Question Rss has additional content "script"

[ztjal]

Reproduction steps:

Use the browser's private window to open, eg:

https://www.anime-sharing.com/forums/-/index.rss

Go to the end of the document.

    </item>
  </channel>
</rss>
<script>window.CheckmateVarnishHelperActivity = {"payload":"eyJjb250cm9sbGVyIjoiWEZcXFB1YlxcQ29udHJvbGxlclxcRm9ydW1Db250cm9sbGVyIiwiYWN0aW9uIjoiSW5kZXgiLCJwYXJhbXMiOltdLCJ2aWV3U3RhdGUiOiJ2YWxpZCIsImV4cGlyZXMiOjE3NzczMjI0NDN9","signature":"b18da71472277098a1b33313e7344b1e7e50afb63d7c2669aa01e3dadda2c0b3"};</script>

 

[clefy]

I tested this on my side as well. The feed becomes readable as soon as the <script> line appended after </rss>
is removed. That extra script is invalid XML, so RSS readers like Feedbro reject the feed until it's gone.

 

[Checkmate]

This is the CSRF token for security; without it, the site won't function. Every user is assigned this token, which rotates every few seconds. It should not be injected into RSS.

I will patch this soon.

I mentioned a couple of years ago that RSS is going away. I made no promises about its functionality back then, and I make no promises now. Eventually, that will also be obsolete.

 

[Checkmate]

I have patched this now

 

[clefy]

Thank you. I remember when you first mentioned that RSS would eventually be phased out. While it's a bit disappointing to see it nearing the end, I genuinely appreciate the effort you've put into the site over the years and the attention you continue to give it.