From f4b415c54e475f891cffe9363d4e19d58a062ad3 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@feld.me>
Date: Fri, 22 May 2026 12:12:11 -0700
Subject: [PATCH 01/12] Improve RSS compliance

The core feed reader issue was that RSS 2.0 <link> is a simple text
element and can only appear once per <item>.
By having multiple <link> tags with rel attributes, parsers were
getting confused and resolving entries to the wrong URL.
Now each item has exactly one <link>: the post URL. Everything else
uses valid <atom:link> or dedicated extension elements where
appropriate.
---
 changelog.d/rss.fix                           |   1 +
 lib/pleroma/web/feed/feed_view.ex             | 151 +++++++++++++++++-
 .../templates/feed/feed/_activity.atom.eex    |  24 +--
 .../web/templates/feed/feed/_activity.rss.eex |  35 ++--
 .../feed/feed/_tag_activity.atom.eex          |  32 ++--
 .../templates/feed/feed/_tag_activity.xml.eex |  22 ++-
 .../web/templates/feed/feed/tag.atom.eex      |   6 +-
 .../web/templates/feed/feed/tag.rss.eex       |   5 +
 .../web/templates/feed/feed/user.atom.eex     |   6 +-
 .../web/templates/feed/feed/user.rss.eex      |  12 +-
 test/pleroma/web/feed/tag_controller_test.exs |   2 +-
 11 files changed, 212 insertions(+), 84 deletions(-)
 create mode 100644 changelog.d/rss.fix

diff --git a/changelog.d/rss.fix b/changelog.d/rss.fix
new file mode 100644
index 000000000..a3455698a
--- /dev/null
+++ b/changelog.d/rss.fix
@@ -0,0 +1 @@
+Fix RSS feeds to be W3C compliant and render better in RSS readers
diff --git a/lib/pleroma/web/feed/feed_view.ex b/lib/pleroma/web/feed/feed_view.ex
index e1ee33d62..a433b8403 100644
--- a/lib/pleroma/web/feed/feed_view.ex
+++ b/lib/pleroma/web/feed/feed_view.ex
@@ -97,6 +97,64 @@ defmodule Pleroma.Web.Feed.FeedView do
     end
   end
 
+  def rss_content_encoded(data) do
+    data
+    |> feed_content_encoded()
+    |> String.replace("]]>", "]]&gt;")
+  end
+
+  def atom_content_encoded(data), do: feed_content_encoded(data)
+
+  defp feed_content_encoded(data) do
+    base_content =
+      case activity_content(data) do
+        "" ->
+          data["summary"] || data["type"] ||
+            ""
+            |> escape()
+
+        content ->
+          content
+      end
+
+    attachments_html =
+      (data["attachment"] || [])
+      |> Enum.map(&rss_attachment_preview/1)
+      |> Enum.reject(&(&1 == ""))
+      |> Enum.join("<br/><br/>")
+
+    [base_content, attachments_html]
+    |> Enum.reject(&(&1 == ""))
+    |> Enum.join("<br/><br/>")
+  end
+
+  defp rss_attachment_preview(attachment) do
+    href = attachment_href(attachment)
+
+    if is_binary(href) and href != "" do
+      media_type = attachment_type(attachment) || "application/octet-stream"
+      escaped_href = escape(href)
+      name = attachment["name"] || "Attachment"
+      escaped_name = escape(name)
+
+      cond do
+        String.starts_with?(media_type, "image/") ->
+          ~s(<p><img src="#{escaped_href}" alt="#{escaped_name}" loading="lazy"/></p>)
+
+        String.starts_with?(media_type, "video/") ->
+          ~s(<p><video controls preload="metadata" src="#{escaped_href}"></video></p><p><a href="#{escaped_href}">#{escaped_name}</a></p>)
+
+        String.starts_with?(media_type, "audio/") ->
+          ~s(<p><audio controls preload="metadata" src="#{escaped_href}"></audio></p><p><a href="#{escaped_href}">#{escaped_name}</a></p>)
+
+        true ->
+          ~s(<p><a href="#{escaped_href}">#{escaped_name}</a></p>)
+      end
+    else
+      ""
+    end
+  end
+
   def activity_content(%{"content" => content}) do
     content
     |> String.replace(~r/[\n\r]/, "")
@@ -106,16 +164,99 @@ defmodule Pleroma.Web.Feed.FeedView do
 
   def activity_context(activity), do: escape(activity.data["context"])
 
+  def feed_self_url(conn), do: Phoenix.Controller.current_url(conn)
+
+  def activity_link(activity, data) do
+    cond do
+      activity.local -> data["id"] || data["url"]
+      true -> data["external_url"] || data["id"] || data["url"]
+    end
+  end
+
   def attachment_href(attachment) do
-    attachment["url"]
-    |> hd()
+    attachment
+    |> attachment_url_data()
     |> Map.get("href")
   end
 
