3674 | +Template:Identity |
| | 3675 | +!! text |
| | 3676 | +{{{1}}} |
| | 3677 | +!! endarticle |
| | 3678 | + |
| | 3679 | +!! test |
| | 3680 | +Expansion of multi-line templates in attribute values (bug 6255) |
| | 3681 | +!! input |
| | 3682 | +<div style="background: {{identity|#00FF00}}">-</div> |
| | 3683 | +!! result |
| | 3684 | +<div style="background: #00FF00">-</div> |
| | 3685 | + |
| | 3686 | +!! end |
| | 3687 | + |
| | 3688 | + |
| | 3689 | +!! test |
| | 3690 | +Expansion of multi-line templates in attribute values (bug 6255 sanity check) |
| | 3691 | +!! input |
| | 3692 | +<div style="background: |
| | 3693 | +#00FF00">-</div> |
| | 3694 | +!! result |
| | 3695 | +<div style="background: #00FF00">-</div> |
| | 3696 | + |
| | 3697 | +!! end |
| | 3698 | + |
| | 3699 | +!! test |
| | 3700 | +Expansion of multi-line templates in attribute values (bug 6255 sanity check) |
| | 3701 | +!! input |
| | 3702 | +<div style="background: #00FF00">-</div> |
| | 3703 | +!! result |
| | 3704 | +<div style="background: #00FF00">-</div> |
| | 3705 | + |
| | 3706 | +!! end |
| | 3707 | + |
| 3672 | 3708 | ### |
| 3673 | 3709 | ### Parser hooks (see maintenance/parserTestsParserHook.php for the <tag> extension) |
| 3674 | 3710 | ### |
| — | — | @@ -4290,7 +4326,7 @@ |
| 4291 | 4327 | <table> |
| 4292 | 4328 | |
| 4293 | 4329 | <u class="|">} > |
| 4294 | | -<br style="onmouseover='alert(document.cookie);' " /> |
| | 4330 | +<br style="onmouseover='alert(document.cookie);'" /> |
| 4295 | 4331 | |
| 4296 | 4332 | MOVE YOUR MOUSE CURSOR OVER THIS TEXT |
| 4297 | 4333 | <tr> |
| Index: trunk/phase3/includes/Sanitizer.php |
| — | — | @@ -618,36 +618,67 @@ |
| 619 | 619 | $attribs = array(); |
| 620 | 620 | foreach( $stripped as $attribute => $value ) { |
| 621 | 621 | $encAttribute = htmlspecialchars( $attribute ); |
| | 622 | + $encValue = Sanitizer::safeEncodeAttribute( $value ); |
| 622 | 623 | |
| 623 | | - $encValue = htmlspecialchars( $value ); |
| 624 | | - # Templates and links may be expanded in later parsing, |
| 625 | | - # creating invalid or dangerous output. Suppress this. |
| 626 | | - $encValue = strtr( $encValue, array( |
| 627 | | - '<' => '<', // This should never happen, |
| 628 | | - '>' => '>', // we've received invalid input |
| 629 | | - '"' => '"', // which should have been escaped. |
| 630 | | - '{' => '{', |
| 631 | | - '[' => '[', |
| 632 | | - "''" => '''', |
| 633 | | - 'ISBN' => 'ISBN', |
| 634 | | - 'RFC' => 'RFC', |
| 635 | | - 'PMID' => 'PMID', |
| 636 | | - '|' => '|', |
| 637 | | - '__' => '__', |
| 638 | | - ) ); |
| 639 | | - |
| 640 | | - # Stupid hack |
| 641 | | - $encValue = preg_replace_callback( |
| 642 | | - '/(' . wfUrlProtocols() . ')/', |
| 643 | | - array( 'Sanitizer', 'armorLinksCallback' ), |
| 644 | | - $encValue ); |
| 645 | | - |
| 646 | 624 | $attribs[] = "$encAttribute=\"$encValue\""; |
| 647 | 625 | } |
| 648 | 626 | return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : ''; |
| 649 | 627 | } |
| 650 | 628 | |
| 651 | 629 | /** |
| | 630 | + * Encode an attribute value for HTML output. |
| | 631 | + * @param $text |
| | 632 | + * @return HTML-encoded text fragment |
| | 633 | + */ |
