Feed item content gets unescaped

[drweissbrot]

I'm trying to parse a feed and render its contents on a website. The feed sometimes contains HTML code blocks (think tutorial posts explaining how to do something in HTML, like this).

Take this example feed for instance:

<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
	<channel>
		<item>
			<content:encoded><![CDATA[
				<pre><code>&lt;div class="wrapper">Lorem ipsum dolor sit amet&lt;/div></code></pre>
			]]></content:encoded>
		</item>
	</channel>
</rss>

Intuitively, I expected that parseFeed(xml).items[0].content would return something like:

<pre><code>&lt;div class="wrapper">Lorem ipsum dolor sit amet&lt;/div></code></pre>

Instead, the text for content gets unescaped (RSS, Atom), and this is returned instead:

<pre><code><div class="wrapper">Lorem ipsum dolor sit amet</div></code></pre>

While I do want the outer <pre> and <code> tags to be rendered as proper HTML tags on the final page, the inner div I want to keep verbatim, i.e. <div class="wrapper">, so that it is rendered as text on the final website.

I made the changes to suit my needs in this commit, including some tests. I was unable to get most of the integration tests to actually pass, since the feedparser library (used to process feeds in tests) seems to unescape HTML in the same way, with no option to turn it off.

The way I did it would also be a breaking change; to avoid, assuming you even want to support this use case, perhaps we could add an options parameter to the parseFeed function to opt out of unescaping?

[rowanmanning]

Hi @drweissbrot, do you have a live example of this? I'm trying to find out what existing feed readers and other libraries do here and a real-world feed would be useful - I'm strugging to find one.

Something to note when I was looking around at how RSS encoding works, this documentation (see example 3) indicates that, in order to escape HTML in CDATA you need to double-encode it, e.g your example would become this:

<pre><code>&amp;lt;div class="wrapper"&amp;gt;Lorem ipsum dolor sit amet&amp;lt;/div&amp;gt;</code></pre>

[drweissbrot]

Here are two RSS and one Atom feed that are affected.

1. css-tricks.rss.xml.txt, from https://css-tricks.com/feed/, RSS, uses CDATA, single-escaped, e.g. in the item with ID https://css-tricks.com/?p=386654
2. html-tip.rss.xml.txt, from https://html-css-tip-of-the-week.netlify.app/rss.xml, RSS, doesn't use CDATA, e.g. in the item with ID https://html-css-tip-of-the-week.netlify.app/tip/output/
3. leaverou.atom.xml.txt, from https://lea.verou.me/feed.xml, Atom, no CDATA, e.g. in item with ID https://lea.verou.me/blog/2025/bluesky-likes/

Unless I'm misunderstanding the RSS Board site, I think all of these correctly escape things? Examples:

From feed 1's XML, inside CDATA:

<pre rel="HTML" class="wp-block-csstricks-code-block language-markup" data-line=""><code markup="tt">&lt;div>
  &lt;a>1&lt;/a>
  &lt;a>2&lt;/a>
  &lt;a>3&lt;/a>
  &lt;a>4&lt;/a>
  &lt;a>5&lt;/a>
&lt;/div></code></pre>

The <pre> and <code> tags are supposed to be rendered as tags, the <div> and <a>s are supposed to be rendered as text.

From feed 2's XML, not inside CDATA:

<p>Pretty much everyone knows about the <code><input></code> element,

HTML when rendering should be

<p>Pretty much everyone knows about the <code>&lt;input&gt;</code> element,

From feed 3's XML, also not inside CDATA:

<li><code><bluesky-likes></code> — displays the number of likes for a post, and</li>

Final HTML:

<li><code>&lt;bluesky-likes&gt;</code> — displays the number of likes for a post, and</li>

[rowanmanning]

Perfect thank you, I can replicate 👍 it seems like the wrong/unexpected behaviour and so I'm not against making this the default behaviour in a breaking change

I'll do the following:

• Double check what other feed parsers do - I ran compatibility tests with node-feedparser when building this library and so it's possible a bug was replicated too
• Bring these example feeds into the end-to-end tests
• Assess the impact of making this change the default as a new major version - not sure how many other feeds this will impact

[drweissbrot]

Great to hear, thank you very much!