XXE attacks are caused by configuration settings of the XML parser. Generally the default config is to allow external entities, and the calling code needs to override that config because the documents come from untrusted sources.
RSS 1.0 and 2.0 are completely incompatible. There is a whole boring politics story there..
Comments
Is the security issue related to specifically RSS or the XML parsers?
With regards to Atom: https://github.com/frewsxcv/rust-rss/issues/2
I did not think RSS 1.0 support was necessary since (AFAIK) RSS 2.0 is backwards compatible. Please correct me if this is wrong
XXE attacks are caused by configuration settings of the XML parser. Generally the default config is to allow external entities, and the calling code needs to override that config because the documents come from untrusted sources.
RSS 1.0 and 2.0 are completely incompatible. There is a whole boring politics story there..