   def attachment_type(attachment) do
-    attachment["url"]
-    |> hd()
-    |> Map.get("mediaType")
+    attachment
+    |> attachment_url_data()
+    |> Map.get("mediaType") || attachment["mediaType"]
+  end
+
+  def attachment_size(attachment) do
+    attachment
+    |> attachment_url_data()
+    |> Map.get("size", 0)
+  end
+
+  def attachment_size_positive(attachment) do
+    case attachment_size(attachment) do
+      size when is_integer(size) and size > 0 ->
+        size
+
+      size when is_binary(size) ->
+        case Integer.parse(size) do
+          {parsed, ""} when parsed > 0 -> parsed
+          _ -> nil
+        end
+
+      _ ->
+        nil
+    end
+  end
+
+  def attachment_medium(attachment) do
+    case attachment_type(attachment) do
+      "image/" <> _rest -> "image"
+      "video/" <> _rest -> "video"
+      "audio/" <> _rest -> "audio"
+      _ -> "document"
+    end
+  end
+
+  def attachment_previewable?(attachment) do
+    attachment_medium(attachment) in ["image", "video", "audio"]
+  end
+
+  def attachment_description(attachment) do
+    attachment["name"] || ""
+  end
+
+  def media_content_xml(attachment) do
+    href = escape(attachment_href(attachment) || "")
+    type = escape(attachment_type(attachment) || "application/octet-stream")
+    medium = escape(attachment_medium(attachment))
+
+    file_size_attr =
+      case attachment_size_positive(attachment) do
+        size when is_integer(size) -> ~s( fileSize="#{size}")
+        _ -> ""
+      end
+
+    description_xml =
+      case attachment_description(attachment) do
+        "" ->
+          ""
+
+        description ->
+          ~s(\n  <media:description type="plain">#{escape(description)}</media:description>)
+      end
+
+    """
+    <media:content url="#{href}" type="#{type}"#{file_size_attr} medium="#{medium}">
+      <media:rating scheme="urn:simple">nonadult</media:rating>#{description_xml}
+    </media:content>
+    """
+  end
+
+  defp attachment_url_data(attachment) do
+    case attachment["url"] do
+      [first | _] when is_map(first) -> first
+      %{} = map -> map
+      _ -> %{}
+    end
   end
 
   def get_href(id) do
diff --git a/lib/pleroma/web/templates/feed/feed/_activity.atom.eex b/lib/pleroma/web/templates/feed/feed/_activity.atom.eex
index b774f7984..f87d97cb4 100644
--- a/lib/pleroma/web/templates/feed/feed/_activity.atom.eex
+++ b/lib/pleroma/web/templates/feed/feed/_activity.atom.eex
@@ -3,7 +3,7 @@
   <activity:verb>http://activitystrea.ms/schema/1.0/post</activity:verb>
   <id><%= @data["id"] %></id>
   <title><%= activity_title(@data, Keyword.get(@feed_config, :post_title, %{})) %></title>
-  <content type="html"><%= activity_description(@data) %></content>
+  <content type="html"><%= escape(atom_content_encoded(@data)) %></content>
   <published><%= to_rfc3339(@data["published"]) %></published>
   <updated><%= to_rfc3339(@data["published"]) %></updated>
   <ostatus:conversation ref="<%= activity_context(@activity) %>">
@@ -15,35 +15,23 @@
     <summary><%= escape(@data["summary"]) %></summary>
   <% end %>
 
-  <%= if @activity.local do %>
-    <link type="application/atom+xml" href='<%= @data["id"] %>' rel="self"/>
-    <link type="text/html" href='<%= @data["id"] %>' rel="alternate"/>
-  <% else %>
-    <link type="text/html" href='<%= @data["external_url"] %>' rel="alternate"/>
-  <% end %>
+  <link type="application/atom+xml" href='<%= activity_link(@activity, @data) %>' rel="self"/>
+  <link type="text/html" href='<%= activity_link(@activity, @data) %>' rel="alternate"/>
 
   <%= for tag <- Pleroma.Object.hashtags(@object) do %>
     <category term="<%= tag %>"></category>
   <% end %>
 
   <%= for attachment <- @data["attachment"] || [] do %>
-    <link rel="enclosure" href="<%= attachment_href(attachment) %>" type="<%= attachment_type(attachment) %>"/>
+    <%= unless attachment_previewable?(attachment) do %>
+      <link rel="enclosure" href="<%= attachment_href(attachment) %>" type="<%= attachment_type(attachment) %>" length="<%= attachment_size(attachment) %>"/>
+    <% end %>
   <% end %>
 
   <%= if @data["inReplyTo"] do %>
     <thr:in-reply-to ref='<%= @data["inReplyTo"] %>' href='<%= get_href(@data["inReplyTo"]) %>'/>
   <% end %>
 
-  <%= for id <- @activity.recipients do %>
-    <%= if id == Pleroma.Constants.as_public() do %>
-      <link rel="mentioned" ostatus:object-type="http://activitystrea.ms/schema/1.0/collection" href="http://activityschema.org/collection/public"/>
-    <% else %>
-      <%= unless Regex.match?(~r/^#{Pleroma.Web.Endpoint.url()}.+followers$/, id) do %>
-        <link rel="mentioned" ostatus:object-type="http://activitystrea.ms/schema/1.0/person" href="<%= id %>"/>
-      <% end %>
-    <% end %>
-  <% end %>
-
   <%= for {emoji, file} <- @data["emoji"] || %{} do %>
     <link name="<%= emoji %>" rel="emoji" href="<%= file %>"/>
   <% end %>
diff --git a/lib/pleroma/web/templates/feed/feed/_activity.rss.eex b/lib/pleroma/web/templates/feed/feed/_activity.rss.eex
index 7de98f736..a8c2aa342 100644
--- a/lib/pleroma/web/templates/feed/feed/_activity.rss.eex
+++ b/lib/pleroma/web/templates/feed/feed/_activity.rss.eex
@@ -1,45 +1,32 @@
 <item>
   <activity:object-type>http://activitystrea.ms/schema/1.0/note</activity:object-type>
   <activity:verb>http://activitystrea.ms/schema/1.0/post</activity:verb>
-  <guid><%= @data["id"] %></guid>
+  <guid isPermaLink="true"><%= @data["id"] %></guid>
   <title><%= activity_title(@data, Keyword.get(@feed_config, :post_title, %{})) %></title>
   <description><%= activity_description(@data) %></description>
+  <content:encoded><![CDATA[<%= rss_content_encoded(@data) %>]]></content:encoded>
   <pubDate><%= to_rfc2822(@data["published"]) %></pubDate>
   <ostatus:conversation ref="<%= activity_context(@activity) %>">
     <%= activity_context(@activity) %>
   </ostatus:conversation>
 
