Update to MediaWiki 1.24.1

1 files changed, 205 insertions, 95 deletions

diff --git a/includes/libs/CSSMin.php b/includes/libs/CSSMin.php
index 4f142fc7..c69e79f5 100644
--- a/includes/libs/CSSMin.php
+++ b/includes/libs/CSSMin.php
@@ -38,11 +38,13 @@ class CSSMin {
 	 * which when base64 encoded will result in a 1/3 increase in size.
 	 */
 	const EMBED_SIZE_LIMIT = 24576;
-	const URL_REGEX = 'url\(\s*[\'"]?(?P<file>[^\?\)\'"]*)(?P<query>\??[^\)\'"]*)[\'"]?\s*\)';
+	const URL_REGEX = 'url\(\s*[\'"]?(?P<file>[^\?\)\'"]*?)(?P<query>\?[^\)\'"]*?|)[\'"]?\s*\)';
+	const EMBED_REGEX = '\/\*\s*\@embed\s*\*\/';
+	const COMMENT_REGEX = '\/\*.*?\*\/';
 
 	/* Protected Static Members */
 
-	/** @var array List of common image files extensions and mime-types */
+	/** @var array List of common image files extensions and MIME-types */
 	protected static $mimeTypes = array(
 		'gif' => 'image/gif',
 		'jpe' => 'image/jpeg',
@@ -52,6 +54,7 @@ class CSSMin {
 		'tif' => 'image/tiff',
 		'tiff' => 'image/tiff',
 		'xbm' => 'image/x-xbitmap',
+		'svg' => 'image/svg+xml',
 	);
 
 	/* Static Methods */
@@ -59,23 +62,38 @@ class CSSMin {
 	/**
 	 * Gets a list of local file paths which are referenced in a CSS style sheet
 	 *
+	 * This function will always return an empty array if the second parameter is not given or null
+	 * for backwards-compatibility.
+	 *
 	 * @param string $source CSS data to remap
 	 * @param string $path File path where the source was read from (optional)
 	 * @return array List of local file references
 	 */
 	public static function getLocalFileReferences( $source, $path = null ) {
+		if ( $path === null ) {
+			return array();
+		}
+
+		$path = rtrim( $path, '/' ) . '/';
 		$files = array();
+
 		$rFlags = PREG_OFFSET_CAPTURE | PREG_SET_ORDER;
 		if ( preg_match_all( '/' . self::URL_REGEX . '/', $source, $matches, $rFlags ) ) {
 			foreach ( $matches as $match ) {
-				$file = ( isset( $path )
-					? rtrim( $path, '/' ) . '/'
-					: '' ) . "{$match['file'][0]}";
+				$url = $match['file'][0];
 
-				// Only proceed if we can access the file
-				if ( !is_null( $path ) && file_exists( $file ) ) {
-					$files[] = $file;
+				// Skip fully-qualified and protocol-relative URLs and data URIs
+				if ( substr( $url, 0, 2 ) === '//' || parse_url( $url, PHP_URL_SCHEME ) ) {
+					break;
 				}
+
+				$file = $path . $url;
+				// Skip non-existent files
+				if ( file_exists( $file ) ) {
+					break;
+				}
+
+				$files[] = $file;
 			}
 		}
 		return $files;
@@ -95,7 +113,9 @@ class CSSMin {
 	 *     instead. If $sizeLimit is false, no limit is enforced.
 	 * @return string|bool: Image contents encoded as a data URI or false.
 	 */
-	public static function encodeImageAsDataURI( $file, $type = null, $sizeLimit = self::EMBED_SIZE_LIMIT ) {
+	public static function encodeImageAsDataURI( $file, $type = null,
+		$sizeLimit = self::EMBED_SIZE_LIMIT
+	) {
 		if ( $sizeLimit !== false && filesize( $file ) >= $sizeLimit ) {
 			return false;
 		}
@@ -115,124 +135,214 @@ class CSSMin {
 	 */
 	public static function getMimeType( $file ) {
 		$realpath = realpath( $file );
-		// Try a couple of different ways to get the mime-type of a file, in order of
-		// preference
 		if (
 			$realpath
 			&& function_exists( 'finfo_file' )
 			&& function_exists( 'finfo_open' )
 			&& defined( 'FILEINFO_MIME_TYPE' )
 		) {
-			// As of PHP 5.3, this is how you get the mime-type of a file; it uses the Fileinfo
-			// PECL extension
 			return finfo_file( finfo_open( FILEINFO_MIME_TYPE ), $realpath );
-		} elseif ( function_exists( 'mime_content_type' ) ) {
-			// Before this was deprecated in PHP 5.3, this was how you got the mime-type of a file
-			return mime_content_type( $file );
-		} else {
-			// Worst-case scenario has happened, use the file extension to infer the mime-type
-			$ext = strtolower( pathinfo( $file, PATHINFO_EXTENSION ) );
-			if ( isset( self::$mimeTypes[$ext] ) ) {
-				return self::$mimeTypes[$ext];
-			}
 		}
+
+		// Infer the MIME-type from the file extension
+		$ext = strtolower( pathinfo( $file, PATHINFO_EXTENSION ) );
+		if ( isset( self::$mimeTypes[$ext] ) ) {
+			return self::$mimeTypes[$ext];
+		}
+
 		return false;
 	}
 
