Re: Re: Embeding HTML into RSS???

ecomputerd wrote:
> 
> 
> I'd love to see a comparison chart of different Readers and their 
> support for this. I think it's technically against XML to embed even
> HTML tags. I may be wrong on that, not sure, especially for CDATA
> information or for properly defined schemas--I'm not an expert on
> that, yet ;-).
> 
> In any case, I would agree that many modern readers can decode 
> standard HTML tags when embedded in the description element (simple 
> things like links, bold, italics). I would not embed JavaScript due 
> to the many ways in which the feed can be presented. Pocket PCs for 
> example support JavaScript 1.1 (ECMA-262) and the Internet Explorer 
> 3.02 DOM. This is only for readers using an embedded Pocket Internet
>  Explorer HTML rendering control. But Bill's right about the security
>  implications of this. And stripping scripts from feeds will be the 
> first thing I do in FeederReader when requested by my users. With RSS
> we are just getting back to universal readability on a multitude of
> platforms. Why cripple that with non-standard JavaScript?

My aggregator is essentially a Java servlet (actually a portlet), and
renders a feed as an HTML fragment. Because the fragment has to co-exist
in the browser window with other HTML content, it absolutely has to be
well-behaved. Consequently my aggregator strips (or tries to):

* All Javascript
* All style attributes
* All frame and iframe elements
* All embed and object elements

All of these are security threats, and all of them can potentially cause
the rendered content to 'leak' out of the portlet window, and mess up
the rest of the page.

There are still a lot of feeds that screw-up the resulting rendition;
notable examples include BoingBoing, and many (most?) feeds from
LiveJournal. A lot of LiveJournal bloggers, in particular, seem to take
a perverse pleasure in putting crap in their postings.

Stripping out the crap is heavy work, and currently relies on a bunch of
quite hairy regular expressions. I don't know a better way of cleaning
up the content, given that the HTML itself is quite likely to be broken,
other than rejecting all HTML tags; which I'm very reluctant to do. So
I'm stuck with heuristics. It's very distasteful, given the superficial
appearance of regularity that RSS presents; but I don't know what else
one can do.

-- 
Jack.



 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/rss-dev/

<*> To unsubscribe from this group, send an email to:
    [email protected]

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/