Post #4278370
2026-07-17 04:54 UTC
Atom and JSON Feed aren’t really any better. Can anyone tell me what the intended security origin is for the snippets of HTML content included in feeds? I doubt if even the authors of these format specs thought about it.
The atom spec, despite being written in the style of an engineering document, literally just says “pay particular attention to the security of” elements where the origin would matter. No amount of my attention is going to make up for the gaping holes in your spec, sorry
Replies (2)
-
@dale_price@mastodon.online 2026-07-17 05:10
Too many devs think any rich text is a problem they can just throw HTML at (*cough* mastodon API *cough* activitypub *cough*). Congratulations, you just threw all of HTML, Javascript, and CSS's security and privacy issues on top of your problem. Now you have a pile of problems.
-
@iamkonstantin@mstdn.social 2026-07-17 05:13
@dale_price@mastodon.online I think they’re just fragments of HTML (they don’t have an origin) like content. So a renderer would inject them into a template of sorts and also needs to sanitise them.