Prevent tag injection

[eliemichel]

When importing tags directly from feed, some of them can be system tags or even virtual tags. We have to be aware of that, although I don't exactly know what behavior to expect.

My idea is that:

• System tags may be leaved un escaped, because it could be interesting for some advanced features such as recognizing a particular entry format and so display it in another way. But it would be anoying for tags such as _sticky or _no_home. We could either blacklist or on the contrary whitelist some tags.
• Virtual tags better be escaped. Maybe by a html entity that would enable a pretty printing rom the user point of view.

[Phyks]

Up. Any new ideas on this topic?

[eliemichel]

Is it really an urgent feature? Actually we did not decide of the expected behavior…

[Phyks]

Not urgent. Just to know wether someone had clearer ideas about this subject or not.