 	/**
-	 * Remaps CSS URL paths and automatically embeds data URIs for URL rules
-	 * preceded by an /* @embed * / comment
+	 * Build a CSS 'url()' value for the given URL, quoting parentheses (and other funny characters)
+	 * and escaping quotes as necessary.
+	 *
+	 * See http://www.w3.org/TR/css-syntax-3/#consume-a-url-token
+	 *
+	 * @param string $url URL to process
+	 * @return string 'url()' value, usually just `"url($url)"`, quoted/escaped if necessary
+	 */
+	public static function buildUrlValue( $url ) {
+		// The list below has been crafted to match URLs such as:
+		//   scheme://user@domain:port/~user/fi%20le.png?query=yes&really=y+s
+		//   data:image/png;base64,R0lGODlh/+==
+		if ( preg_match( '!^[\w\d:@/~.%+;,?&=-]+$!', $url ) ) {
+			return "url($url)";
+		} else {
+			return 'url("' . strtr( $url, array( '\\' => '\\\\', '"' => '\\"' ) ) . '")';
+		}
+	}
+
+	/**
+	 * Remaps CSS URL paths and automatically embeds data URIs for CSS rules
+	 * or url() values preceded by an / * @embed * / comment.
 	 *
 	 * @param string $source CSS data to remap
 	 * @param string $local File path where the source was read from
 	 * @param string $remote URL path to the file
-	 * @param bool $embedData If false, never do any data URI embedding, even if / * @embed * / is found
+	 * @param bool $embedData If false, never do any data URI embedding,
+	 *   even if / * @embed * / is found.
 	 * @return string Remapped CSS data
 	 */
 	public static function remap( $source, $local, $remote, $embedData = true ) {
-		$pattern = '/((?P<embed>\s*\/\*\s*\@embed\s*\*\/)(?P<pre>[^\;\}]*))?' .
-			self::URL_REGEX . '(?P<post>[^;]*)[\;]?/';
-		$offset = 0;
-		while ( preg_match( $pattern, $source, $match, PREG_OFFSET_CAPTURE, $offset ) ) {
-			// Skip fully-qualified URLs and data URIs
-			$urlScheme = parse_url( $match['file'][0], PHP_URL_SCHEME );
-			if ( $urlScheme ) {
-				// Move the offset to the end of the match, leaving it alone
-				$offset = $match[0][1] + strlen( $match[0][0] );
-				continue;
-			}
-			// URLs with absolute paths like /w/index.php need to be expanded
-			// to absolute URLs but otherwise left alone
-			if ( $match['file'][0] !== '' && $match['file'][0][0] === '/' ) {
-				// Replace the file path with an expanded (possibly protocol-relative) URL
-				// ...but only if wfExpandUrl() is even available.
-				// This will not be the case if we're running outside of MW
-				$lengthIncrease = 0;
-				if ( function_exists( 'wfExpandUrl' ) ) {
-					$expanded = wfExpandUrl( $match['file'][0], PROTO_RELATIVE );
-					$origLength = strlen( $match['file'][0] );
-					$lengthIncrease = strlen( $expanded ) - $origLength;
-					$source = substr_replace( $source, $expanded,
-						$match['file'][1], $origLength
+		// High-level overview:
+		// * For each CSS rule in $source that includes at least one url() value:
+		//   * Check for an @embed comment at the start indicating that all URIs should be embedded
+		//   * For each url() value:
+		//     * Check for an @embed comment directly preceding the value
