Security Issues in class Snoopy within trunk

[hakre]

The core trunk codebase contains a class called Snoopy which has security issues (it is said). Next to this, one I found in concrete is that it does not properly fitler XML/HTML so it's open to XSS and other forms of injection.

1. If the class is still in use I suggest to replace it with WP API functions (related: #8082).
2. (Then,) If the class isn't any longer in use, I suggest to remove it from trunk.
3. It's about time. If you do not think so, then the class should be mimicked with WP API functions.

In any case that code should be removed finally.

[dd32]

Snoopy will be staying for backcompat for a little bit longer.

Snoopy should not be responsible for any XSS/filtering, its designed to return the raw content of a URL, the same as WP_HTTP is. Data from all external sources should be filtered properly by the functions using it.

Snoopy is no longer used by WordPress at all, Magpie which used it has a WP_HTTP -> Snoopy-style-result compat function.

Closing as worksforme due to the above reasons. If you wish to have a ticket for removal of snoopy, please open one for Future Release without Security-conotations for the removal.

[nacin]

MagpieRSS in turn is deprecated in favor of Simplepie, of course.