rssFilter icon indicating copy to clipboard operation
rssFilter copied to clipboard

Published 20 hours ago • verified publisher icon bionoren

Used RSS library is unmaintained and has security issues

Open BernhardPosselt opened this issue 9 years ago • 0 comments

Hi,

We at ownCloud News used SimplePie before and switched to picoFeed because of the following issues:

  • SimplePie is not maintained anymore as far as we've experienced it. Fixes and enhancements were neither reviewed nor merged
  • SimplePie is vulnerable to XXE (look it up, tl;dr: users can include abitrary files from your server in their feeds, such as /etc/passwd)

BernhardPosselt avatar Dec 12 '15 13:12 BernhardPosselt