script tag in entry content is not stripped out

[heubergen]

I have install ownCloud 8, Opera 27.0 and install all Dependencies.
When I read a article from a feed I see some not nice code, that I don't see on other feed reader like tiny-tiny.

The Bug depend not only the web client, I have the same issue on my mobile client so I think it is problem here.

[cosenal]

Please read this: https://github.com/owncloud/news#bugs

[heubergen]

The feed is a valid Atom 1.0 feed.

Bug is also happen on supported browser:

[cosenal]

Does it happen only with this particular feed? Do you mind to share the feed address?

[heubergen]

Hmm, bug seems to happen only with this specific feed.
I can not share the address from this feed public (its a paid subscription) but I will share it with you.

Here a screenshot how other feed reader render this code:

Anyway I send you @cosenal a mail with the feed so you can test it.

[cosenal]

Thanks a lot. I will have a look

[cosenal]

It's a valid feed, but so many warnings!

Anyway, it looks like we don't strip out the script tag (see http://validator.w3.org/feed/docs/warning/SecurityRisk.html) cc @Raydiation

I created a demo feed with the same issue:
https://gist.githubusercontent.com/cosenal/b803844b747e180cec92/raw/786320a8f5f2a4e72ac42eb1c5bb2c0ffd5f8b38/feed.xml

gist: https://gist.github.com/cosenal/b803844b747e180cec92

[BernhardPosselt]

Hm we run it through two sanitizers and it's quite a trivial thing to sanitize. Will take a look next week once I'm back from holidays

[BernhardPosselt]

PS, not a security issue since the script tag is converted to text, can confirm the bug.

Actually why the fuck are these guys serving a script tag in their feeds xD?

Are they trying to XSS their subscribers?

[cosenal]

You're right, no security issue (my link to w3 was just to explain what a reader is supposed to do).

Also, I have no idea why their feeds suck so much, I run the OP's feed through w3 validator and it counts more than a thousand warnings!

[cosenal]

It works perfectly on OP's feed. Thanks!