Discussion Forum Archives vs XML

, ,
1

Imported from previous forum

2

I was searching the discussion forum to see if a question I had about FAST templates had been addressed before.

The good news is, yes, the topic had been covered.

The bad news is the archived messages concerning the topic were unreadable because the XML fragments used to explain the question and the answer disappeared. View Page Source showed that the XML fragments are still there. For example:

Is it possible to convince those-who-maintain-the-archives to properly HTML escape the body of the archived messages?

Dale

3

This enhancement request has already been posted at

http://fixprotocol.org/discuss/read/45887a45

I was searching the discussion forum to see if a question I had about
FAST templates had been addressed before.

The good news is, yes, the topic had been covered.

The bad news is the archived messages concerning the topic were
unreadable because the XML fragments used to explain the question and
the answer disappeared. View Page Source showed that the XML fragments
are still there. For example:

Is it possible to convince those-who-maintain-the-archives to properly
HTML escape the body of the archived messages?

Dale

4

I believe there were some security concerns with accepting HTML or XML snippets within discussion posts–predominantly avoiding exposure to an ‘embedded’ script. We’ll have to take another look at that with the webmaster team.

This enhancement request has already been posted at

http://fixprotocol.org/discuss/read/45887a45

I was searching the discussion forum to see if a question I had about
FAST templates had been addressed before.

The good news is, yes, the topic had been covered.

The bad news is the archived messages concerning the topic were
unreadable because the XML fragments used to explain the question and
the answer disappeared. View Page Source showed that the XML fragments
are still there. For example:

Is it possible to convince those-who-maintain-the-archives to properly
HTML escape the body of the archived messages?

Dale

5

Thanks, Scott,

I was carefully avoiding pointing out that the current mode of operation is a major security risk in the interest of not tempting anyone to try it out, but now that you mention it…

Because the XML text as originally entered by the user does appear in on the page in unescaped form there are a number of interesting exploits that could happen. Escaping the HTML/XML characters, in particular < would prevent most of these (and make the archive more readable.)

Dale

I believe there were some security concerns with accepting HTML or XML
snippets within discussion posts–predominantly avoiding exposure to an
‘embedded’ script. We’ll have to take another look at that with the
webmaster team.

This enhancement request has already been posted at

http://fixprotocol.org/discuss/read/45887a45

I was searching the discussion forum to see if a question I had
about FAST templates had been addressed before.

The good news is, yes, the topic had been covered.

The bad news is the archived messages concerning the topic were
unreadable because the XML fragments used to explain the question
and the answer disappeared. View Page Source showed that the XML
fragments are still there. For example:

Is it possible to convince those-who-maintain-the-archives to
properly HTML escape the body of the archived messages?

Dale

6

A year and a half later, we have a fix for this in production. We are quoting the “<” character except where it precedes some HTML element names which are allowed for formatting purposes (and which are hopefully not found in XML examples!) This is at rendering time, so the old forum messages containing XML are now legible. Thank you all for your patience!

[Cross-posted to Mahesh’s thread in the Website Feedback forum.]