8076ed13f1
We have our Mako filters set to escape HTML by default. Unfortunately RSS requires double escaping in some places and not in others, so there isn't a reasonable default. Here I have done a pass through the `.xml` templates to find user data that's ending up single-escaped and added double escaping to them. This requirement is because RSS grew HTML support organically in a way that clients can't tell if a field actually contains HTML or not. Sometimes it's double escaped, sometimes it's not. Clients have to take a guess by sniffing for `>` characters and hoping they get it right. This also means that it's impossible for servers to reliably tell the clients which data this field contains. This is a bit of a ticking time bomb. Users may find ways to sneak in HTML in the date field, or we may add new templates that forget to do double escaping on little-used fields. I recommend that we switch these to use Atom which always indicates whether the fields contain HTML or not. Work has started on this conversion in another branch. * ref https://www.reddit.com/r/AskNetsec/comments/41larg/titleheadbody_idmsgfeedsummarybodyimg/ * ref https://reddit.atlassian.net/browse/INFRA-721 * ref https://bugzilla.mozilla.org/show_bug.cgi?id=1240603
Greetings!
This is the primary codebase that powers reddit.com.
For notices about major changes and general discussion of reddit development, subscribe to the /r/redditdev and /r/changelog subreddits.
You can also chat with us via IRC in #reddit-dev on freenode.
Quickstart
To set up your own instance of reddit to develop with, we have a handy install script for Ubuntu that will automatically install and configure most of the stack.
Alternatively, refer to our Install Guide for instructions on setting up reddit from scratch. Many frequently asked questions regarding local reddit installs are covered in our FAQ.
APIs
To learn more about reddit's API, check out our automated API documentation and the API wiki page. Please use a unique User-Agent string and take care to abide by our API rules.
Happy hacking!
Issues and Contribution Guidelines
Thanks for wanting to help make reddit better! First things first, though: github issues is only for confirmed, active bugs. Please submit ideas to /r/ideasfortheadmins.
Please read more on contributions in CONTRIBUTING.md.