Attachment 42545 Details for Bug 96334

[patch] fix from 1.4.5

mediawiki-1.4rc1-parser.diff (text/plain), 4.47 KB, created by Anna Maresova on 2005-07-19 11:40:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Anna Maresova

Created: 2005-07-19 11:40:28 UTC

Size: 4.47 KB

patch

obsolete

>Index: includes/Parser.php
>================================================================================
>--- includes/Parser.php
>+++ includes/Parser.php
>@@ -488,24 +488,53 @@
> 		$htmlattrs = $this->getHTMLattrs() ;
> 
> 		# Strip non-approved attributes from the tag
>-		$t = preg_replace(
>-			'/(\\w+)(\\s*=\\s*([^\\s\">]+|\"[^\">]*\"))?/e',
>-			"(in_array(strtolower(\"\$1\"),\$htmlattrs)?(\"\$1\".((\"x\$3\" != \"x\")?\"=\$3\":'')):'')",
>-			$t);
>-
>-		$t = str_replace ( '<></>' , '' , $t ) ; # This should fix bug 980557
>+		if( !preg_match_all(
>+			'/(\\w+)(\\s*=\\s*([^\\s\"\'>]+|\"[^\">]*\"|\'[^\'>]*\'))?(?=\\s|$)/',
>+			$t, $matches, PREG_SET_ORDER ) ) {
>+			// No matching attributes.
>+			return '';
>+		}
>+		
>+		$out = '';
>+		foreach( $matches as $set ) {
>+			if( in_array( strtolower( $set[1] ), $htmlattrs ) ) {
>+				$out .= ' ' . $set[1];
>+				if( isset( $set[3] ) ) {
>+					if( $set[3] == "''" ) {
>+						// special-case quick hack
>+						$out .= '=""';
>+					} else {
>+						$out .= '=' . $set[3];
>+					}
>+				}
>+			}
>+		}
> 
> 		# Strip javascript "expression" from stylesheets. Brute force approach:
> 		# If anythin offensive is found, all attributes of the HTML tag are dropped
> 
> 		if( preg_match(
> 			'/style\\s*=.*(expression|tps*:\/\/|url\\s*\().*/is',
>-			wfMungeToUtf8( $t ) ) )
>+			wfMungeToUtf8( $out ) ) )
> 		{
>-			$t='';
>+			$out = '';
> 		}
>-
>-		return trim ( $t ) ;
>+		
>+		# Templates and links may be expanded in later parsing,
>+		# creating invalid or dangerous output. Suppress this.
>+		$out = strtr( $out, array(
>+			'{'    => '&#123;',
>+			'['    => '&#91;',
>+			"''"   => '&#39;&#39;',
>+			'ISBN' => '&#73;SBN',
>+			'RFC'  => '&#82;FC',
>+			'PMID' => '&#80;MID',
>+		) );
>+		$out = preg_replace(
>+			'/(' . URL_PROTOCOLS . '):/',
>+			'\\1&#58;', $out );
>+		
>+		return trim( $out );
> 	}
> 
> 	/**
>@@ -687,7 +716,7 @@
> 		$fname = 'Parser::internalParse';
> 		wfProfileIn( $fname );
> 
>-		$text = $this->removeHTMLtags( $text );
>+		$text = $this->removeHTMLtags( $text, array( &$this, 'replaceVariables' ) );
> 		$text = $this->replaceVariables( $text, $args );
> 
> 		$text = preg_replace( '/(^|\n)-----*/', '\\1<hr />', $text );
>@@ -2101,7 +2130,7 @@
> 			$this->mTemplatePath[$part1] = 1;
> 
> 			$text = $this->strip( $text, $this->mStripState );
>-			$text = $this->removeHTMLtags( $text );
>+			$text = $this->removeHTMLtags( $text, array( &$this, 'replaceVariables' ), $assocArgs );
> 			$text = $this->replaceVariables( $text, $assocArgs );
> 
> 			# Resume the link cache and register the inclusion as a link
>@@ -2197,8 +2226,12 @@
> 	 * Cleans up HTML, removes dangerous tags and attributes, and
> 	 * removes HTML comments
> 	 * @access private
>+	 * @param string $text
>+	 * @param callback $processCallback to do any variable or parameter replacements in HTML attribute values
>+	 * @param array $args for the processing callback
>+	 * @return string
> 	 */
>-	function removeHTMLtags( $text ) {
>+	function removeHTMLtags( $text, $processCallback = null, $args = array() ) {
> 		global $wgUseTidy, $wgUserHtml;
> 		$fname = 'Parser::removeHTMLtags';
> 		wfProfileIn( $fname );
>@@ -2242,7 +2275,7 @@
> 			$tagstack = array(); $tablestack = array();
> 			foreach ( $bits as $x ) {
> 				$prev = error_reporting( E_ALL & ~( E_NOTICE | E_WARNING ) );
>-				preg_match( '/^(\\/?)(\\w+)([^>]*)(\\/{0,1}>)([^<]*)$/',
>+				preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
> 				$x, $regs );
> 				list( $qbar, $slash, $t, $params, $brace, $rest ) = $regs;
> 				error_reporting( $prev );
>@@ -2277,6 +2310,13 @@
> 							}
> 							array_push( $tagstack, $t );
> 						}
>+
>+						# Replace any variables or template parameters with
>+						# plaintext results.
>+						if( is_callable( $processCallback ) ) {
>+							call_user_func_array( $processCallback, array( &$params, $args ) );
>+						}
>+
> 						# Strip non-approved attributes from the tag
> 						$newparams = $this->fixTagAttributes($params);
> 
>@@ -2297,10 +2337,13 @@
> 		} else {
> 			# this might be possible using tidy itself
> 			foreach ( $bits as $x ) {
>-				preg_match( '/^(\\/?)(\\w+)([^>]*)(\\/{0,1}>)([^<]*)$/',
>+				preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
> 				$x, $regs );
> 				@list( $qbar, $slash, $t, $params, $brace, $rest ) = $regs;
> 				if ( in_array( $t = strtolower( $t ), $htmlelements ) ) {
>+					if( is_callable( $processCallback ) ) {
>+						call_user_func_array( $processCallback, array( &$params, $args ) );
>+					}
> 					$newparams = $this->fixTagAttributes($params);
> 					$rest = str_replace( '>', '&gt;', $rest );
> 					$text .= "<$slash$t $newparams$brace$rest";

Actions: View | Diff

Attachments on bug 96334: 42545 | 42546