| Index: trunk/phase3/includes/Sanitizer.php |
| — | — | @@ -353,7 +353,7 @@ |
| 354 | 354 | if ( !$staticInitialised ) { |
| 355 | 355 | |
| 356 | 356 | $htmlpairsStatic = array( # Tags that must be closed |
| 357 | | - 'a', 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1', |
| | 357 | + 'b', 'del', 'i', 'ins', 'u', 'font', 'big', 'small', 'sub', 'sup', 'h1', |
| 358 | 358 | 'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's', |
| 359 | 359 | 'strike', 'strong', 'tt', 'var', 'div', 'center', |
| 360 | 360 | 'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre', |
| — | — | @@ -605,8 +605,6 @@ |
| 606 | 606 | */ |
| 607 | 607 | static function validateAttributes( $attribs, $whitelist ) { |
| 608 | 608 | $whitelist = array_flip( $whitelist ); |
| 609 | | - $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/'; |
| 610 | | - |
| 611 | 609 | $out = array(); |
| 612 | 610 | foreach( $attribs as $attribute => $value ) { |
| 613 | 611 | if( !isset( $whitelist[$attribute] ) ) { |
| — | — | @@ -628,23 +626,6 @@ |
| 629 | 627 | $wgEnforceHtmlIds ? 'noninitial' : 'xml' ); |
| 630 | 628 | } |
| 631 | 629 | |
| 632 | | - if ( $attribute === 'href' || $attribute === 'src' ) { |
| 633 | | - if ( !preg_match( $hrefExp, $value ) ) { |
| 634 | | - continue; //drop any href or src attributes not using an allowed protocol. |
| 635 | | - //NOTE: this also drops all relative URLs |
| 636 | | - } |
| 637 | | - } |
| 638 | | - |
| 639 | | - //RDFa properties allow URIs. check them |
| 640 | | - if ( $attribute === 'rel' || $attribute === 'rev' || |
| 641 | | - $attribute === 'about' || $attribute === 'property' || $attribute === 'resource' || |
| 642 | | - $attribute === 'datatype' || $attribute === 'typeof' ) { |
| 643 | | - //Paranoia. Allow "simple" values but suppress javascript |
| 644 | | - if ( preg_match( '/(^|\s)javascript\s*:/i', $value ) ) { |
| 645 | | - continue; |
| 646 | | - } |
| 647 | | - } |
| 648 | | - |
| 649 | 630 | // If this attribute was previously set, override it. |
| 650 | 631 | // Output should only have one attribute of each name. |
| 651 | 632 | $out[$attribute] = $value; |
| — | — | @@ -1173,11 +1154,7 @@ |
| 1174 | 1155 | * @return Array |
| 1175 | 1156 | */ |
| 1176 | 1157 | static function setupAttributeWhitelist() { |
| 1177 | | - $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style', |
| 1178 | | - #RDFa attributes as specified in section 9 of http://www.w3.org/TR/2008/REC-rdfa-syntax-20081014 |
| 1179 | | - 'about', 'property', 'resource', 'datatype', 'typeof', |
| 1180 | | - ); |
| 1181 | | - |
| | 1158 | + $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' ); |
| 1182 | 1159 | $block = array_merge( $common, array( 'align' ) ); |
| 1183 | 1160 | $tablealign = array( 'align', 'char', 'charoff', 'valign' ); |
| 1184 | 1161 | $tablecell = array( 'abbr', |
| — | — | @@ -1283,9 +1260,6 @@ |
| 1284 | 1261 | 'td' => array_merge( $common, $tablecell, $tablealign ), |
| 1285 | 1262 | 'th' => array_merge( $common, $tablecell, $tablealign ), |
| 1286 | 1263 | |
| 1287 | | - # 12.2 |
| 1288 | | - 'a' => array_merge( $common, array( 'href', 'rel', 'rev' ) ), # rel/rev esp. for RDFa |
| 1289 | | - |
| 1290 | 1264 | # 13.2 |
| 1291 | 1265 | # Not usually allowed, but may be used for extension-style hooks |
| 1292 | 1266 | # such as <math> when it is rasterized |