+		//     * If either @embed comment exists:
+		//       * Embedding the URL as data: URI, if it's possible / allowed
+		//       * Otherwise remap the URL to work in generated stylesheets
+
+		// Guard against trailing slashes, because "some/remote/../foo.png"
+		// resolves to "some/remote/foo.png" on (some?) clients (bug 27052).
+		if ( substr( $remote, -1 ) == '/' ) {
+			$remote = substr( $remote, 0, -1 );
+		}
+
+		// Replace all comments by a placeholder so they will not interfere with the remapping.
+		// Warning: This will also catch on anything looking like the start of a comment between
+		// quotation marks (e.g. "foo /* bar").
+		$comments = array();
+		$placeholder = uniqid( '', true );
+
+		$pattern = '/(?!' . CSSMin::EMBED_REGEX . ')(' . CSSMin::COMMENT_REGEX . ')/s';
+
+		$source = preg_replace_callback(
+			$pattern,
+			function ( $match ) use ( &$comments, $placeholder ) {
+				$comments[] = $match[ 0 ];
+				return $placeholder . ( count( $comments ) - 1 ) . 'x';
+			},
+			$source
+		);
+
+		// Note: This will not correctly handle cases where ';', '{' or '}'
+		// appears in the rule itself, e.g. in a quoted string. You are advised
+		// not to use such characters in file names. We also match start/end of
+		// the string to be consistent in edge-cases ('@import url(…)').
+		$pattern = '/(?:^|[;{])\K[^;{}]*' . CSSMin::URL_REGEX . '[^;}]*(?=[;}]|$)/';
+
+		$source = preg_replace_callback(
+			$pattern,
+			function ( $matchOuter ) use ( $local, $remote, $embedData, $placeholder ) {
+				$rule = $matchOuter[0];
+
+				// Check for global @embed comment and remove it. Allow other comments to be present
+				// before @embed (they have been replaced with placeholders at this point).
+				$embedAll = false;
+				$rule = preg_replace( '/^((?:\s+|' . $placeholder . '(\d+)x)*)' . CSSMin::EMBED_REGEX . '\s*/', '$1', $rule, 1, $embedAll );
+
+				// Build two versions of current rule: with remapped URLs
+				// and with embedded data: URIs (where possible).
+				$pattern = '/(?P<embed>' . CSSMin::EMBED_REGEX . '\s*|)' . CSSMin::URL_REGEX . '/';
+
+				$ruleWithRemapped = preg_replace_callback(
+					$pattern,
+					function ( $match ) use ( $local, $remote ) {
+						$remapped = CSSMin::remapOne( $match['file'], $match['query'], $local, $remote, false );
+
+						return CSSMin::buildUrlValue( $remapped );
+					},
+					$rule
+				);
+
+				if ( $embedData ) {
+					$ruleWithEmbedded = preg_replace_callback(
+						$pattern,
+						function ( $match ) use ( $embedAll, $local, $remote ) {
+							$embed = $embedAll || $match['embed'];
+							$embedded = CSSMin::remapOne(
+								$match['file'],
+								$match['query'],
+								$local,
+								$remote,
+								$embed
+							);
+
+							return CSSMin::buildUrlValue( $embedded );
+						},
+						$rule
 					);
 				}
-				// Move the offset to the end of the match, leaving it alone
-				$offset = $match[0][1] + strlen( $match[0][0] ) + $lengthIncrease;
-				continue;
-			}
 
