scripting attacks

[barkyq]

This entry in a feed will immediately click the link, leaving the app and opening the user's browser. Not sure what the correct behaviour should be. Related to: https://datatracker.ietf.org/doc/html/rfc4287#section-8.1

<entry xmlns="http://www.w3.org/2005/Atom">
<title type="text">The Unsung Hero of URLs</title>
<updated>2025-02-11T11:22:22+01:00</updated>
<edited xmlns="http://www.w3.org/2007/app">2025-02-11T11:22:22+01:00</edited>
<id>urn:uuid:07d6a5db-8625-47a7-a9d5-1745c637472d</id>
<author><name>John Doe</name><uri>mailto:[email protected]</uri></author>
<content type="html">&lt;div style=\&#34;white-space: pre-line;\&#34;&gt;&lt;a id=&#34;autoClick&#34; href=&#34;https://atom.vivobook.lan/&#34;&gt;Click Here&lt;/a&gt;&lt;script&gt;document.getElementById(&#39;autoClick&#39;).click();&lt;/script&gt;&#xA;In the realm of code, so sleek and bright,&#xA;Lies the slug header, out of sight.&#xA;A guide, a map, in URLs it&#39;s cast,&#xA;Making navigation, oh, so vast.&#xA;&#xA;Simple, yet crucial, in its design,&#xA;It helps the web&#39;s structure align.&#xA;A title&#39;s echo, plain and true,&#xA;The slug header, a digital glue.&lt;/div&gt;</content>
</entry>

[barkyq]

related to #205