Hugo: Provide <content:encoded> tag with HTML full text

[danielcompton]

Following on from https://github.com/gohugoio/hugo/issues/3218 where <description> was changed to only include the .Summary.

At first I didn't like the change. But as I looked around at different RSS feeds I saw that people actually did use RSS feeds in this fashion, and they put their full text in a <content:encoded> tag. Something like https://webkit.org/feed/ has entries like

<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
        xmlns:content="http://purl.org/rss/1.0/modules/content/"
        xmlns:wfw="http://wellformedweb.org/CommentAPI/"
        xmlns:dc="http://purl.org/dc/elements/1.1/"
        xmlns:atom="http://www.w3.org/2005/Atom"
        xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
        xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
        >

<channel>
        <title>WebKit</title>
        <atom:link href="https://webkit.org/feed/" rel="self" type="application/rss+xml" />
        <link>https://webkit.org</link>
        <description>Open Source Web Browser Engine</description>
        <lastBuildDate>Tue, 09 Jan 2018 00:49:57 +0000</lastBuildDate>
        <language>en-US</language>
        <sy:updatePeriod>hourly</sy:updatePeriod>
        <sy:updateFrequency>1</sy:updateFrequency>
        <generator>https://wordpress.org/?v=4.8.3</generator>
        <item>
                <title>What Spectre and Meltdown Mean For WebKit</title>
                <link>https://webkit.org/blog/8048/what-spectre-and-meltdown-mean-for-webkit/</link>
                <pubDate>Tue, 09 Jan 2018 00:49:57 +0000</pubDate>
                <dc:creator><![CDATA[Filip Pizlo]]></dc:creator>
                                <category><![CDATA[News]]></category>

                <guid isPermaLink="false">https://webkit.org/?p=8048</guid>
                <description><![CDATA[Security researchers have recently uncovered security issues known as Meltdown and Spectre.]]></description>
                                <content:encoded><![CDATA[<p><a href="https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html">Security researchers have recently uncovered</a> security issues known as <a href="https://meltdownattack.com">Meltdown</a> and <a href="https://spectreattack.com">Spectre</a>. These issues apply to all modern processors and allow attackers to gain read access to parts of memory that were meant to be secret. To initiate a Spectre- or Meltdown-based attack, the attacker must be able to run code on the victim&#8217;s processor. WebKit is affected because in order to render modern web sites, any web JavaScript engine must allow untrusted JavaScript code to run on the user&#8217;s processor. Spectre impacts WebKit directly. Meltdown impacts WebKit because WebKit&#8217;s security properties must first be bypassed (via Spectre) before WebKit can be used to mount a Meltdown attack.</p>
<ul>
<li>WebKit relies on <em>branch instructions</em> to enforce what untrusted JavaScript and WebAssembly code can do. Spectre means that an attacker can control branches, so branches alone are no longer adequate for enforcing security properties.</p>
</li>
<li>
<p>Meltdown means that userland code, such as JavaScript running in a web browser, can read kernel memory. Not all CPUs are affected by Meltdown and Meltdown is being mitigated by operating system changes. Mounting a Meltdown attack via JavaScript running in WebKit requires first bypassing branch-based security checks, like in the case of a Spectre attack. Therefore, Spectre mitigations that fix the branch problem also prevent an attacker from using WebKit as the starting point for Meltdown.</p>
</li>
</ul>
<p>This document explains how Spectre and Meltdown affect existing WebKit security mechanisms and what short-term and long-term fixes WebKit is deploying to provide protection against this new class of attacks. The first of these mitigations shipped on Jan 8, 2018:</p>
<ul>
<li><a href="https://support.apple.com/en-us/HT208401">iOS 11.2.2</a>.</li>
<li><a href="https://support.apple.com/en-us/HT208397">High Sierra 10.13.2 Supplemental Update</a>. This reuses the 10.13.2 version number. You can check if your Safari and WebKit are patched by verifying the full version number in About Safari. The version number should be either 13604.4.7.1.6 or 13604.4.7.10.6.</li>
<li><a href="https://support.apple.com/en-us/HT208403">Safari 11.0.2</a> for El Capitan and Sierra. This reuses the 11.0.2 version number. Patched versions are 11604.4.7.1.6 (El Capitan) and 12604.4.7.1.6 (Sierra).</li>
</ul>
<h2>Spectre and Security Checks</h2>
<p>Spectre means that branches are no longer sufficient for enforcing the security properties of read operations in WebKit.  The most impacted subsystem is JavaScriptCore (WebKit&#8217;s JavaScript engine).  Almost all bounds checks can be bypassed to read arbitrarily out-of-bounds.  This could allow an attacker to read arbitrary memory.  All type checks are also vulnerable.  For example,
...
<h2>Conclusion</h2>
<p>Spectre and Meltdown are a new class of security issues that apply to modern processors and the software that runs on them. WebKit is affected by both issues because WebKit allows untrusted code to run on users&#8217; processors. In response to these new issues, we have implemented mitigations to defend against Spectre (and Meltdown by proxy, since you need Spectre to do Meltdown via the browser). The first of these mitigations have shipped in the Jan 8 updates (iOS 11.2.2, High Sierra 10.13.2 supplemental update, and Safari 11.0.2 reissue). Stay tuned for more WebKit Spectre fixes!</p>
]]>