-			// Guard against double slashes, because "some/remote/../foo.png"
-			// resolves to "some/remote/foo.png" on (some?) clients (bug 27052).
-			if ( substr( $remote, -1 ) == '/' ) {
-				$remote = substr( $remote, 0, -1 );
-			}
+				if ( $embedData && $ruleWithEmbedded !== $ruleWithRemapped ) {
+					// Build 2 CSS properties; one which uses a base64 encoded data URI in place
+					// of the @embed comment to try and retain line-number integrity, and the
+					// other with a remapped an versioned URL and an Internet Explorer hack
+					// making it ignored in all browsers that support data URIs
+					return "$ruleWithEmbedded;$ruleWithRemapped!ie";
+				} else {
+					// No reason to repeat twice
+					return $ruleWithRemapped;
+				}
+			}, $source );
 
-			// Shortcuts
-			$embed = $match['embed'][0];
-			$pre = $match['pre'][0];
-			$post = $match['post'][0];
-			$query = $match['query'][0];
-			$url = "{$remote}/{$match['file'][0]}";
-			$file = "{$local}/{$match['file'][0]}";
+		// Re-insert comments
+		$pattern = '/' . $placeholder . '(\d+)x/';
+		$source = preg_replace_callback( $pattern, function( $match ) use ( &$comments ) {
+			return $comments[ $match[1] ];
+		}, $source );
 
-			$replacement = false;
+		return $source;
 
-			if ( $local !== false && file_exists( $file ) ) {
+	}
+
+	/**
+	 * Remap or embed a CSS URL path.
+	 *
+	 * @param string $file URL to remap/embed
+	 * @param string $query
+	 * @param string $local File path where the source was read from
+	 * @param string $remote URL path to the file
+	 * @param bool $embed Whether to do any data URI embedding
+	 * @return string Remapped/embedded URL data
+	 */
+	public static function remapOne( $file, $query, $local, $remote, $embed ) {
+		// The full URL possibly with query, as passed to the 'url()' value in CSS
+		$url = $file . $query;
+
+		// Skip fully-qualified and protocol-relative URLs and data URIs
+		if ( substr( $url, 0, 2 ) === '//' || parse_url( $url, PHP_URL_SCHEME ) ) {
+			return $url;
+		}
+
+		// URLs with absolute paths like /w/index.php need to be expanded
+		// to absolute URLs but otherwise left alone
+		if ( $url !== '' && $url[0] === '/' ) {
+			// Replace the file path with an expanded (possibly protocol-relative) URL
+			// ...but only if wfExpandUrl() is even available.
+			// This will not be the case if we're running outside of MW
+			if ( function_exists( 'wfExpandUrl' ) ) {
+				return wfExpandUrl( $url, PROTO_RELATIVE );
+			} else {
+				return $url;
+			}
+		}
+
+		if ( $local === false ) {
+			// Assume that all paths are relative to $remote, and make them absolute
+			return $remote . '/' . $url;
+		} else {
+			// We drop the query part here and instead make the path relative to $remote
+			$url = "{$remote}/{$file}";
+			// Path to the actual file on the filesystem
+			$localFile = "{$local}/{$file}";
+			if ( file_exists( $localFile ) ) {
 				// Add version parameter as a time-stamp in ISO 8601 format,
 				// using Z for the timezone, meaning GMT
-				$url .= '?' . gmdate( 'Y-m-d\TH:i:s\Z', round( filemtime( $file ), -2 ) );
-				// Embedding requires a bit of extra processing, so let's skip that if we can
-				if ( $embedData && $embed && $match['embed'][1] > 0 ) {
-					$data = self::encodeImageAsDataURI( $file );
+				$url .= '?' . gmdate( 'Y-m-d\TH:i:s\Z', round( filemtime( $localFile ), -2 ) );
+				if ( $embed ) {
+					$data = self::encodeImageAsDataURI( $localFile );
 					if ( $data !== false ) {
-						// Build 2 CSS properties; one which uses a base64 encoded data URI in place
-						// of the @embed comment to try and retain line-number integrity, and the
-						// other with a remapped an versioned URL and an Internet Explorer hack
-						// making it ignored in all browsers that support data URIs
-						$replacement = "{$pre}url({$data}){$post};{$pre}url({$url}){$post}!ie;";
+						return $data;
 					}
 				}
-				if ( $replacement === false ) {
-					// Assume that all paths are relative to $remote, and make them absolute
-					$replacement = "{$embed}{$pre}url({$url}){$post};";
-				}
-			} elseif ( $local === false ) {
-				// Assume that all paths are relative to $remote, and make them absolute
-				$replacement = "{$embed}{$pre}url({$url}{$query}){$post};";
 			}
-			if ( $replacement !== false ) {
-				// Perform replacement on the source
-				$source = substr_replace(
-					$source, $replacement, $match[0][1], strlen( $match[0][0] )
-				);
-				// Move the offset to the end of the replacement in the source
-				$offset = $match[0][1] + strlen( $replacement );
-				continue;
-			}
-			// Move the offset to the end of the match, leaving it alone
-			$offset = $match[0][1] + strlen( $match[0][0] );
+			// If any of these conditions failed (file missing, we don't want to embed it
+			// or it's not embeddable), return the URL (possibly with ?timestamp part)
+			return $url;
 		}
-		return $source;
 	}
 
 	/**