JS in feed content isn't sanitized at all.

[AvverbioPronome]

Expected behavior

I expect javascript in feed content NOT to be run

Actual behavior

Javascript in feed content runs

Steps to reproduce

• put javascript in a feed (ie: <script>document.location.replace('https://example.com');</script>)
• add feed to moonmoon
• open main page on moonmoon

Moonmoon version

9.0.0-rc.3

[rdalverny]

That's because of:

moonmoon/app/classes/PlanetFeed.php

Line 26 in ee9c408

$this->set_stupidly_fast(true);

Switching it to false will filter out the JavaScript (among other things). See https://github.com/simplepie/simplepie/blob/1aec297145a150f627e6ed82b8b084e0c933def8/library/SimplePie.php#L1178-L1191 for the changes it implies.

Maybe we should make both the full trigger configurable (but not recommended), or make a custom selection of the features to turn on/off? At least to force $this->strip_htmltags(true).