-  <%= if @activity.local do %>
-    <link><%= @data["id"] %></link>
-  <% else %>
-    <link><%= @data["external_url"] %></link>
-  <% end %>
-
-  <link rel="ostatus:conversation"><%= activity_context(@activity) %></link>
+  <link><%= activity_link(@activity, @data) %></link>
 
   <%= for tag <- Pleroma.Object.hashtags(@object) do %>
-    <category term="<%= tag %>"></category>
+    <%= if tag && tag != "" do %>
+      <category><%= tag %></category>
+    <% end %>
   <% end %>
 
   <%= for attachment <- @data["attachment"] || [] do %>
-    <enclosure url="<%= attachment_href(attachment) %>" type="<%= attachment_type(attachment) %>" />
+    <%= size = attachment_size_positive(attachment) %>
+    <%= unless attachment_previewable?(attachment) do %>
+      <enclosure url="<%= attachment_href(attachment) %>" type="<%= attachment_type(attachment) %>" length="<%= size || 0 %>" />
+    <% end %>
+    <%= media_content_xml(attachment) %>
   <% end %>
 
   <%= if @data["inReplyTo"] do %>
     <thr:in-reply-to ref='<%= @data["inReplyTo"] %>' href='<%= get_href(@data["inReplyTo"]) %>'/>
   <% end %>
-
-  <%= for id <- @activity.recipients do %>
-    <%= if id == Pleroma.Constants.as_public() do %>
-      <link rel="mentioned" ostatus:object-type="http://activitystrea.ms/schema/1.0/collection">http://activityschema.org/collection/public</link>
-    <% else %>
-      <%= unless Regex.match?(~r/^#{Pleroma.Web.Endpoint.url()}.+followers$/, id) do %>
-        <link rel="mentioned" ostatus:object-type="http://activitystrea.ms/schema/1.0/person"><%= id %></link>
-      <% end %>
-    <% end %>
-  <% end %>
-
-  <%= for {emoji, file} <- @data["emoji"] || %{} do %>
-    <link name="<%= emoji %>" rel="emoji"><%= file %></link>
-  <% end %>
 </item>
diff --git a/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex b/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex
index 03c222975..ae762f9ed 100644
--- a/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex
+++ b/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex
@@ -6,7 +6,7 @@
 
   <id><%= @data["id"] %></id>
   <title><%= activity_title(@data, Keyword.get(@feed_config, :post_title, %{})) %></title>
-  <content type="html"><%= activity_description(@data) %></content>
+  <content type="html"><%= escape(atom_content_encoded(@data)) %></content>
   <published><%= to_rfc3339(@data["published"]) %></published>
   <updated><%= to_rfc3339(@data["published"]) %></updated>
   <ostatus:conversation ref="<%= activity_context(@activity) %>">
@@ -15,34 +15,22 @@
   <link href="<%= activity_context(@activity) %>" rel="ostatus:conversation"/>
 
   <%= if @data["summary"] != "" do %>
-    <summary><%= @data["summary"] %></summary>
+    <summary><%= escape(@data["summary"]) %></summary>
   <% end %>
 
-  <%= if @activity.local do %>
-    <link type="application/atom+xml" href='<%= @data["id"] %>' rel="self"/>
-    <link type="text/html" href='<%= @data["id"] %>' rel="alternate"/>
-  <% else %>
-    <link type="text/html" href='<%= @data["external_url"] %>' rel="alternate"/>
-  <% end %>
-
-  <%= for id <- @activity.recipients do %>
-    <%= if id == Pleroma.Constants.as_public() do %>
-      <link rel="mentioned"
-            ostatus:object-type="http://activitystrea.ms/schema/1.0/collection"
-            href="http://activityschema.org/collection/public"/>
-    <% else %>
-      <%= unless Regex.match?(~r/^#{Pleroma.Web.Endpoint.url()}.+followers$/, id) do %>
-        <link rel="mentioned"
-              ostatus:object-type="http://activitystrea.ms/schema/1.0/person"
-              href="<%= id %>" />
-      <% end %>
-    <% end %>
-  <% end %>
+  <link type="application/atom+xml" href='<%= activity_link(@activity, @data) %>' rel="self"/>
+  <link type="text/html" href='<%= activity_link(@activity, @data) %>' rel="alternate"/>
 
   <%= for tag <- Pleroma.Object.hashtags(@object) do %>
     <category term="<%= tag %>"></category>
   <% end %>
 
+  <%= for attachment <- @data["attachment"] || [] do %>
+    <%= unless attachment_previewable?(attachment) do %>
+      <link rel="enclosure" href="<%= attachment_href(attachment) %>" type="<%= attachment_type(attachment) %>" length="<%= attachment_size(attachment) %>"/>
+    <% end %>
+  <% end %>
+
   <%= for {emoji, file} <- @data["emoji"] || %{} do %>
     <link name="<%= emoji %>" rel="emoji" href="<%= file %>"/>
   <% end %>
diff --git a/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex b/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex
index 1b8c34b87..6ae3c5a55 100644
--- a/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex
+++ b/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex
@@ -1,14 +1,22 @@
 <item>
-  <title><%= activity_title(@data, Keyword.get(@feed_config, :post_title, %{})) %></title>
-
-
-  <guid isPermalink="true"><%= activity_context(@activity) %></guid>
-  <link><%= activity_context(@activity) %></link>
+  <guid isPermalink="true"><%= activity_link(@activity, @data) %></guid>
+  <link><%= activity_link(@activity, @data) %></link>
   <pubDate><%= to_rfc2822(@data["published"]) %></pubDate>
-
+  <title><%= activity_title(@data, Keyword.get(@feed_config, :post_title, %{})) %></title>
   <description><%= activity_description(@data) %></description>
+  <content:encoded><![CDATA[<%= rss_content_encoded(@data) %>]]></content:encoded>
+
   <%= for attachment <- @data["attachment"] || [] do %>
-    <enclosure url="<%= attachment_href(attachment) %>" type="<%= attachment_type(attachment) %>"/>
+    <%= size = attachment_size_positive(attachment) %>
+    <%= unless attachment_previewable?(attachment) do %>
+      <enclosure url="<%= attachment_href(attachment) %>" type="<%= attachment_type(attachment) %>" length="<%= size || 0 %>"/>
+    <% end %>
+    <%= media_content_xml(attachment) %>
   <% end %>
 
