diff --git a/src/Core/Sanitizer.php b/src/Core/Sanitizer.php index 086ac1ea9..14c1eea7c 100644 --- a/src/Core/Sanitizer.php +++ b/src/Core/Sanitizer.php @@ -965,7 +965,10 @@ class Sanitizer { # * Disallow data attributes used by MediaWiki code # * Ensure that the attribute is not namespaced by banning # colons. - if ( ( !preg_match( '/^data-[^:]*$/iD', $k ) && !isset( $list[$k] ) ) + # * Ensure attribute name will be accepted by the HTML + # parser; see + # https://github.com/whatwg/dom/issues/849#issuecomment-1007541209 + if ( ( !preg_match( '|^data-[^: \t\r\n/>\0]*$|iD', $k ) && !isset( $list[$k] ) ) || self::isReservedDataAttribute( $k ) ) { $newAttrs[$k] = [ null, $origV, $origK ];