James' Website

February 03, 2005

JBlog 1.1 Released

Along with international text support, JBlog now features an RSS feed. Now all my friends who use RSS aggregators can subscribe! Unfortunately most of my friends are still wrapping their heads around email. If you use Firefox, you can add a Live Bookmark by clicking the button that appears in the bottom right corner of the window. Enjoy!

Add a Comment


Subject line has length limitati
Posted by Ramsay (24.141.58.249) on Thursday, February 03 2005 at 2:27 PM
And still no html support damnit
HTML Support Not Planned so Ha
Posted by James (209.183.2.168) on Thursday, February 03 2005 at 3:54 PM
It's all about security. The incoming text from visitors is the most exposed surface area of this application, so that input has to be scrubbed clean. I do this by HTMLEncoding the whole string.

If I turn off html encoding, it would allow tags like <p> and <b> to be used, but then I would have to write my own handler for things like <script> and other nasties. And if I filter out "<script>," somebody will post "<script >" or something equally clever. It's an exercise I don't care to get into. The system will hyperlink any properly formed http URL's automatically, and that should be enough for anybody but the hardcores like yourself.