I dont know Rust, but I think this could be vulnerable to XXE attacks[1]. Back in the day I fixed all the Java RSS libraries so now I always look for it. It's not exactly an obvious problem.
Also you should add RSS 1.0 (RDF) and Atom support.
XXE attacks are caused by configuration settings of the XML parser. Generally the default config is to allow external entities, and the calling code needs to override that config because the documents come from untrusted sources.
RSS 1.0 and 2.0 are completely incompatible. There is a whole boring politics story there..
Comments
I dont know Rust, but I think this could be vulnerable to XXE attacks[1]. Back in the day I fixed all the Java RSS libraries so now I always look for it. It's not exactly an obvious problem.
Also you should add RSS 1.0 (RDF) and Atom support.
[1] https://www.owasp.org/index.php/XML_External_Entity_%28XXE%2...
Is the security issue related to specifically RSS or the XML parsers?
With regards to Atom: https://github.com/frewsxcv/rust-rss/issues/2
I did not think RSS 1.0 support was necessary since (AFAIK) RSS 2.0 is backwards compatible. Please correct me if this is wrong
XXE attacks are caused by configuration settings of the XML parser. Generally the default config is to allow external entities, and the calling code needs to override that config because the documents come from untrusted sources.
RSS 1.0 and 2.0 are completely incompatible. There is a whole boring politics story there..