Xapian devel - Jan 2006 - opensearch template

I've just noticed the Omega "opensearch" template seems to lack
escaping
for URLs in <link> tags:

$httpheader{Content-Type,application/xml}<?xml version="1.0"?>
  <rss version="2.0"
xmlns:openSearch="http://a9.com/-/spec/opensearchrss/1.0/">
    <channel>
      <title>Xapian search results</title>
     
<link>$env{SCRIPT_NAME}?DB=$dbname&amp;P=$html{$query}</link>
      <description>Search results for "$html{$query}" at
xapian.org</description>
      <language>en</language>
      <copyright>(C)2005, Xapian.org</copyright>
      <openSearch:totalResults>$msize</openSearch:totalResults>
      <openSearch:startIndex>$add{topdoc,1}</openSearch:startIndex>
     
<openSearch:itemsPerPage>$hitsperpage</openSearch:itemsPerPage>
$hitlist{
      <item>
        <title>$html{$or{$field{title},$field{caption}}}</title>
        <link>$field{url}</link>
       
<description>$highlight{$field{sample},$terms,&lt;strong&gt;,&lt;/strong&gt;}$if{$field{sample},...}</description>
      </item>}
    </channel>
  </rss>

Surely $field{url} needs some sort of escaping?  Also, we aren't
escaping $env{SCRIPT_NAME} or $dbname in the <channel>'s <link>
tag.

Sadly, the opensearch spec doesn't really seem cover the format of
URLs in <link> tags, but the "&amp;" in the
<channel>'s <link> makes
me suspect that $html{ } is the right answer.

But reading the spec, it does say that any HTML in the description tag
should be escaped once, or enclosed as CDATA:

http://opensearch.a9.com/docs/devfaq.jsp#html

Since we seem to be using RSS instead of ATOM, I think that means we
need a $html{ } around the contents of the description tag.

Cheers,
    Olly

On Tue, Jan 03, 2006 at 05:00:26PM +0000, Olly Betts wrote:
> $httpheader{Content-Type,application/xml}<?xml
version="1.0"?>
>   <rss version="2.0"
xmlns:openSearch="http://a9.com/-/spec/opensearchrss/1.0/">
>     <channel>
>       <title>Xapian search results</title>
>      
<link>$env{SCRIPT_NAME}?DB=$dbname&amp;P=$html{$query}</link>
>       <description>Search results for "$html{$query}" at
xapian.org</description>
>       <language>en</language>
>       <copyright>(C)2005, Xapian.org</copyright>
>       <openSearch:totalResults>$msize</openSearch:totalResults>
>      
<openSearch:startIndex>$add{topdoc,1}</openSearch:startIndex>
>      
<openSearch:itemsPerPage>$hitsperpage</openSearch:itemsPerPage>
> $hitlist{
>       <item>
>        
<title>$html{$or{$field{title},$field{caption}}}</title>
>         <link>$field{url}</link>
>        
<description>$highlight{$field{sample},$terms,&lt;strong&gt;,&lt;/strong&gt;}$if{$field{sample},...}</description>
>       </item>}
>     </channel>
>   </rss>
> 
> Surely $field{url} needs some sort of escaping?  Also, we aren't
> escaping $env{SCRIPT_NAME} or $dbname in the <channel>'s
<link> tag.
Yeah, they should all be escaped appropriately.
> Sadly, the opensearch spec doesn't really seem cover the format of
> URLs in <link> tags, but the "&amp;" in the
<channel>'s <link> makes
> me suspect that $html{ } is the right answer.
There isn't any structure beyond "they are URLs". It's an
XML-based
format, so omegascripts' (slightly confusingly-named) $html{ } should
do fine.
> But reading the spec, it does say that any HTML in the description tag
> should be escaped once, or enclosed as CDATA:
> 
> http://opensearch.a9.com/docs/devfaq.jsp#html
> 
> Since we seem to be using RSS instead of ATOM, I think that means we
> need a $html{ } around the contents of the description tag.
If you do, the &lt; and &gt; in the $highlight{...} need to change to
< and > respectively, or you'll have "double escaped" them.
I hate the
opensearch spec, it's written as if the RSS 2.0 document were a spec.

In theory we can re-work opensearch over Atom, but you get into fiddly
areas because Atom requires GUIDs. There wasn't enough interest on the
Atom list to get anywhere with the idea, as far as I can tell (and
neither Richard nor I have had time).

The opensearch template isn't really finished - it was more a quick
hack to see how fiddly it would be.

J

-- 
/--------------------------------------------------------------------------\
  James Aylett                                                  xapian.org
  james at tartarus.org                               uncertaintydivision.org