+  <%= for tag <- Pleroma.Object.hashtags(@object) do %>
+    <%= if tag && tag != "" do %>
+      <category><%= tag %></category>
+    <% end %>
+  <% end %>
 </item>
diff --git a/lib/pleroma/web/templates/feed/feed/tag.atom.eex b/lib/pleroma/web/templates/feed/feed/tag.atom.eex
index 3449c97ff..1646aeec7 100644
--- a/lib/pleroma/web/templates/feed/feed/tag.atom.eex
+++ b/lib/pleroma/web/templates/feed/feed/tag.atom.eex
@@ -9,10 +9,12 @@
 
   <id><%= Routes.tag_feed_url(@conn, :feed, @tag) <> ".atom" %></id>
   <title>#<%= @tag %></title>
-  <subtitle><%= Gettext.dpgettext("static_pages", "tag feed description", "These are public toots tagged with #%{tag}. You can interact with them if you have an account anywhere in the fediverse.", tag: @tag) %></subtitle>
+  <%= with subtitle when subtitle not in [nil, ""] <- Gettext.dpgettext("static_pages", "tag feed description", "These are public toots tagged with #%{tag}. You can interact with them if you have an account anywhere in the fediverse.", tag: @tag) do %>
+    <subtitle><%= subtitle %></subtitle>
+  <% end %>
   <logo><%= feed_logo() %></logo>
   <updated><%= most_recent_update(@activities) %></updated>
-  <link rel="self" href="<%= "#{Routes.tag_feed_url(@conn, :feed, @tag)}.atom"  %>" type="application/atom+xml"/>
+  <link rel="self" href="<%= feed_self_url(@conn) %>" type="application/atom+xml"/>
 
   <%= for activity <- @activities do %>
   <%= render Phoenix.Controller.view_module(@conn), "_tag_activity.atom", Map.merge(assigns, prepare_activity(activity, actor: true)) %>
diff --git a/lib/pleroma/web/templates/feed/feed/tag.rss.eex b/lib/pleroma/web/templates/feed/feed/tag.rss.eex
index a87f9bf50..618b89ba3 100644
--- a/lib/pleroma/web/templates/feed/feed/tag.rss.eex
+++ b/lib/pleroma/web/templates/feed/feed/tag.rss.eex
@@ -1,6 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <rss version="2.0"
      xmlns:webfeeds="http://webfeeds.org/rss/1.0"
+     xmlns:content="http://purl.org/rss/1.0/modules/content/"
+     xmlns:media="http://search.yahoo.com/mrss/"
      xmlns:thr="http://purl.org/syndication/thread/1.0">
   <channel>
 
@@ -8,7 +10,10 @@
     <description><%= Gettext.dpgettext("static_pages", "tag feed description", "These are public toots tagged with #%{tag}. You can interact with them if you have an account anywhere in the fediverse.", tag: @tag) %></description>
     <link><%= "#{Routes.tag_feed_url(@conn, :feed, @tag)}.rss" %></link>
     <webfeeds:logo><%= feed_logo() %></webfeeds:logo>
+    <webfeeds:icon><%= feed_logo() %></webfeeds:icon>
     <webfeeds:accentColor>2b90d9</webfeeds:accentColor>
+    <lastBuildDate><%= most_recent_update(@activities) || to_rfc2822(NaiveDateTime.utc_now()) %></lastBuildDate>
+    <generator><%= Pleroma.Application.named_version() %></generator>
     <%= for activity <- @activities do %>
     <%= render Phoenix.Controller.view_module(@conn), "_tag_activity.xml", Map.merge(assigns, prepare_activity(activity)) %>
     <% end %>
diff --git a/lib/pleroma/web/templates/feed/feed/user.atom.eex b/lib/pleroma/web/templates/feed/feed/user.atom.eex
index c2c77cfed..cc6883727 100644
--- a/lib/pleroma/web/templates/feed/feed/user.atom.eex
+++ b/lib/pleroma/web/templates/feed/feed/user.atom.eex
@@ -8,10 +8,12 @@
 
   <id><%= Routes.user_feed_url(@conn, :feed, @user.nickname) <> ".atom" %></id>
   <title><%= @user.nickname <> "'s timeline" %></title>
-  <subtitle><%= escape(@user.bio) %></subtitle>
+  <%= if @user.bio && @user.bio != "" do %>
+    <subtitle><%= escape(@user.bio) %></subtitle>
+  <% end %>
   <updated><%= most_recent_update(@activities, @user, :atom) %></updated>
   <logo><%= logo(@user) %></logo>
-  <link rel="self" href="<%= "#{Routes.user_feed_url(@conn, :feed, @user.nickname)}.atom" %>" type="application/atom+xml"/>
+  <link rel="self" href="<%= feed_self_url(@conn) %>" type="application/atom+xml"/>
 
