Escape HTML in RSS Feeds

[danbrellis]

In my theme I have a filter that appends a query string (via append_query_string()) to an activity's primary_link that is stored in the database. As a result, when I visit www.example.org/groups/mygroup/feed, I get an error:

error on line X at column X: EntityRef: expecting ';'

After some digging, this is caused as a result of the query string in the <link> element that has unescaped ampersands. I've found that applying this to my functions.php file fixes the problem.

<?php
add_filter('bp_get_activity_thread_permalink', 'my_theme_bp_get_activity_thread_permalink');
function my_theme_bp_get_activity_thread_permalink($link){
  return esc_url($link);
}

What I'm wondering is if esc_url() should be applied to bp_get_activity_thread_permalink() or where the <link> is output in the BP_Activity_Feed class or if it's just me.

[DJPaul]

Good spot - yes, this is our mistake.

[DJPaul]

Team: should we be, as standard, filtering the likes of bp_get_activity_thread_permalink with a hooked escaping function?

[djpaul]

In 10824:

Activity: escape activity thread and activity comment permalinks

Fixes #6990

[johnjamesjacoby]

Replying to DJPaul:

Team: should we be, as standard, filtering the likes of bp_get_activity_thread_permalink with a hooked escaping function?

Yes. As a general rule, our _get_ functions are unescaped, but their equivalent echo functions should output properly sanitized and trustworthy values.