If an RSS feed handles quotes and HTML tags incorrectly, can it be considered a security risk?

Question

I'm trying to encourage an organization to fix their RSS feed, which has numerous problems with the way quotes and tags in the source text are displayed in feed readers. I'd like to be able to tell them that their feed constitutes a security risk for readers, because I think that might get their attention.

Here are a few of the issues I've documented:

• spurious extended characters
• pieces of random HTML markup
• missing characters, including entire paragraphs at times
• quote characters almost never appear (especially apostrophes)
• missing spaces between words

Sometimes a post will be so messed up that I get page after page of garbage.

I've tested several feed readers, on Windows and Mac systems, and the problems appeared in all tests. The same material looks fine when viewed on the source page.

Assuming the answer is yes, how might the risk affect users?

Answer 1

Malformed HTML, due to what you're describing where people are able to inject tags into the feed, can place users at risk of quite a few things.

• pieces of random HTML markup
• missing characters, including entire paragraphs at times
• quote characters almost never appear (especially apostrophes)
• missing spaces between words

This is the result of input sanitation, which is inherently insecure, buggy and not worth anyone's time, plus the lack of prepared statements, meaning the web application is vulnerable. Output sanitation is the answer here.

Let me repeat Mark C. Wallace, "page after page of garbage = failure to deliver content correctly = loss of integrity and availability = security risk. Potentially additional consequences."

Assuming the answer is yes, how might the risk affect users?

This is a really dangerous problem How can it affect users? There are multiple ways:

1. Injection of malicious javascript, flash, java, etc., into your user's pages.
2. Injection of content that directs users to malware websites
3. Injection of code tags into your client's website: <% %>, <?php ?>, etc., which allows for a full breach of pretty much everything.

Answer 2

By itself, malformed HTML is probably not placing their users at risk of anything other than developing an aversion to an amateurish, ugly feed. It's probably caused by an automated Word-to-HTML or PDF-to-HTML converter, but by themselves those won't create risk for their readers.

Do they include user-submitted data in their feed? If so, they could subject their users to a CSRF or XSS attack. Or they might be susceptible to script injection. But if so, those could be vulnerabilities regardless of whether or not the rest of their HTML is well formed. The fact that they don't test their feeds or care about their image may give their clients the impression they don't care about other issues such as security or data safety; but it's not proof of negligence.

Don't use 'security' as a stick unless you have more concrete evidence of a vulnerability. Instead, let them know their company image is coming across poorly. When you raise the stakes, you could say "if you don't care about this, why should I believe that you care about other things, like the safety of my data?" If they still do nothing, I suggest you look elsewhere for your source of topical news. There are millions of other web sites, some of which might serve you better.