pipes-digital / pipes

Repository for Pipes
https://pipes.digital
GNU Affero General Public License v3.0
248 stars 19 forks source link

Feed Preview parses HTML code in item.description tags #98

Open anewuser opened 1 year ago

anewuser commented 1 year ago

Compare:

~Please make iframes in descriptions display only the code too.~

In the first example, the Feed Preview page displays the generated HTML code as plain text. In the second example, it parses the generated HTML code.

onli commented 1 year ago

I think this follows the spec currently. Have a look at the item in the second feed itself, not the page preview:

 <item>
      <title>Audio</title>
      <link>https://dailyjidols.tumblr.com/post/690686976630915072</link>
      <description>&lt;iframe class=&quot;tumblr_audio_player tumblr_audio_player_690686976630915072&quot; src=&quot;https://dailyjidols.tumblr.com/post/690686976630915072/audio_player_iframe/dailyjidols/tumblr_rczf7b6o5B1v9j3tc?audio_file=https%3A%2F%2Fa.tumblr.com%2Ftumblr_rczf7b6o5B1v9j3tco1.mp3&quot; frameborder=&quot;0&quot; allowtransparency=&quot;true&quot; scrolling=&quot;no&quot; width=&quot;540&quot; height=&quot;169&quot;&gt;&lt;/iframe&gt;</description>
      <category>CoCo</category>
      <category>throwback</category>
      <category>media</category>
      <category>audio</category>
      <pubDate>Sun, 24 Jul 2022 19:20:30 -0000</pubDate>
      <guid isPermaLink="true">https://dailyjidols.tumblr.com/post/690686976630915072</guid>
      <dc:date>2022-07-24T19:20:30Z</dc:date>
    </item>

The html in the description is escaped, exactly like it's supposed to. Do I have a mixup in my thinking?

anewuser commented 1 year ago

I do agree with you. The resulting HTML code should always be escaped both in description and content tags of actual RSS feeds. Pipes does this properly in these examples, and everything works as expected on my feed reader.

My report was actually about the "Feed Preview" page itself:

Resulting RSS Feed Preview page
First example ✔️ Escaped HTML in content:encode ✔️ Unescaped HTML displayed as plain text (as in the pipe editor).
👍 It has always worked like this, and is useful for analyzing the final HTML code.
Second example ✔️ Escaped HTML in description ❌ HTML is parsed and added to the DOM of the Feed Preview page.
👎 This makes it less practical to analyze the code.

Sorry for not being clear at first and mentioning only iframes.