Don't escape entities inside CDATA

[akirk]

Laravel feeds of posts that contain quotes in titles when parsed by standard-compliant XML parsers, contain " instead of just a ". The reason is that a CDATA section is being used in combination with Blade's htmlspecialchars handling.

https://www.w3.org/TR/REC-xml/#dt-cdsection

Within a CDATA section, only the CDEnd string is recognized as markup, so that left angle brackets and ampersands may occur in their literal form; they need not (and cannot) be escaped using " < " and " & ". CDATA sections cannot nest.

One possible solution would be to just remove the CDATA sections and let htmlspecialchars do its thing or to create a special output function for CDATA content. I chose the latter approach.

For unit tests, I have just added some "dangerous" markup to the "feedItemTitle" of the DummyItems but I am not sure this is the best approach. Please advise.

[akirk]

I just realized this was already addressed in the stale and auto-closed #77, this is still a problem.

[freekmurze]

Thank you for this. We're not getting any reports from current users that this is currently broken.

Could you give an example where the current implementation renders the wrong results?

[akirk]

For example, https://validator.w3.org/feed/check.cgi?url=https%3A%2F%2Ffreek.dev%2Ffeed tells me

This feed is valid, but interoperability with the widest range of feed readers could be improved by implementing the following recommendations.
line 27, column 77: title should not contain HTML unless declared in the type attribute: ' (4 occurrences) [help]

or https://validator.w3.org/feed/check.cgi?url=https%3A%2F%2Fbenjamincrozat.com%2Ffeed

line 10, column 77: title should not contain HTML unless declared in the type attribute: ' (13 occurrences) [help]

Or when parsing a feed with an XML parser and getting the entry title with xpath:

curl -s https://freek.dev/feed | xpath -e '//feed/entry[2]/title/text()'
Found 1 nodes in stdin:
-- NODE --
What's new in PHP 8.3? Take a sneak peek.

Whereas when I fix the CDATA, I get this

xpath -e '//feed/entry[2]/title/text()' freek.rss
Found 1 nodes in freek.rss:
-- NODE --
What's new in PHP 8.3? Take a sneak peek.

For those feeds the Firefox Extension RSS Preview also shows the HTML entities in the titles:

[freekmurze]

Thanks!