#37513 [Opn->Csd]: Have news submission system perform HTML sanity checks, prevent RSS breakage

ID: 37513 Updated by: bjori@php.net Reported By: edwardzyang at thewritingpot dot com -Status: Open +Status: Closed Bug Type: Website problem PHP Version: Irrelevant -Assigned To: +Assigned To: bjori New Comment: See http://php.net/feed.atom Previous Comments: ------------------------------------------------------------------------ [2006-11-06 23:11:18] edwardzyang at thewritingpot dot com The real parser is http://cvs.php.net/viewvc.cgi/php-master-web/scripts/rss_parser?view=markup I need to know a little more about server setup before I write a patch. I could use Tidy (very quick and easy fix), but it may not be installed on PHP.net's servers, and thus not be a viable solution. If that is the case, we'll probably have to bundle in a library like HTML Purifier http://hp.jpsband.org/ to do the dirty work. If that seems like overkill, a quick: $text = html_entity_decode($text, ENT_COMPAT, 'UTF-8'); $text = htmlspecialchars($text, ENT_COMPAT, 'UTF-8'); ...would work on PHP 5, but since that's not deployed, you'd be better off replacing the html_entity_decode() with: $text = str_replace(array('&amp;', '&quot;', '&lt;', '&gt;'), array('&', '"', '<', '>'), $text); ...and hope no one uses a non-special entity. If you want that covered too use HTML Purifier. ------------------------------------------------------------------------ [2006-10-06 06:32:40] bjori@php.net http://cvs.php.net/viewvc.cgi/php-master-web/scripts/update-backend ------------------------------------------------------------------------ [2006-10-05 23:18:37] edwardzyang at thewritingpot dot com What file is the RSS parser located in? index.php mentions it but doesn't give any other indication. ------------------------------------------------------------------------ [2006-05-18 21:14:48] edwardzyang at thewritingpot dot com I'm investigating the source. However, it seems like the news items are inlined inside index.php. Factoring them out would present major architectural changes. ------------------------------------------------------------------------ [2006-05-18 21:11:01] goba@php.net We are open for patches. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/37513 -- Edit this bug report at http://bugs.php.net/?id=37513&edit=1