404198 - Links from feed not properly escaped

Status: RESOLVED FIXED

(MailNews Core :: Feed Reader, defect)

Description

[Christian Schmidt]

When reading feeds, the link is not properly escaped when generating the HTML page used in the preview pane.

If a feed contains a reference to the following URL:
  http://example.org/foo?bar©

i.e. if the RSS file contains this:
  <link>http://example.org/foo?bar&amp;copy;</link>

then the generated HTML contains the following (you can see it with View Source):
  <iframe id ="_mailrssiframe" src="http://example.org/foo?bar&copy;">
    Lorem ipsum
  </iframe>

The "&copy;" part of the URL is treated as an HTML entity and is translated to a copyright sign (©), so the the URL that is loaded is this:
  http://example.org/foo?bar%C2%A9

Comment 1

[Christian Schmidt]

Attachment: Escape HTML entities

In this specific case it may be sufficient to only escape "&", but I escape the other characters just to be safe.

Comment 2

[Christian Schmidt]

Attachment: Escape HTML entities (updated patch)

Comment 3

[Magnus Melin [:mkmelin]]

Why not ' for escaping of ' ?

Comment 4

[Christian Schmidt]

Because (In reply to comment #3)
> Why not ' for escaping of ' ?
The entities are used in an HTML document (at least it looks like HTML, though it doesn't have a DOCTYPE - but it definately isn't XHTML). ' is defined in XML (including XHTML) but not in HTML.

Appearently Gecko does support ' in HTML documents, though, and ' will be defined in the next version of HTML, so I guess there is no harm in using it, though I'd suggest we stick with HTML 4.01 and ' as long as Gecko's support for HTML5 is so limited as it currently is.

Comment 5

[Mark Banner (:standard8)]

Comment on attachment 289207 [details] [diff] [review]
Escape HTML entities (updated patch)

This patch still seems to apply.

Comment 6

[Magnus Melin [:mkmelin]]

Comment on attachment 289207 [details] [diff] [review]
Escape HTML entities (updated patch)

Sorry for the delay, this looks good. 

pushed to c-c; changeset: 338:2af3ef0df217

http://hg.mozilla.org/comm-central/rev/2af3ef0df217

Comment 7

[Magnus Melin [:mkmelin]]

->FIXED