   <%= render Phoenix.Controller.view_module(@conn), "_author.atom", assigns %>
 
diff --git a/lib/pleroma/web/templates/feed/feed/user.rss.eex b/lib/pleroma/web/templates/feed/feed/user.rss.eex
index b907a7e57..e2150d8b6 100644
--- a/lib/pleroma/web/templates/feed/feed/user.rss.eex
+++ b/lib/pleroma/web/templates/feed/feed/user.rss.eex
@@ -1,26 +1,32 @@
 <?xml version="1.0" encoding="UTF-8" ?>
 <rss version="2.0"
      xmlns:atom="http://www.w3.org/2005/Atom"
+     xmlns:content="http://purl.org/rss/1.0/modules/content/"
+     xmlns:webfeeds="http://webfeeds.org/rss/1.0"
+     xmlns:media="http://search.yahoo.com/mrss/"
      xmlns:thr="http://purl.org/syndication/thread/1.0"
      xmlns:activity="http://activitystrea.ms/spec/1.0/"
      xmlns:ostatus="http://ostatus.org/schema/1.0"
      xmlns:poco="http://portablecontacts.net/spec/1.0">
   <channel>
     <title><%= @user.nickname <> "'s timeline" %></title>
-    <link><%= "#{Routes.user_feed_url(@conn, :feed, @user.nickname)}.rss" %></link>
-    <atom:link href="<%= Routes.user_feed_url(@conn, :feed, @user.nickname) <> ".atom" %>"
+    <atom:link href="<%= feed_self_url(@conn) %>"
                rel="self" type="application/rss+xml" />
+    <link><%= "#{Routes.user_feed_url(@conn, :feed, @user.nickname)}.rss" %></link>
     <description><%= escape(@user.bio) %></description>
     <image>
       <url><%= logo(@user) %></url>
       <title><%= @user.nickname <> "'s timeline" %></title>
       <link><%= "#{Routes.user_feed_url(@conn, :feed, @user.nickname)}.rss" %></link>
     </image>
+    <lastBuildDate><%= most_recent_update(@activities, @user, :rss) %></lastBuildDate>
+    <webfeeds:icon><%= logo(@user) %></webfeeds:icon>
+    <generator><%= Pleroma.Application.named_version() %></generator>
 
     <%= render Phoenix.Controller.view_module(@conn), "_author.rss", assigns %>
 
     <%= if last_activity(@activities) do %>
-      <link rel="next"><%= "#{Routes.user_feed_url(@conn, :feed, @user.nickname)}.rss?max_id=#{last_activity(@activities).id}" %></link>
+      <atom:link rel="next" href="<%= "#{Routes.user_feed_url(@conn, :feed, @user.nickname)}.rss?max_id=#{last_activity(@activities).id}" %>" />
     <% end %>
 
     <%= for activity <- @activities do %>
diff --git a/test/pleroma/web/feed/tag_controller_test.exs b/test/pleroma/web/feed/tag_controller_test.exs
index 662235f31..7f2f57b07 100644
--- a/test/pleroma/web/feed/tag_controller_test.exs
+++ b/test/pleroma/web/feed/tag_controller_test.exs
@@ -141,7 +141,7 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
              FeedView.to_rfc2822(activity1.data["published"])
            ]
 
-    assert xpath(xml, ~x"//channel/item/enclosure/@url"sl) == [
+    assert xpath(xml, ~x"//channel/item/media:content/@url"sl) == [
              "https://peertube.moe/static/webseed/df5f464b-be8d-46fb-ad81-2d4c2d1630e3-480.mp4"
            ]
 

From a9bf7212d495c5005789768f63d302fc4677f120 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 24 Jul 2026 19:59:18 +0400
Subject: [PATCH 02/12] fix(feed): escape fallback content

---
 lib/pleroma/web/feed/feed_view.ex        |  5 ++---
 test/pleroma/web/feed/feed_view_test.exs | 22 ++++++++++++++++++++++
 2 files changed, 24 insertions(+), 3 deletions(-)
 create mode 100644 test/pleroma/web/feed/feed_view_test.exs

diff --git a/lib/pleroma/web/feed/feed_view.ex b/lib/pleroma/web/feed/feed_view.ex
index a433b8403..9724cc7f9 100644
--- a/lib/pleroma/web/feed/feed_view.ex
+++ b/lib/pleroma/web/feed/feed_view.ex
@@ -109,9 +109,8 @@ defmodule Pleroma.Web.Feed.FeedView do
     base_content =
       case activity_content(data) do
         "" ->
-          data["summary"] || data["type"] ||
-            ""
-            |> escape()
+          (data["summary"] || data["type"] || "")
+          |> escape()
 
         content ->
           content
diff --git a/test/pleroma/web/feed/feed_view_test.exs b/test/pleroma/web/feed/feed_view_test.exs
new file mode 100644
index 000000000..3ff3b9bae
--- /dev/null
+++ b/test/pleroma/web/feed/feed_view_test.exs
@@ -0,0 +1,22 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.Feed.FeedViewTest do
+  use Pleroma.DataCase, async: true
+
+  alias Pleroma.Web.Feed.FeedView
+
+  test "escapes fallback content" do
+    data = %{
+      "attachment" => [],
+      "content" => "",
+      "summary" => "<script>alert('feed')</script>"
+    }
+
+    expected = "&lt;script&gt;alert(&#39;feed&#39;)&lt;/script&gt;"
+
+    assert FeedView.atom_content_encoded(data) == expected
+    assert FeedView.rss_content_encoded(data) == expected
+  end
+end

From 85a802282e193333cca700a4ea46243c33057767 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 24 Jul 2026 20:08:04 +0400
Subject: [PATCH 03/12] fix(feed): hide sensitive media previews

