CSS Filtering for RSS Readers

I have come across this article about CSS-related vulnerabilities in email clients. It's quite shocking what you can do with CSS if you render arbitrary CSS from a third party. RSS readers have challenges similar to email clients: they both embed HTML from untrusted third parties. Not all readers support CSS though. Some go the easy route and just filter it out. Inoreader is a popular reader with CSS support, while Feedly does not support it. My project Downread supports CSS, so this is something that concerns me as well.

While RSS readers typically show feeds the user trusts, you can't always rely on that. Especially when users are adding comment feeds or aggregators. So filtering HTML is one of the crucial but more difficult parts of writing an RSS reader. On the one hand, you want to allow as much HTML as possible to allow rendering the feed as well as possible. On the other hand, RSS readers can't allow everything. Not only for security reasons, but also to prevent feeds from breaking the RSS reader's UI, especially when the reader is HTML-based and renders posts in its own DOM tree.

Unfortunately, RSS and other syndication formats (Atom, JSON Feed) do not make any attempt to specify an HTML subset to be used in feeds. As readers can't allow full HTML, this will inevitably lead to incompatibilities between readers. I believe this is something to be addressed, and I will come back to in a future post here.

But the main point I was going to make here was: be careful. If you are the user of an RSS reader, make sure you get one you can trust, because it's a tool you process untrusted data with. And as an author of RSS tools, be aware of the fallacies that come with rendering untrusted HTML.