I think the standard for RSS is to make items <content:encoded> using the xmlns:content="http://purl.org/rss/1.0/modules/content/" namespace. See http://web.resource.org/rss/1.0/modules/content/, https://developer.mozilla.org/en-US/docs/Web/RSS/Article/Why_RSS_Content_Module_is_Popular_-_Including_HTML_Contents, and http://www.rssboard.org/rss-profile#namespace-elements-content-encoded.

This change seems like it would satisfy both parties involved in the previous change: those who want the <description> tag to match the spec, and those who want full-text RSS feeds. Would a change like this be accepted?

[purpleidea]

I think this would be fabulous, however whenever I try doing this with a custom template my:

<![CDATA[ whatever ]]>

block gets mangled into:

<![CDATA whatever ]]>

Strangely it only mangles the first one. I've tried enclosing it in {{ & }} but it doesn't help. It seems the mangling happens after processing of the template, and before hugo spits it all out. :/

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. The resources of the Hugo team are limited, and so we are asking for your help.
If this is a bug and you can still reproduce this error on the master branch, please reply with all of the information you have about it in order to keep the issue open.
If this is a feature request, and you feel that it is still relevant and valuable, please tell us why.
This issue will automatically be closed in the near future if no further activity occurs. Thank you for all your contributions.

[danielcompton]

I think this would still be a useful addition, as it fits in with the web standards and allows both sides to get full content, _and_ use things like Mailchimp's RSS importer.

[purpleidea]

Yeah, this bot is stupid. Go away bot!

[jakewies]

+1

[lidel]

Below trick solves the problem of escaped<![CDATA:

<content:encoded>{{ `<![CDATA[` | safeHTML }}{{ .Content | safeHTML }}{{ `]]>` | safeHTML }}</content:encoded>

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. The resources of the Hugo team are limited, and so we are asking for your help.
If this is a bug and you can still reproduce this error on the master branch, please reply with all of the information you have about it in order to keep the issue open.
If this is a feature request, and you feel that it is still relevant and valuable, please tell us why.
This issue will automatically be closed in the near future if no further activity occurs. Thank you for all your contributions.

[danielcompton]

I think this is still a valuable feature request. Lots of people want to be able to provide full text RSS feeds.

[bep]

@purpleidea we render the RSS feed with Go's HTML package, you can try something ala:

{{ "printf "<![CDATA[" | safeHTML }}

Sor something.

[jaclyntan]

The solution posted by @lidel worked for me. Would love to see this in the documentation because this is actually useful to know.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. The resources of the Hugo team are limited, and so we are asking for your help.
If this is a bug and you can still reproduce this error on the master branch, please reply with all of the information you have about it in order to keep the issue open.
If this is a feature request, and you feel that it is still relevant and valuable, please tell us why.
This issue will automatically be closed in the near future if no further activity occurs. Thank you for all your contributions.

[purpleidea]

ping!

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. The resources of the Hugo team are limited, and so we are asking for your help.
If this is a bug and you can still reproduce this error on the master branch, please reply with all of the information you have about it in order to keep the issue open.
If this is a feature request, and you feel that it is still relevant and valuable, please tell us why.
This issue will automatically be closed in the near future if no further activity occurs. Thank you for all your contributions.

[purpleidea]

hi bot!

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. The resources of the Hugo team are limited, and so we are asking for your help.
If this is a bug and you can still reproduce this error on the master branch, please reply with all of the information you have about it in order to keep the issue open.
If this is a feature request, and you feel that it is still relevant and valuable, please tell us why.
This issue will automatically be closed in the near future if no further activity occurs. Thank you for all your contributions.

[purpleidea]

bot no!