Re^3: XML::RSS::Parser::Lite Question

[BlenderHead]

Thank you for these warnings!

Am not sure of all the implications of the security issues you mention, but - since the above code contained links which would evoke HTTP_REFERER, I disabled the script.

The bulk of my actual intent was to use the RSS scripts under privatized servers, so only trusted content would be fed to the aggregator. But these issues with public content are good to know, as there's always the want for greater inclusion.

If anyone wishes to further comment, then please feel free to do so. I'm still not sure of how the HTTP_REFERER could be traced, but looking into it now. Anyway, the script link above will not work - though the question is still held open for comment.

Ty.

BH

[Utilitarian]

Hi BlenderHead,
The implication of HTTP_REFERER is that where session info is present in the url of the page, that info will be contained in the HTTP_REFERER header, this can be abused to extract info of poorly guarded sessions to capture currently running session.

The issue with your script's output is the HTML::Entity encoding of data within XML files, in this case the item.description. To resolve use HTML::Entity to decode the encoded chars, however you should then use HTML::Scrubber on the resulting output if you do not trust the originating source.

And Corion's advice about not displaying images from remote/untrusted sources is wise until you have developed a security policy for this scenario. Happy reading ;)