dylang / dylang/node-rss

Remove any script tags from generated feed xml

Open
#69 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
1k
Forks
128
PR merge metrics
No merged PRs in 30d

Description

Hey! 👋

In my opinion `node-rss` should remove all script (e.g. iframe) tags from a generated feed, because some rss validators show the following warnings/recommendations:

`content:encoded should not contain iframe tag`
`description should not contain iframe tag`

These warnings occur if you add `custom_elements` like
```
item.custom_elements.push({
'content:encoded': {
_cdata: ""
}
});
```

Refs https://validator.w3.org/feed/docs/warning/SecurityRisk.html

As this is a rule, it might be helpful for everybody. Let me know if you think that the caller should remove script tags by himself.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.