Sanitize html during feed parsing.

hammond-data/Cargo.toml

@@ -5,7 +5,9 @@ version = "0.1.0"
 workspace = "../"
 
 [dependencies]
+ammonia = "1.0.0"
 chrono = "0.4.0"
+derive_builder = "0.5.0"
 dotenv = "0.10.1"
 error-chain = "0.11.0"
 lazy_static = "1.0.0"
@@ -18,7 +20,6 @@ rfc822_sanitizer = "0.3.3"
 rss = "1.2.1"
 url = "1.6.0"
 xdg = "2.1.0"
-derive_builder = "0.5.0"
 
 [dependencies.diesel]
 features = ["sqlite"]

hammond-data/src/lib.rs

@@ -46,6 +46,7 @@ extern crate rfc822_sanitizer;
 extern crate rss;
 extern crate url;
 extern crate xdg;
+extern crate ammonia;
 
 #[allow(missing_docs)]
 pub mod dbqueries;

hammond-data/src/parser.rs

@@ -1,3 +1,4 @@
+use ammonia;
 use rss::{Channel, Item};
 use rfc822_sanitizer::parse_from_rfc2822_with_fallback;
 
@@ -10,7 +11,7 @@ use errors::*;
 /// Parses a `rss::Channel` into a `NewPodcast` Struct.
 pub(crate) fn new_podcast(chan: &Channel, source_id: i32) -> NewPodcast {
     let title = chan.title().trim();
-    let description = chan.description().trim();
+    let description = ammonia::clean(chan.description().trim());
 
     let link = url_cleaner(chan.link());
     let x = chan.itunes_ext().map(|s| s.image());
@@ -33,7 +34,7 @@ pub(crate) fn new_podcast(chan: &Channel, source_id: i32) -> NewPodcast {
 /// Parses an `rss::Item` into a `NewEpisode` Struct.
 pub(crate) fn new_episode(item: &Item, parent_id: i32) -> Result<NewEpisode> {
     let title = item.title().map(|s| s.trim().to_owned());
-    let description = item.description().map(|s| s.trim().to_owned());
+    let description = item.description().map(|s| ammonia::clean(s.trim()));
     let guid = item.guid().map(|s| s.value().trim().to_owned());
 
     // Its kinda weird this being an Option type.
@@ -276,10 +277,10 @@ mod tests {
         let channel = Channel::read_from(BufReader::new(file)).unwrap();
 
         let firstitem = channel.items().first().unwrap();
-        let descr =
-            "Audit your network with a couple of easy commands on Kali Linux. Chris decides to \
-             blow off a little steam by attacking his IoT devices, Wes has the scope on Equifax \
-             blaming open source & the Beard just saved the show. It’s a really packed episode!";
+        let descr = "Audit your network with a couple of easy commands on Kali Linux. Chris \
+                     decides to blow off a little steam by attacking his IoT devices, Wes has \
+                     the scope on Equifax blaming open source &amp; the Beard just saved the \
+                     show. It’s a really packed episode!";
         let i = new_episode(&firstitem, 0).unwrap();
 
         assert_eq!(i.title(), Some("Hacking Devices with Kali Linux | LUP 214"));
@@ -301,7 +302,7 @@ mod tests {
                       decisions for the next version of Gnome have us worried about the \
                       future.</p>\n\n<p>Plus we chat with Wimpy about the Ubuntu Rally in NYC, \
                       Microsoft’s sneaky move to turn Windows 10 into the “ULTIMATE LINUX \
-                      RUNTIME”, community news & more!</p>";
+                      RUNTIME”, community news &amp; more!</p>";
         assert_eq!(i2.title(), Some("Gnome Does it Again | LUP 213"));
         assert_eq!(
             i2.uri(),
@@ -321,8 +322,8 @@ mod tests {
 
         let firstitem = channel.items().iter().nth(9).unwrap();
         let descr = "This week we look at <a \
-                     href=\"https://github.com/rust-lang/rfcs/pull/2094\">RFC 2094</a> \
-                     \"Non-lexical lifetimes\"";
+                     href=\"https://github.com/rust-lang/rfcs/pull/2094\" rel=\"noopener \
+                     noreferrer\">RFC 2094</a> \"Non-lexical lifetimes\"";
         let i = new_episode(&firstitem, 0).unwrap();
 
         assert_eq!(i.title(), Some("Episode #9 - A Once in a Lifetime RFC"));
@@ -343,9 +344,9 @@ mod tests {
         let second = channel.items().iter().nth(8).unwrap();
         let i2 = new_episode(&second, 0).unwrap();
 
-        let descr2 = "This week we look at <a \
-                      href=\"https://github.com/rust-lang/rfcs/pull/2071\">RFC 2071</a> \"Add \
-                      impl Trait type alias and variable declarations\"";
+        let descr2 = "This week we look at <a href=\"https://github.com/rust-lang/rfcs/pull/2071\" \
+                      rel=\"noopener noreferrer\">RFC 2071</a> \"Add impl Trait type alias and \
+                      variable declarations\"";
         assert_eq!(i2.title(), Some("Episode #8 - An Existential Crisis"));
         assert_eq!(
             i2.uri(),