check_plain

Issue Summary

Hello,

I had a problem parsing characters using Google's RSS feeds. Basically ampersands were being rendered as &. Ampersands should just render as an & otherwise the output becomes ' whereas it should be '.

At line 421 the module contains: $output .= '<h2 class="feed-item-title">' . check_plain($item->title) . '</h2>';

This isn't good enough at dealing with character entities and could open up an exploit.

So simply change line 421 to: $output .= '<h2 class="feed-item-title">' . filter_xss($item->title, array()) . '</h2>';

This issue was addressed in the original 5.x release of the aggregation module.

See: http://drupal.org/node/61456 for more info.

Thanks,

Justin.