search

jackjamieson2 / yarns-microsub-server

Yarns is a Microsub server that runs as a plugin on your WordPress site.
GNU General Public License v2.0
20 stars 4 forks source link

Escaped HTML / JS leaks into item text #104

Closed bekopharm closed 3 years ago

bekopharm commented 4 years ago

While most of my feeds look fine and do no longer inject HTML I've various feeds that show escaped HTML or JS in feed items that should not be there:

Examples:

Leaked HTML that should not be there

<div class="if-your-feed-reader-displays-this-then-it-is-violating-the-Atom-spec-RFC-4287-section-4.2.14"></div>

gnome-shell-screenshot-KCGNK0

Leaked JSON-LD data

{"@context":"http://schema.org","@type":"Review","author": [...]

gnome-shell-screenshot-FEOOK0

HTML Entities

Nach einem &quot;Computerangriff von außen&quot;

gnome-shell-screenshot-TIXLK0

Facebook Launches &#039;Discover,&#039; A Secure Proxy

gnome-shell-screenshot-UXOKK0

Both readers I use, Monocle and Indigenous for Android, look the same on this.

May be related to #74 and #15

Preview (RSS and ATOM) is also affected: gnome-shell-screenshot-TEWEK0

Feeds look fine in regular feed readers, like Liferea

dshanske commented 4 years ago

@bekopharm I may take this over at github.com/dshanske/parse-this and see about better filtering. @jackjamieson2 hasn't updated to the latest version of Parse This, which actually does something with JSON-LD, so not sure if I already fixed some of this, but I can check if you provide the URLs for the feed.

bekopharm commented 4 years ago

Huh, so I did manage to bark up the wrong tree again :confused:

I'll compile a list @dshanske :+1:

jackjamieson2 commented 4 years ago

Thanks @bekopharm and @dshanske. I’m quite behind on yarns updates, sorry for that! @dshanske let me know if you resolve this in parse this and I’ll push a new version.

dshanske commented 4 years ago

@jackjamieson2 Hope you are staying safe. I did a major update on Parse This to add JSON-LD and other options a few weeks back, but I intend to return to add docblocks and will likely do some code cleanup then.

jackjamieson2 commented 4 years ago

@dshanske Safe here, thanks! Even without COVID-19 I'd be staying home to write right now, so things aren't too bad for me. Mostly just buried in writing, which is why I haven't been active on development stuff or IRC. Hope you're staying safe too.

dshanske commented 4 years ago

@bekopharm I've been exploring this, and it is an upstream issue. SimplePie is stripping the script tags...so that is why my code isn't.

dshanske commented 4 years ago

I'm disabling SimplePie's stripping in favor of my own.

dshanske commented 3 years ago

Resolved with refresh of Parse This library