| | 634 | + function encodeAttribute( $text ) { |
| | 635 | + $encValue = htmlspecialchars( $text ); |
| | 636 | + |
| | 637 | + // Whitespace is normalized during attribute decoding, |
| | 638 | + // so if we've been passed non-spaces we must encode them |
| | 639 | + // ahead of time or they won't be preserved. |
| | 640 | + $encValue = strtr( $encValue, array( |
| | 641 | + "\n" => ' ', |
| | 642 | + "\r" => ' ', |
| | 643 | + "\t" => '	', |
| | 644 | + ) ); |
| | 645 | + |
| | 646 | + return $encValue; |
| | 647 | + } |
| | 648 | + |
| | 649 | + /** |
| | 650 | + * Encode an attribute value for HTML tags, with extra armoring |
| | 651 | + * against further wiki processing. |
| | 652 | + * @param $text |
| | 653 | + * @return HTML-encoded text fragment |
| | 654 | + */ |
| | 655 | + function safeEncodeAttribute( $text ) { |
| | 656 | + $encValue = Sanitizer::encodeAttribute( $text ); |
| | 657 | + |
| | 658 | + # Templates and links may be expanded in later parsing, |
| | 659 | + # creating invalid or dangerous output. Suppress this. |
| | 660 | + $encValue = strtr( $encValue, array( |
| | 661 | + '<' => '<', // This should never happen, |
| | 662 | + '>' => '>', // we've received invalid input |
| | 663 | + '"' => '"', // which should have been escaped. |
| | 664 | + '{' => '{', |
| | 665 | + '[' => '[', |
| | 666 | + "''" => '''', |
| | 667 | + 'ISBN' => 'ISBN', |
| | 668 | + 'RFC' => 'RFC', |
| | 669 | + 'PMID' => 'PMID', |
| | 670 | + '|' => '|', |
| | 671 | + '__' => '__', |
| | 672 | + ) ); |
| | 673 | + |
| | 674 | + # Stupid hack |
| | 675 | + $encValue = preg_replace_callback( |
| | 676 | + '/(' . wfUrlProtocols() . ')/', |
| | 677 | + array( 'Sanitizer', 'armorLinksCallback' ), |
| | 678 | + $encValue ); |
| | 679 | + return $encValue; |
| | 680 | + } |
| | 681 | + |
| | 682 | + /** |
| 652 | 683 | * Given a value escape it so that it can be used in an id attribute and |
| 653 | 684 | * return it, this does not validate the value however (see first link) |
| 654 | 685 | * |
| — | — | @@ -711,6 +742,12 @@ |
| 712 | 743 | foreach( $pairs as $set ) { |
| 713 | 744 | $attribute = strtolower( $set[1] ); |
| 714 | 745 | $value = Sanitizer::getTagAttributeCallback( $set ); |
| | 746 | + |
| | 747 | + // Normalize whitespace |
| | 748 | + $value = preg_replace( '/[\t\r\n ]+/', ' ', $value ); |
| | 749 | + $value = trim( $value ); |
| | 750 | + |
| | 751 | + // Decode character references |
| 715 | 752 | $attribs[$attribute] = Sanitizer::decodeCharReferences( $value ); |
| 716 | 753 | } |
| 717 | 754 | return $attribs; |
| Index: trunk/phase3/RELEASE-NOTES |
| — | — | @@ -467,7 +467,10 @@ |
| 468 | 468 | * (bug 2069) Merge the LanguageUtf8 class into the Language class |
| 469 | 469 | * Update to Yiddish localization (yi) |
| 470 | 470 | * (bug 6254) Update to Indonesian translation (id) #20 |
| | 471 | +* (bug 6255) Fix transclusions starting with "#" or "*" in HTML attributes |
| | 472 | +* Whitespace now normalized more or less properly in HTML attributes |
| 471 | 473 | |
| | 474 | + |
| 472 | 475 | == Compatibility == |
| 473 | 476 | |
| 474 | 477 | MediaWiki 1.7 requires PHP 5 (5.1 recommended). PHP 4 is no longer supported. |