diff --git a/includes/parser/Sanitizer.php b/includes/parser/Sanitizer.php index 2d6934bb93a..7e8a669e3a3 100644 --- a/includes/parser/Sanitizer.php +++ b/includes/parser/Sanitizer.php @@ -512,8 +512,11 @@ class Sanitizer { # * Disallow data attributes used by MediaWiki code # * Ensure that the attribute is not namespaced by banning # colons. + # * Ensure attribute name will be accepted by the HTML + # parser; see + # https://github.com/whatwg/dom/issues/849#issuecomment-1007541209 if ( ( - !preg_match( '/^data-[^:]*$/i', $attribute ) && + !preg_match( '|^data-[^: \t\r\n/>\0]*$|i', $attribute ) && !array_key_exists( $attribute, $allowed ) ) || self::isReservedDataAttribute( $attribute ) ) { continue;