Fix css decoding in the sanitizer

While investigating our handling of the non-IE6 part of bug 55332, I noticed
that our CSS char escape decoding was fairly broken. The regexp was not
adjusted properly for JS, the return values were checking for the empty string
instead of undefined and codepointToUtf8 did not look as if it ever worked
(and used the deprecated unescape method too).

The good news is that the original code does not seem to suffer from the
reported security vulnerability either.

The new code properly decodes the escape and detects the css string as
dangerous.

Bug 55332 also discusses IE6-specific vulnerabilities, but as our current main
user is VE which won't ever be enabled with IE6 we probably don't need to care
any more. I asked for browser stat data in support of a possible
no-session-for-IE6 policy in bug 56575.

Bug: 55332
Change-Id: Ia0230f2258a360749a6cbffff716ed426a207ce9
Default initial MW page is Main Page (capitalized P)

Change-Id: I755f6ecc679188e698993b87b1ff279c951cb2e7
Merge "Fix css decoding in the sanitizer"
(Bug 56733) Fixed bug serialization template args containing " : "

* Template arg escaping code tokenizes arg string and uses that
  to escape any problematic substrings. This was modifying " : "
  substrings because of special case treatment of this pattern
  in the tokenizer (I dont understand why Parsoid and the PHP parser
  has this special case). This is the second or third bug that
  has cropped up because of this special case.

* Added parser test that passes with this patch and failed without
  the fix.

Change-Id: If8297165e9a1b320515eaff90683ef6a20d2cc7e
Merge "Default initial MW page is Main Page (capitalized P)"
Merge "(Bug 56733) Fixed bug serialization template args containing " : ""
Treat WikiLink/Category like PageProp/Category while serializing

* We've had bug reports on the VE/F page about new categories
  not serializing on a new line. Found that this is because
  VE temporarily went back to the old RDF annotations when we
  reverted our deploy last week.

* This patch makes us backward compatible till a new version of
  VE is deployed with the new RDF annotations for categories.

Change-Id: I2cc6b9bcb7bdc8c952ce8bec2ed123a49250253d
Change round-trip test db page prefix to 24 chars

Change-Id: I0761d0da8e1cfa57e0bdc16cc6087d290f68e0af
Remove 'wiki' from prefix to get the actual wikipedia URL

TODO: Make this more intelligent when we start testing other wikis.

Change-Id: I3758394f21fa1258817b15ba8c6bc3947d48a859
Better error handling in the ParserService

200b9eae019de50aa770c7fdf2daacb82c9080ce and
5cc3dfb83f6d2741be88a7f38e63f70dc6c63730 introduce some wonkiness.

 * Parse now acts on an error from TemplateRequest right away, instead of
   deferring till after Util.parse.

 * Message wasn't being properly stored in EnvError.

 * A restart flag is added to the errCB because only certain errors
   should invoked a process restart.

 * Removed fetching the default pageinfo when no pagename is supplied.

 * Redirect url is constructed from the prefix and target instead of
   req.path. Ex.

     /en/ -> /en/Main_page?oldid=12345
     /en/test -> /en/Test?oldid=34567

 * Cleans up favicon conditions now that they are supported.

 * html2wt() expects html param to be a string.

Change-Id: I2694f9f968a297f82294a54f1e1b2a75d66725eb
Some clean-up and fixes for the external API

* Use relative redirects so that they work both using internal and external
  IPs / addresses
* Remove /en/ style default prefixes in favor of production /enwiki/ etc to
  avoid cache misses
* Fix an encoding issue this uncovered in parserTests. Did not investigate too
  deeply why the language change triggered this, but the bug needed fixing in
  any case.

Change-Id: Iccc1fcf2ded40fb07319092070a2704366880c9c
(Bug 56983) Correctly serialize magic words added on client

* Added generic support for serialization of magic words added
  on the client.

* Unrecognized magicword directives in HTML are silently dropped
  on serialization.

* Minor code cleanup associated with adding support for this.

* Added new parser test to test this (passes with this patch
  and fails without).

Change-Id: I4afef6a1e8a5acbe5b0ac673fabe1d9bcd3cc0bf
Fixed DSR errors introduced by DOM spec changes

* DSR computation used DOM Spec markers on A-tags to detect
  source wikitext syntax in computing dsr tag widths. This code
  went out ofsync with DOM spec changes.

* This patch introduces helpers to detect a-tag source syntax
  and adds additional data-parsoid markers for rfc/pmid/isbn
  uses.

* Eliminated lower-case html tag names in
  mediawiki.wikitext.constants.js which got rid of the only
  lower-case HTML tag names in that file.

* No change in parser test results but 25 fewer DSR warnings
  and eliminates NaN entries.

Change-Id: Idf0a15d64739da5d82f0632864987ff547daded6
tagId was incorrectly used as tsr info in TreeBuilderFixups

 * Populates data-stag with tag tsr info for later use when adding
   placeholder metas.

 * Fixes the long crashes we saw on round-trip tests. They were the
   result of not having a tsr end number on the meta tag, which soaked
   up the entire page into data-parsoid, subsequently dragging jsDiff to
   a halt.

Bug: 57069
Bug: 57071
Change-Id: Iff6341c5260b534282d13e4881aa38ea40722728
Add commonswiki prefix by default

Change-Id: Id504ba7d6ea1d170023973c8823fc7501eb09e0a
js/README.txt instructions to run node server

I am a very lazy person and would have loved to get some basic
instructions to easily start the node server (ie without having to
browse the wiki).

Added in the instructions to create a localsettings.js and how to start
the server.  Point to the extensive wiki doc.

Change-Id: If0d2091eff2cfdf6b09ff07c415774141d4b5c50
Merge "js/README.txt instructions to run node server"
Merge "Fixed DSR errors introduced by DOM spec changes"
Merge "(Bug 56983) Correctly serialize magic words added on client"
Suppress harmless DSR inconsistency warnings

* Added 2 scenario which suppresses 54 warnings.
* More scenarios to be added later.

Change-Id: I65e9b93e72453b006c817cb2d880e40234b0bf26