---
 lib/pleroma/web/feed/feed_view.ex             | 39 ++++++++++---------
 .../web/templates/feed/feed/_activity.rss.eex |  2 +-
 .../templates/feed/feed/_tag_activity.xml.eex |  2 +-
 test/pleroma/web/feed/feed_view_test.exs      | 24 ++++++++++++
 4 files changed, 47 insertions(+), 20 deletions(-)

diff --git a/lib/pleroma/web/feed/feed_view.ex b/lib/pleroma/web/feed/feed_view.ex
index 9724cc7f9..f8bc94504 100644
--- a/lib/pleroma/web/feed/feed_view.ex
+++ b/lib/pleroma/web/feed/feed_view.ex
@@ -117,10 +117,14 @@ defmodule Pleroma.Web.Feed.FeedView do
       end
 
     attachments_html =
-      (data["attachment"] || [])
-      |> Enum.map(&rss_attachment_preview/1)
-      |> Enum.reject(&(&1 == ""))
-      |> Enum.join("<br/><br/>")
+      if data["sensitive"] do
+        ""
+      else
+        (data["attachment"] || [])
+        |> Enum.map(&rss_attachment_preview/1)
+        |> Enum.reject(&(&1 == ""))
+        |> Enum.join("<br/><br/>")
+      end
 
     [base_content, attachments_html]
     |> Enum.reject(&(&1 == ""))
@@ -223,7 +227,9 @@ defmodule Pleroma.Web.Feed.FeedView do
     attachment["name"] || ""
   end
 
-  def media_content_xml(attachment) do
+  def media_content_xml(_attachment, true), do: ""
+
+  def media_content_xml(attachment, _sensitive) do
     href = escape(attachment_href(attachment) || "")
     type = escape(attachment_type(attachment) || "application/octet-stream")
     medium = escape(attachment_medium(attachment))
@@ -234,20 +240,17 @@ defmodule Pleroma.Web.Feed.FeedView do
         _ -> ""
       end
 
-    description_xml =
-      case attachment_description(attachment) do
-        "" ->
-          ""
+    case attachment_description(attachment) do
+      "" ->
+        ~s(<media:content url="#{href}" type="#{type}"#{file_size_attr} medium="#{medium}"/>\n)
 
-        description ->
-          ~s(\n  <media:description type="plain">#{escape(description)}</media:description>)
-      end
-
-    """
-    <media:content url="#{href}" type="#{type}"#{file_size_attr} medium="#{medium}">
-      <media:rating scheme="urn:simple">nonadult</media:rating>#{description_xml}
-    </media:content>
-    """
+      description ->
+        """
+        <media:content url="#{href}" type="#{type}"#{file_size_attr} medium="#{medium}">
+          <media:description type="plain">#{escape(description)}</media:description>
+        </media:content>
+        """
+    end
   end
 
   defp attachment_url_data(attachment) do
diff --git a/lib/pleroma/web/templates/feed/feed/_activity.rss.eex b/lib/pleroma/web/templates/feed/feed/_activity.rss.eex
index a8c2aa342..e2708543f 100644
--- a/lib/pleroma/web/templates/feed/feed/_activity.rss.eex
+++ b/lib/pleroma/web/templates/feed/feed/_activity.rss.eex
@@ -23,7 +23,7 @@
     <%= unless attachment_previewable?(attachment) do %>
       <enclosure url="<%= attachment_href(attachment) %>" type="<%= attachment_type(attachment) %>" length="<%= size || 0 %>" />
     <% end %>
-    <%= media_content_xml(attachment) %>
+    <%= media_content_xml(attachment, @data["sensitive"]) %>
   <% end %>
 
   <%= if @data["inReplyTo"] do %>
diff --git a/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex b/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex
index 6ae3c5a55..9b857ee5e 100644
--- a/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex
+++ b/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex
@@ -11,7 +11,7 @@
     <%= unless attachment_previewable?(attachment) do %>
       <enclosure url="<%= attachment_href(attachment) %>" type="<%= attachment_type(attachment) %>" length="<%= size || 0 %>"/>
     <% end %>
-    <%= media_content_xml(attachment) %>
+    <%= media_content_xml(attachment, @data["sensitive"]) %>
   <% end %>
 
   <%= for tag <- Pleroma.Object.hashtags(@object) do %>
diff --git a/test/pleroma/web/feed/feed_view_test.exs b/test/pleroma/web/feed/feed_view_test.exs
index 3ff3b9bae..45ed3c3ff 100644
--- a/test/pleroma/web/feed/feed_view_test.exs
+++ b/test/pleroma/web/feed/feed_view_test.exs
@@ -19,4 +19,28 @@ defmodule Pleroma.Web.Feed.FeedViewTest do
     assert FeedView.atom_content_encoded(data) == expected
     assert FeedView.rss_content_encoded(data) == expected
   end
+
+  test "does not preview or classify sensitive attachments" do
+    attachment = %{
+      "name" => "spoiler",
+      "url" => [%{"href" => "https://example.com/spoiler.png", "mediaType" => "image/png"}]
+    }
+
+    data = %{
+      "attachment" => [attachment],
+      "content" => "content warning",
+      "sensitive" => true
+    }
+
+    assert FeedView.atom_content_encoded(data) == "content warning"
+    assert FeedView.rss_content_encoded(data) == "content warning"
+    assert FeedView.media_content_xml(attachment, true) == ""
+
+    media_content = FeedView.media_content_xml(attachment, false)
+    assert media_content =~ "<media:description type=\"plain\">spoiler</media:description>"
+    refute media_content =~ "media:rating"
+
+    assert FeedView.media_content_xml(Map.delete(attachment, "name"), false) ==
+             ~s(<media:content url="https://example.com/spoiler.png" type="image/png" medium="image"/>\n)
+  end
 end

From d0c8ca92a5885fbd4919273300cd952f87bea661 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 24 Jul 2026 20:11:19 +0400
Subject: [PATCH 04/12] fix(feed): escape self link URLs

---
 lib/pleroma/web/feed/feed_view.ex              |  6 +++++-
 test/pleroma/web/feed/user_controller_test.exs | 12 ++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/lib/pleroma/web/feed/feed_view.ex b/lib/pleroma/web/feed/feed_view.ex
index f8bc94504..ade9f7a15 100644
--- a/lib/pleroma/web/feed/feed_view.ex
+++ b/lib/pleroma/web/feed/feed_view.ex
@@ -167,7 +167,11 @@ defmodule Pleroma.Web.Feed.FeedView do
 
   def activity_context(activity), do: escape(activity.data["context"])
 
