Re: XML_Feed_Parser and HTML security

On 8/16/06, Helgi Þormar Þorbjörnsson <dufuz@php.net> wrote:

On Wed, 16 Aug 2006 20:27:18 +0200, Martin Jansen wrote: On Wed Aug 16, 2006 at 11:3937AM -0400, Arnaud Limbourg wrote:

What about filtering html and give methods to access the raw input ? It makes the package relatively safe to use and different methods make it clear that it is the unfiltered content being accessed without the need to see if a parameter is set to true or false.

This sounds like the best compromise to me. I wonder why we should pollute the package, as in we should keep the API clean, I mean why not just document that the user has to do the escaping them self and provide example with HTML_Safe or so (users are suckers for doing a copy/paste from the examples ;))

I actually agree with this. For those who want feed parsing without HTML_Safe they have it. For those who do want it it's a simple addition. XML_Feed_Parser should parse feeds. Keeping things simple makes them that much easier to maintain and more reusable.

Tho I suppose adding the security part to the project isn't all that bad. One idea would be to have 2 packages, feed_parser and feed_parser_security, the latter is on top of the first one and thus we kinda have the raw/safe API and the user just instances the package depending on what they want but that of course isn't optimal approach at all ;-) Just brainfarting a bit =)

Actually, I like this idea. Either include 2 classes, one which returns raw data dn one which filters (the filterer being extended from the raw one) or just include a sample "safe" class in the docs and/or examples. -- Justin Patrin