Repository navigation
Conversation
The feed templates interpolated every value raw, so a node or network
name containing an `&`, `<` or `>` produced a document no XML parser
accepts:
feed.xml:4: parser error : xmlParseEntityRef: no name
<title>Unreachable nodes - Signet & Testnet</title>
RSS readers reject the whole feed in that case rather than skipping the
offending item, so a single such name silently takes down all four feeds
for everyone subscribed. Node and network names come straight from the
operator's config, which makes this reachable without anything unusual
going on.
The escaping happens in the Display implementations rather than at the
call sites, so a field added later can't forget it. The five predefined
entities cover both character data and the double-quoted atom:link
attribute.
All four feeds built the channel `<link>` as
{base}?network={id}?src={feed}
with a second `?` where the parameter separator belongs. A reader that
follows the link hands the frontend a network parameter whose value is
`1?src=forks-rss`, which matches no network, so the link lands on the
default network instead of the one the feed is about.
The four call sites built their two URLs by hand, which is how they
drifted apart in the first place, so they now go through one helper.
Writing the separator as a plain `&` is correct because the Display
implementation escapes it into `&` on the way out.
The atom:link self `href` was built as `{base}/rss/...`, while the
channel `<link>` appended its query string to the base directly. Only
one of the two can be right for a given base_url, and the value the
example config ships ends in a slash, so a stock deployment advertises
itself as
https://fork-observer.example.com//rss/1/forks.xml
The self link is what a reader stores and polls, and what it compares
against the URL it was subscribed at, so a base_url without the trailing
slash moved the problem to the channel link instead.
Trimming the trailing slash once makes both URLs independent of how the
base_url is written.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fixes a few things with the RSS feeds:
&,<or>produced a document no XML parser accepts:xmlParseEntityRef: no nameon a title likeUnreachable nodes - Signet & Testnet. Readers reject the whole feed rather than skipping the bad item, and names come straight from the operator's config. Escaping now happens in theDisplayimplementations so a new field cannot forget it.{base}?network={id}?src={feed}, with a second?where the parameter separator belongs. Following it hands the frontend a network parameter that matches nothing, so the reader lands on the default network instead of the one the feed is about.atom:linkselfhrefappended/rss/...to a base the example config ends with a slash, advertisinghttps://fork-observer.example.com//rss/1/forks.xml. That URL is what a reader stores and polls, and what it compares against the URL it was subscribed at. Both URLs now come from one helper that normalizes the base.