-  def feed_self_url(conn), do: Phoenix.Controller.current_url(conn)
+  def feed_self_url(conn) do
+    conn
+    |> Phoenix.Controller.current_url()
+    |> escape()
+  end
 
   def activity_link(activity, data) do
     cond do
diff --git a/test/pleroma/web/feed/user_controller_test.exs b/test/pleroma/web/feed/user_controller_test.exs
index 916531cd5..5dfe6aa89 100644
--- a/test/pleroma/web/feed/user_controller_test.exs
+++ b/test/pleroma/web/feed/user_controller_test.exs
@@ -138,6 +138,18 @@ defmodule Pleroma.Web.Feed.UserControllerTest do
       assert activity_titles == [~c"2hu & as"]
     end
 
+    test "escapes query parameters in feed self links", %{conn: conn, user: user} do
+      for format <- ~w[atom rss] do
+        response =
+          conn
+          |> get("/users/#{user.nickname}/feed.#{format}?first=one&second=two")
+          |> response(200)
+
+        assert response =~ "first=one&amp;second=two"
+        refute response =~ "first=one&second=two"
+      end
+    end
+
     test "returns 404 for a missing feed", %{conn: conn} do
       conn =
         conn

From 96f471a291428c4d0266b3c9536a315e1668864a Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 24 Jul 2026 20:21:54 +0400
Subject: [PATCH 05/12] fix(feed): format RSS build dates

---
 lib/pleroma/web/feed/feed_view.ex               | 14 ++++++++++++++
 lib/pleroma/web/templates/feed/feed/tag.rss.eex |  4 +++-
 test/pleroma/web/feed/tag_controller_test.exs   | 17 ++++++++++++++++-
 3 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/lib/pleroma/web/feed/feed_view.ex b/lib/pleroma/web/feed/feed_view.ex
index ade9f7a15..dcbb8404f 100644
--- a/lib/pleroma/web/feed/feed_view.ex
+++ b/lib/pleroma/web/feed/feed_view.ex
@@ -38,6 +38,20 @@ defmodule Pleroma.Web.Feed.FeedView do
     end
   end
 
+  def most_recent_update([], :rss), do: nil
+
+  def most_recent_update(activities, :rss) do
+    activities
+    |> Enum.map(fn activity ->
+      case Object.normalize(activity, fetch: false) do
+        %Object{updated_at: updated_at} -> updated_at
+        _ -> activity.updated_at
+      end
+    end)
+    |> Enum.max_by(&NaiveDateTime.to_erl/1)
+    |> to_rfc2822()
+  end
+
   def most_recent_update(activities, user, :atom) do
     (List.first(activities) || user).updated_at
     |> to_rfc3339()
diff --git a/lib/pleroma/web/templates/feed/feed/tag.rss.eex b/lib/pleroma/web/templates/feed/feed/tag.rss.eex
index 618b89ba3..b74a573e5 100644
--- a/lib/pleroma/web/templates/feed/feed/tag.rss.eex
+++ b/lib/pleroma/web/templates/feed/feed/tag.rss.eex
@@ -12,7 +12,9 @@
     <webfeeds:logo><%= feed_logo() %></webfeeds:logo>
     <webfeeds:icon><%= feed_logo() %></webfeeds:icon>
     <webfeeds:accentColor>2b90d9</webfeeds:accentColor>
-    <lastBuildDate><%= most_recent_update(@activities) || to_rfc2822(NaiveDateTime.utc_now()) %></lastBuildDate>
+    <%= with last_build_date when not is_nil(last_build_date) <- most_recent_update(@activities, :rss) do %>
+      <lastBuildDate><%= last_build_date %></lastBuildDate>
+    <% end %>
     <generator><%= Pleroma.Application.named_version() %></generator>
     <%= for activity <- @activities do %>
     <%= render Phoenix.Controller.view_module(@conn), "_tag_activity.xml", Map.merge(assigns, prepare_activity(activity)) %>
diff --git a/test/pleroma/web/feed/tag_controller_test.exs b/test/pleroma/web/feed/tag_controller_test.exs
index 7f2f57b07..2e20e18d7 100644
--- a/test/pleroma/web/feed/tag_controller_test.exs
+++ b/test/pleroma/web/feed/tag_controller_test.exs
@@ -105,8 +105,10 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
         }
       ])
 
+    edited_at = NaiveDateTime.add(object.updated_at, 60)
+
     object
-    |> Ecto.Changeset.change(data: object_data)
+    |> Ecto.Changeset.change(data: object_data, updated_at: edited_at)
     |> Pleroma.Repo.update()
 
     {:ok, activity2} = CommonAPI.post(user, %{status: "42 This is :moominmamma #PleromaArt"})
@@ -141,6 +143,9 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
              FeedView.to_rfc2822(activity1.data["published"])
            ]
 
+    assert xpath(xml, ~x"//channel/lastBuildDate/text()"s) ==
+             FeedView.to_rfc2822(edited_at)
+
     assert xpath(xml, ~x"//channel/item/media:content/@url"sl) == [
              "https://peertube.moe/static/webseed/df5f464b-be8d-46fb-ad81-2d4c2d1630e3-480.mp4"
            ]
@@ -181,6 +186,16 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
            ]
   end
 
+  test "does not fabricate lastBuildDate for an empty RSS feed", %{conn: conn} do
+    response =
+      conn
+      |> put_req_header("accept", "application/rss+xml")
+      |> get(tag_feed_path(conn, :feed, "empty.rss"))
+      |> response(200)
+
+    refute response =~ "<lastBuildDate>"
+  end
+
   describe "private instance" do
     setup do: clear_config([:instance, :public], false)
 

