Followup r111891; Update the test to also make sure things like http-equiv and rel=stylesheet don't link through. And update the sanitizer code so that bad <link> and <meta> tags show in proper plaintext when tidy is enabled just like they do when not.

2 files changed, 16 insertions, 4 deletions

diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index 785e2ec9c15c..eb8710866aad 100644
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -564,16 +564,24 @@ class Sanitizer {
 				preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
 				$x, $regs );
 				@list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs;
+				$badtag = false;
 				if ( isset( $htmlelements[$t = strtolower( $t )] ) ) {
 					if( is_callable( $processCallback ) ) {
 						call_user_func_array( $processCallback, array( &$params, $args ) );
 					}
+
+					if ( !Sanitizer::validateTag( $params, $t ) ) {
+						$badtag = true;
+					}
+
 					$newparams = Sanitizer::fixTagAttributes( $params, $t );
-					$rest = str_replace( '>', '&gt;', $rest );
-					$text .= "<$slash$t$newparams$brace$rest";
-				} else {
-					$text .= '&lt;' . str_replace( '>', '&gt;', $x);
+					if ( !$badtag ) {
+						$rest = str_replace( '>', '&gt;', $rest );
+						$text .= "<$slash$t$newparams$brace$rest";
+						continue;
+					}
 				}
+				$text .= '&lt;' . str_replace( '>', '&gt;', $x);
 			}
 		}
 		wfProfileOut( __METHOD__ );
diff --git a/tests/parser/parserTests.txt b/tests/parser/parserTests.txt
index 22970a147d9f..8535d78f1f8d 100644
--- a/tests/parser/parserTests.txt
+++ b/tests/parser/parserTests.txt
@@ -5425,16 +5425,20 @@ Sanitizer: Validating that <meta> and <link> work, but only for Microdata
 <div itemscope>
 	<meta itemprop="hello" content="world">
 	<meta http-equiv="refresh" content="5">
+	<meta itemprop="hello" http-equiv="refresh" content="5">
 	<link itemprop="hello" href="{{SERVER}}">
 	<link rel="stylesheet" href="{{SERVER}}">
+	<link rel="stylesheet" itemprop="hello" href="{{SERVER}}">
 </div>
 !! result
 <div itemscope="itemscope">
 <p>	<meta itemprop="hello" content="world" />
 	&lt;meta http-equiv="refresh" content="5"&gt;
+	<meta itemprop="hello" content="5" />
 </p>
 	<link itemprop="hello" href="http&#58;//Britney-Spears" />
 	&lt;link rel="stylesheet" href="<a rel="nofollow" class="external free" href="http://Britney-Spears">http://Britney-Spears</a>"&gt;
+	<link itemprop="hello" href="http&#58;//Britney-Spears" />
 </div>
 
 !! end