Do we really need file:// as allowed protocol?

[pgrunewald]

I was wondering if there is really the need to provide file-based XML feeds. It happens that way in the doctests (for example here)? I suggest to remove it for security reasons.

And for the doctests, it should suffice to write a browser view, that provides the feed's content and which can be added as ordinary URL (with http) to the feeds list.

[mauritsvanrees]

I don't think the code explicitly enables it, it is just the way that feedparser works.
Allowing it makes things easier to test if you have a local xml file that you can edit.

What would the security reasons be? I guess it goes like this:

• There is a malicious or compromised user who can edit Feedfolders.
• He adds a file:/// url.
• When the path exists on the server and the plone instance user can access it, then the file will be parsed as a feed and if this works the contents will be shown.

That seems an unpractical attack.

I could accept a pull request where only Managers could add such a url. Tricky would be when someone else then edits the Feedfolder.
Restricting it to users who come from the same remote IP address as the server would be fine too.