Fix CDATA parsing in feeds

Author: Lukas Geiger

CHANGELOG.md

@@ -10,13 +10,14 @@
 
 ### Fixed
 - Fixed alarm updates for manual-only feeds when global interval is disabled but other feeds define per-feed intervals.
+- Fixed RSS and Atom text parsing so CDATA wrappers are removed from feed titles, item titles, links, and Atom dates.
 - Normalized the German locale file to real UTF-8 Umlaute instead of escaped code points.
 
 ### Changed
 - Added repository line-ending rules, explicitly ignored local pytest caches, and updated the README Edge packaging note.
 
 ### Verified
-- `npm test` now covers 28 dependency-free Node tests, including theme, service-worker scheduling, and package-content coverage.
+- `npm test` now covers 29 dependency-free Node tests, including CDATA cleanup, theme, service-worker scheduling, and package-content coverage.
 - `npm run package` creates `dist/RSS-BOOK-v1.1.2-edge.zip` with the Manifest V3 runtime files plus license/privacy docs.
 
 ## [1.1.2] — 2026-04-30

README.md

@@ -24,6 +24,7 @@ Your feeds live in your bookmarks — accessible everywhere your browser syncs,
 
 - **Manifest V3 native** — built for modern Chromium browsers
 - **RSS 2.0 + Atom** — both formats supported
+- **CDATA-safe parsing** — titles, links, and Atom dates are cleaned before bookmark creation
 - **ETag/304 caching** — bandwidth-efficient, respects server cache headers
 - **Per-feed intervals** — each feed can have its own update schedule
 - **Retention** — auto-remove bookmarks older than N days
@@ -59,7 +60,7 @@ Create the upload-ready ZIP with `npm run package`. The generated archive stays
 
 ## Development
 
-RSS-BOOK has no bundling step. The repository includes 28 dependency-free Node tests for parser behavior, OPML, storage, bookmark cleanup, feed discovery, folder export, store assets, service-worker scheduling, light/dark theme CSS coverage, and Edge package contents:
+RSS-BOOK has no bundling step. The repository includes 29 dependency-free Node tests for parser behavior, CDATA cleanup, OPML, storage, bookmark cleanup, feed discovery, folder export, store assets, service-worker scheduling, light/dark theme CSS coverage, and Edge package contents:
 
 ```bash
 npm test

lib/rss.js

@@ -75,7 +75,11 @@ function extractTextContent(xml, tag) {
   const re = new RegExp(`<${tag}(?:\\s[^>]*)?>([\\s\\S]*?)</${tag}>`, "i");
   const m = xml.match(re);
   if (!m) return "";
-  return decodeXmlEntities(m[1].trim());
+  return decodeXmlEntities(stripCdata(m[1].trim()));
+}
+
+function stripCdata(text) {
+  return text.replace(/<!\[CDATA\[([\s\S]*?)\]\]>/gi, "$1");
 }
 
 function extractAttr(xml, tag, attr) {

tests/rss.test.mjs

@@ -63,6 +63,60 @@ test("parses RSS 2.0 feeds and sends cache validators", async () => {
   ]);
 });
 
+test("strips CDATA wrappers from RSS and Atom text content", async () => {
+  globalThis.fetch = async () => new Response(
+    `<?xml version="1.0"?>
+    <rss version="2.0">
+      <channel>
+        <title><![CDATA[Example & News]]></title>
+        <item>
+          <title><![CDATA[First <Post>]]></title>
+          <link><![CDATA[https://example.test/first]]></link>
+          <guid>item-1</guid>
+        </item>
+      </channel>
+    </rss>`,
+    { status: 200 }
+  );
+
+  const rssParsed = await fetchFeedAndParse("https://example.test/feed.xml");
+
+  assert.equal(rssParsed.title, "Example & News");
+  assert.deepEqual(rssParsed.items, [
+    {
+      title: "First <Post>",
+      link: "https://example.test/first",
+      guid: "item-1",
+      published: ""
+    }
+  ]);
+
+  globalThis.fetch = async () => new Response(
+    `<feed xmlns="http://www.w3.org/2005/Atom">
+      <title><![CDATA[Atom Feed]]></title>
+      <entry>
+        <title><![CDATA[Atom & One]]></title>
+        <id>urn:post:1</id>
+        <updated><![CDATA[2026-04-30T10:00:00Z]]></updated>
+        <link href="https://example.test/one" rel="alternate" />
+      </entry>
+    </feed>`,
+    { status: 200 }
+  );
+
+  const atomParsed = await fetchFeedAndParse("https://example.test/atom.xml");
+
+  assert.equal(atomParsed.title, "Atom Feed");
+  assert.deepEqual(atomParsed.items, [
+    {
+      title: "Atom & One",
+      link: "https://example.test/one",
+      guid: "urn:post:1",
+      published: "2026-04-30T10:00:00Z"
+    }
+  ]);
+});
+
 test("parses Atom entries and prefers rel alternate links regardless of attribute order", async () => {
   globalThis.fetch = async () => new Response(
     `<feed xmlns="http://www.w3.org/2005/Atom">