Are Microsoft's new RSS handling features a security problem?
Really Simple Syndication, or RSS, has fast become one of the primary methods for online news sites and blogs to make their content easily accessible. Its increased popularity for other types of subject matter, such as audio-based serialized content, meant that it was only a matter of time before it became an integral element of browsers and operating systems.
The RSS support in Windows Vista, primarily through Version 7 of its Internet Explorer Web browser, is built on the Windows RSS Platform, consisting of three components that expose feed handling and management to other Windows applications. All feeds managed by the RSS Platform are stored in the Common RSS Data Store. Feeds are cleansed of potentially malicious code by stripping out scripts and embedded objects. The Common RSS sync download engine downloads content at periodic intervals, using Attachment Execute Services to prevent automatic downloading of potentially malicious file types. Finally, the Common RSS Feed List can be queried by the RSS Platform APIs, giving application developers access to the list of feeds to which the user is subscribed.
