5 ms·

Seems like RSS is broken in this regard. As far as I can tell, the spec doesn't clear whether the title element is HTML or plaintext. [1][2] So the HN RSS feed

Seems like RSS is broken in this regard. As far as I can tell, the spec doesn't clear whether the title element is HTML or plaintext. [1][2] So the HN RSS feed inserts the title of this article into the <title> element as plaintext, but all the readers I tried stripped out the <script> tag, apparently treating the content of the <title> element as HTML markup. Atom though unambiguously specifies that the <title> (and other) elements should be treated as plaintext unless specified otherwise with the type attribute. [3][4] [1] https://www.rssboard.org/rss-draft-1#data-types-characterdata https://www.rssboard.org/rss-draft-1#data-types-characterdat... [2] https://www.rssboard.org/rss-specification#hrelementsOfLtitemgt https://www.rssboard.org/rss-specification#hrelementsOfLtite... [3] https://datatracker.ietf.org/doc/html/rfc4287#section-4.2.14 https://datatracker.ietf.org/doc/html/rfc4287#section-4.2.14 [4] https://datatracker.ietf.org/doc/html/rfc4287#section-3.1.1 https://datatracker.ietf.org/doc/html/rfc4287#section-3.1.1

bscphil 2y ago
> Atom though unambiguously specifies that the <title> (and other) elements should be treated as plaintext unless specified otherwise with the type attribute. I haven't looked at the part of the Atom spec you're talking about, but what does "treat as plaintext" mean when a title could be the literal text "</title><script src=..."
- LinAGKar 2y ago
  Then the reader should display that as text, and not try to parse it. Assuming that's actually the textual content of the <title> element, which would then be serialized <title><![CDATA[</title><script src=...]]></title> or <title></title><script src=...</title>. If the markup reads <title></title><script src=...</title>, that would probably mean you've got a buggy feed generator constructing the markup by hand instead of using an XML serializer. Based on the how I understand the RSS spec, a feed could possibly contain <title><![CDATA[<i>Title</i>]]></title> and expect the title to be italic, but in Atom it would have to be <title type="html"><![CDATA[<i>Title</i>]]></title> to render as italic, otherwise the "<i>Title</i>" would be written out literally by a compliant reader.
- kevincox 2y ago
  No. In both RSS and Atom the content of the title tag is a string (and is encoded into the XML as required). The question is just if if that string should be treated as text/plain or text/HTML. RSS doesn't specify. This type of ambiguity is the main reason that I recommend using Atom.
  - ttepasse 2y ago
    Atom has even three variants of the content model, one where the content is XHTML. As pure text <atom:title atom:type="text">E = mc²</atom:title> As entity-encoded “HTML”: <atom:title atom:type="html>E = mc<sup>2</sup></atom:title> Or as directly embedded XHTML: <atom:title atom:type="xhtml> <div xmlns="http://www.w3.org/1999/xhtml"> <var>E</var> = <var>m</var><var>c</var><sup>2</sup> </div> <atom:title> (The superfluous div element seems to be a result of a compromise for the early 2000s web environment, afair.)
DonHopkins 2y ago
The worst use of the <BLINK> tag ever was the discussion held in the early days of RSS about escaping HTML in titles, whose attention-grabbing title went something like this: "Hey, what happens when you put a <BLINK> tag in the title???!!!" The content of that notorious discussion went on and off and on and off for weeks, giving all the netizens of the RSS community blogosphere terrible headaches, with people's entire blogs disappearing and reappearing every second, until it finally reached a flashing point, when Dave Winer humbly conceded that it wasn't the user's fault for being an idiot, and maybe just maybe there was tiny teeny little design flaw in RSS, and it wasn't actually such a great idea to allow HTML tags in RSS titles.

bscphil 2y ago

> Atom though unambiguously specifies that the <title> (and other) elements should be treated as plaintext unless specified otherwise with the type attribute. I haven't looked at the part of the Atom spec you're talking about, but what does "treat as plaintext" mean when a title could be the literal text "</title><script src=..."

LinAGKar 2y ago
Then the reader should display that as text, and not try to parse it. Assuming that's actually the textual content of the <title> element, which would then be serialized <title><![CDATA[</title><script src=...]]></title> or <title></title><script src=...</title>. If the markup reads <title></title><script src=...</title>, that would probably mean you've got a buggy feed generator constructing the markup by hand instead of using an XML serializer. Based on the how I understand the RSS spec, a feed could possibly contain <title><![CDATA[<i>Title</i>]]></title> and expect the title to be italic, but in Atom it would have to be <title type="html"><![CDATA[<i>Title</i>]]></title> to render as italic, otherwise the "<i>Title</i>" would be written out literally by a compliant reader.
kevincox 2y ago
No. In both RSS and Atom the content of the title tag is a string (and is encoded into the XML as required). The question is just if if that string should be treated as text/plain or text/HTML. RSS doesn't specify. This type of ambiguity is the main reason that I recommend using Atom.
- ttepasse 2y ago
  Atom has even three variants of the content model, one where the content is XHTML. As pure text <atom:title atom:type="text">E = mc²</atom:title> As entity-encoded “HTML”: <atom:title atom:type="html>E = mc<sup>2</sup></atom:title> Or as directly embedded XHTML: <atom:title atom:type="xhtml> <div xmlns="http://www.w3.org/1999/xhtml"> <var>E</var> = <var>m</var><var>c</var><sup>2</sup> </div> <atom:title> (The superfluous div element seems to be a result of a compromise for the early 2000s web environment, afair.)

DonHopkins 2y ago

The worst use of the <BLINK> tag ever was the discussion held in the early days of RSS about escaping HTML in titles, whose attention-grabbing title went something like this: "Hey, what happens when you put a <BLINK> tag in the title???!!!" The content of that notorious discussion went on and off and on and off for weeks, giving all the netizens of the RSS community blogosphere terrible headaches, with people's entire blogs disappearing and reappearing every second, until it finally reached a flashing point, when Dave Winer humbly conceded that it wasn't the user's fault for being an idiot, and maybe just maybe there was tiny teeny little design flaw in RSS, and it wasn't actually such a great idea to allow HTML tags in RSS titles.