HTML entities stripped from item title

Eg: ">"

I'm parsing https://groups.google.com/forum/feed/mozilla.dev.platform/topics/rss.xml?num=50

The item titled "Intent to unship: as in image maps" has those entities encoded as < and > respectively.

However, in the code example below, the entities are missing from item.title, as is detectable from the length:

let url = 'https://groups.google.com/forum/feed/mozilla.dev.platform/topics/rss.xml?num=50';
let req = request(url);
let feedparser = new FeedParser();

req.on('response', function (res) {
this.pipe(feedparser);
});

feedparser.on('readable', function() {
let item = this.read();
console.log(item.title.length)
}

@autonome

@autonome Thanks for opening this issue.

This stripping is being done intentionally -- however, I can't actually remember why. 😬 Presumably, the idea was to avoid handing people a XSS injection foot-gun.

Note that the un-stripped title is available: item['rss:title']['#'].

{ title: 'Intent to unship:  as  in image maps',
  description: 'Hi, In bug 1317937 I intend to unship the feature of <a> elements acting the same way as <area> elements in image maps. This functionality was specced in HTML 4, but no other browser implemented it and was removed from HTML 5. Timothy (:tnikkel) tried to do it before, but it got blocked on',
  summary: 'Hi, In bug 1317937 I intend to unship the feature of <a> elements acting the same way as <area> elements in image maps. This functionality was specced in HTML 4, but no other browser implemented it and was removed from HTML 5. Timothy (:tnikkel) tried to do it before, but it got blocked on',
  date: 2017-11-08T23:50:27.000Z,
  pubdate: 2017-11-08T23:50:27.000Z,
  pubDate: 2017-11-08T23:50:27.000Z,
  link: 'https://groups.google.com/d/msg/mozilla.dev.platform/JUB5K-sz6ek/F4hQWdDRBQAJ',
  guid: 'https://groups.google.com/d/topic/mozilla.dev.platform/JUB5K-sz6ek',
  author: 'Emilio Cobos Álvarez',
  comments: null,
  origlink: null,
  image: {},
  source: {},
  categories: [],
  enclosures: [],
  'rss:@': {},
  'rss:title':
   { '@': {},
     '#': 'Intent to unship: <a> as <area> in image maps' },
  'rss:link':
   { '@': {},
     '#': 'https://groups.google.com/d/msg/mozilla.dev.platform/JUB5K-sz6ek/F4hQWdDRBQAJ' },
  'rss:description':

Thanks for the quick reply Dan! Great to know there's a workaround :D Totally understand the footgun concern. Difficult trade-off against correctness though. I'm not sure the trade-off is worth it, as the content is already escaped. IIUC, the XSS risk would not occur by printing this content directly to a screen. The risk would occur only if someone first unescapes the content and then prints it.

…

On Thu, Nov 23, 2017 at 9:25 AM Dan MacTough ***@***.***> wrote: @autonome <https://github.com/autonome> Thanks for opening this issue. This stripping is being done intentionally <de3566b> -- however, I can't actually remember why. 😬 Presumably, the idea was to avoid handing people a XSS injection foot-gun. Note that the un-stripped title is available: item['rss:title']['#']. { title: 'Intent to unship: as in image maps', description: 'Hi, In bug 1317937 I intend to unship the feature of <a> elements acting the same way as <area> elements in image maps. This functionality was specced in HTML 4, but no other browser implemented it and was removed from HTML 5. Timothy (:tnikkel) tried to do it before, but it got blocked on', summary: 'Hi, In bug 1317937 I intend to unship the feature of <a> elements acting the same way as <area> elements in image maps. This functionality was specced in HTML 4, but no other browser implemented it and was removed from HTML 5. Timothy (:tnikkel) tried to do it before, but it got blocked on', date: 2017-11-08T23:50:27.000Z, pubdate: 2017-11-08T23:50:27.000Z, pubDate: 2017-11-08T23:50:27.000Z, link: 'https://groups.google.com/d/msg/mozilla.dev.platform/JUB5K-sz6ek/F4hQWdDRBQAJ', guid: 'https://groups.google.com/d/topic/mozilla.dev.platform/JUB5K-sz6ek', author: 'Emilio Cobos Álvarez', comments: null, origlink: null, image: {}, source: {}, categories: [], enclosures: [], 'rss:@': {}, 'rss:title': { '@': {}, '#': 'Intent to unship: <a> as <area> in image maps' }, 'rss:link': { '@': {}, '#': 'https://groups.google.com/d/msg/mozilla.dev.platform/JUB5K-sz6ek/F4hQWdDRBQAJ' }, 'rss:description': — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#243 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AADDt5olTZ8ZVmD1_wMiya2EhUJYpAmtks5s5NebgaJpZM4QnMJP> .

related to #165

Change default behavior to not strip html by default

@danmactough

Wonderful, thanks @danmactough!

Change default behavior to not strip html by default

Resolved by #304

Navigation Menu

Repository navigation

HTML entities stripped from item title #243

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

HTML entities stripped from item title #243

Description

Activity

danmactough commented on Nov 23, 2017

autonome commented on Nov 23, 2017

danmactough commented on Dec 9, 2017

autonome commented on Jan 4, 2018

danmactough commented on May 14, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions