Make WordPress Core

Opened 3 years ago

Closed 8 months ago

#17767 closed defect (bug) (fixed)

Anonymous comments can break comments RSS feed

Reported by: dzver Owned by: westi
Milestone: 3.7 Priority: normal
Severity: normal Version: 3.2
Component: Feeds Keywords: 3.3-early westi-likes has-patch easy-fix
Focuses: Cc:


dc:creator and description elements should not be parsed.

Author field that can break RSS:

Аз се казвам Веселин Николов, това е едно много дълго име

Comment text that can break RSS:


(and most of the $allowedentitynames)

Attachments (2)

comments-cdata-suggestion.diff (1.2 KB) - added by dzver 3 years ago.
17767.diff (686 bytes) - added by wonderboymusic 15 months ago.

Download all attachments as: .zip

Change History (10)

comment:1 westi3 years ago

  • Component changed from General to Feeds
  • Keywords 3.3-early westi-likes added
  • Milestone changed from Awaiting Review to Future Release
  • Owner set to westi
  • Status changed from new to accepted
  • Version set to 3.2

comment:2 westi3 years ago

So the underlying issue here is that we use ent2ncr to convert named entities to numeric ones for XML and then do the HTML escaping which converts – to –.

So we need to apply this CDATA change to all the places we do this in feeds or change the order in which we do this filtering so that the named entities that esc_html santizes too will still be encoded.

comment:3 westi3 years ago

  • Cc markjaquith added
  • Keywords 2nd-opinion added

I blamed this back to #929.

I think we should move the ent2ncr calls later to prio 12 instead of 8 which fixes this issue without requiring CDATA'ing.

I would like a 2nd-opinion on this from Mark.

wonderboymusic15 months ago

comment:4 wonderboymusic15 months ago

  • Keywords 2nd-opinion removed
  • Milestone changed from Future Release to 3.6

The original patch added CDATA around <description> and <dc:creator> - <description> was added by Jaquith in [21238], so my freshed patch against trunk just does <dc:creator>

comment:5 ryan11 months ago

  • Milestone changed from 3.6 to Future Release

comment:7 wonderboymusic9 months ago

  • Keywords easy-fix added
  • Milestone changed from Future Release to 3.7

comment:8 westi8 months ago

  • Resolution set to fixed
  • Status changed from accepted to closed

In 25009:

Use a CDATA second for comment authors in RSS2 comment feeds so that HTML in comments doesn't kill the XML validation.

Fixes #17767 props wonderboymusic, dzver.

Note: See TracTickets for help on using tickets.