Make WordPress Core

Opened 10 years ago

Closed 8 years ago

#17767 closed defect (bug) (fixed)

Anonymous comments can break comments RSS feed

Reported by: dzver Owned by: westi
Milestone: 3.7 Priority: normal
Severity: normal Version: 3.2
Component: Feeds Keywords: 3.3-early westi-likes has-patch easy-fix
Focuses: Cc:


dc:creator and description elements should not be parsed.

Author field that can break RSS:

Аз се казвам Веселин Николов, това е едно много дълго име

Comment text that can break RSS:


(and most of the $allowedentitynames)

Attachments (2)

comments-cdata-suggestion.diff (1.2 KB) - added by dzver 10 years ago.
17767.diff (686 bytes) - added by wonderboymusic 9 years ago.

Download all attachments as: .zip

Change History (10)

#1 @westi
10 years ago

  • Component changed from General to Feeds
  • Keywords 3.3-early westi-likes added
  • Milestone changed from Awaiting Review to Future Release
  • Owner set to westi
  • Status changed from new to accepted
  • Version set to 3.2

#2 @westi
10 years ago

So the underlying issue here is that we use ent2ncr to convert named entities to numeric ones for XML and then do the HTML escaping which converts – to –.

So we need to apply this CDATA change to all the places we do this in feeds or change the order in which we do this filtering so that the named entities that esc_html santizes too will still be encoded.

#3 @westi
10 years ago

  • Cc markjaquith added
  • Keywords 2nd-opinion added

I blamed this back to #929.

I think we should move the ent2ncr calls later to prio 12 instead of 8 which fixes this issue without requiring CDATA'ing.

I would like a 2nd-opinion on this from Mark.

9 years ago

#4 @wonderboymusic
9 years ago

  • Keywords 2nd-opinion removed
  • Milestone changed from Future Release to 3.6

The original patch added CDATA around <description> and <dc:creator> - <description> was added by Jaquith in [21238], so my freshed patch against trunk just does <dc:creator>

#5 @ryan
9 years ago

  • Milestone changed from 3.6 to Future Release

#7 @wonderboymusic
8 years ago

  • Keywords easy-fix added
  • Milestone changed from Future Release to 3.7

#8 @westi
8 years ago

  • Resolution set to fixed
  • Status changed from accepted to closed

In 25009:

Use a CDATA second for comment authors in RSS2 comment feeds so that HTML in comments doesn't kill the XML validation.

Fixes #17767 props wonderboymusic, dzver.

Note: See TracTickets for help on using tickets.