#37513 [Opn]: Have news submission system perform HTML sanity checks, prevent RSS breakage

ID: 37513 User updated by: edwardzyang at thewritingpot dot com Reported By: edwardzyang at thewritingpot dot com Status: Open Bug Type: Website problem PHP Version: Irrelevant New Comment: The real parser is http://cvs.php.net/viewvc.cgi/php-master-web/scripts/rss_parser?view=markup I need to know a little more about server setup before I write a patch. I could use Tidy (very quick and easy fix), but it may not be installed on PHP.net's servers, and thus not be a viable solution. If that is the case, we'll probably have to bundle in a library like HTML Purifier http://hp.jpsband.org/ to do the dirty work. If that seems like overkill, a quick: $text = html_entity_decode($text, ENT_COMPAT, 'UTF-8'); $text = htmlspecialchars($text, ENT_COMPAT, 'UTF-8'); ...would work on PHP 5, but since that's not deployed, you'd be better off replacing the html_entity_decode() with: $text = str_replace(array('&amp;', '&quot;', '&lt;', '&gt;'), array('&', '"', '<', '>'), $text); ...and hope no one uses a non-special entity. If you want that covered too use HTML Purifier. Previous Comments: ------------------------------------------------------------------------ [2006-10-06 06:32:40] bjori@php.net http://cvs.php.net/viewvc.cgi/php-master-web/scripts/update-backend ------------------------------------------------------------------------ [2006-10-05 23:18:37] edwardzyang at thewritingpot dot com What file is the RSS parser located in? index.php mentions it but doesn't give any other indication. ------------------------------------------------------------------------ [2006-05-18 21:14:48] edwardzyang at thewritingpot dot com I'm investigating the source. However, it seems like the news items are inlined inside index.php. Factoring them out would present major architectural changes. ------------------------------------------------------------------------ [2006-05-18 21:11:01] goba@php.net We are open for patches. ------------------------------------------------------------------------ [2006-05-18 21:07:16] edwardzyang at thewritingpot dot com Description: ------------ The news items on PHP.net often are sloppily written, with improper encodings and unencoded ampersands. Perhaps you guys should get HTMLTidy to give HTML code a sanity check before allowing it to be submitted. This is even more important for RSS, because one stray ampersand can break the whole feed. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=37513&edit=1