From d1a7e915ce3eff59243b0cd07f430517f4c63c58 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 24 Jul 2026 20:34:33 +0400
Subject: [PATCH 06/12] fix(feed): preserve standard media enclosures

---
 .../templates/feed/feed/_activity.atom.eex    | 10 +++-
 .../web/templates/feed/feed/_activity.rss.eex | 11 ++--
 .../feed/feed/_tag_activity.atom.eex          | 10 +++-
 .../templates/feed/feed/_tag_activity.xml.eex | 11 ++--
 test/pleroma/web/feed/tag_controller_test.exs | 40 ++++++++++++-
 .../pleroma/web/feed/user_controller_test.exs | 57 +++++++++++++++++++
 6 files changed, 122 insertions(+), 17 deletions(-)

diff --git a/lib/pleroma/web/templates/feed/feed/_activity.atom.eex b/lib/pleroma/web/templates/feed/feed/_activity.atom.eex
index f87d97cb4..604805211 100644
--- a/lib/pleroma/web/templates/feed/feed/_activity.atom.eex
+++ b/lib/pleroma/web/templates/feed/feed/_activity.atom.eex
@@ -22,9 +22,13 @@
     <category term="<%= tag %>"></category>
   <% end %>
 
-  <%= for attachment <- @data["attachment"] || [] do %>
-    <%= unless attachment_previewable?(attachment) do %>
-      <link rel="enclosure" href="<%= attachment_href(attachment) %>" type="<%= attachment_type(attachment) %>" length="<%= attachment_size(attachment) %>"/>
+  <%= unless @data["sensitive"] do %>
+    <%= for attachment <- @data["attachment"] || [] do %>
+      <%= if size = attachment_size_positive(attachment) do %>
+        <link rel="enclosure" href="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= size %>"/>
+      <% else %>
+        <link rel="enclosure" href="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>"/>
+      <% end %>
     <% end %>
   <% end %>
 
diff --git a/lib/pleroma/web/templates/feed/feed/_activity.rss.eex b/lib/pleroma/web/templates/feed/feed/_activity.rss.eex
index e2708543f..2127f554f 100644
--- a/lib/pleroma/web/templates/feed/feed/_activity.rss.eex
+++ b/lib/pleroma/web/templates/feed/feed/_activity.rss.eex
@@ -18,11 +18,14 @@
     <% end %>
   <% end %>
 
-  <%= for attachment <- @data["attachment"] || [] do %>
-    <%= size = attachment_size_positive(attachment) %>
-    <%= unless attachment_previewable?(attachment) do %>
-      <enclosure url="<%= attachment_href(attachment) %>" type="<%= attachment_type(attachment) %>" length="<%= size || 0 %>" />
+  <%= unless @data["sensitive"] do %>
+    <%= with [attachment | _] <- @data["attachment"] || [] do %>
+      <%= size = attachment_size_positive(attachment) %>
+      <enclosure url="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= size || 0 %>" />
     <% end %>
+  <% end %>
+
+  <%= for attachment <- @data["attachment"] || [] do %>
     <%= media_content_xml(attachment, @data["sensitive"]) %>
   <% end %>
 
diff --git a/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex b/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex
index ae762f9ed..1720ccd37 100644
--- a/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex
+++ b/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex
@@ -25,9 +25,13 @@
     <category term="<%= tag %>"></category>
   <% end %>
 
-  <%= for attachment <- @data["attachment"] || [] do %>
-    <%= unless attachment_previewable?(attachment) do %>
-      <link rel="enclosure" href="<%= attachment_href(attachment) %>" type="<%= attachment_type(attachment) %>" length="<%= attachment_size(attachment) %>"/>
+  <%= unless @data["sensitive"] do %>
+    <%= for attachment <- @data["attachment"] || [] do %>
+      <%= if size = attachment_size_positive(attachment) do %>
+        <link rel="enclosure" href="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= size %>"/>
+      <% else %>
+        <link rel="enclosure" href="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>"/>
+      <% end %>
     <% end %>
   <% end %>
 
diff --git a/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex b/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex
index 9b857ee5e..09945605c 100644
--- a/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex
+++ b/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex
@@ -6,11 +6,14 @@
   <description><%= activity_description(@data) %></description>
   <content:encoded><![CDATA[<%= rss_content_encoded(@data) %>]]></content:encoded>
 
-  <%= for attachment <- @data["attachment"] || [] do %>
-    <%= size = attachment_size_positive(attachment) %>
-    <%= unless attachment_previewable?(attachment) do %>
-      <enclosure url="<%= attachment_href(attachment) %>" type="<%= attachment_type(attachment) %>" length="<%= size || 0 %>"/>
+  <%= unless @data["sensitive"] do %>
+    <%= with [attachment | _] <- @data["attachment"] || [] do %>
+      <%= size = attachment_size_positive(attachment) %>
+      <enclosure url="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= size || 0 %>"/>
     <% end %>
+  <% end %>
+
+  <%= for attachment <- @data["attachment"] || [] do %>
     <%= media_content_xml(attachment, @data["sensitive"]) %>
   <% end %>
 
diff --git a/test/pleroma/web/feed/tag_controller_test.exs b/test/pleroma/web/feed/tag_controller_test.exs
index 2e20e18d7..0d12f500a 100644
--- a/test/pleroma/web/feed/tag_controller_test.exs
+++ b/test/pleroma/web/feed/tag_controller_test.exs
@@ -31,8 +31,18 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
           "url" => [
             %{
               "href" =>
-                "https://peertube.moe/static/webseed/df5f464b-be8d-46fb-ad81-2d4c2d1630e3-480.mp4",
+                "https://peertube.moe/video.mp4?first=one&second=two",
               "mediaType" => "video/mp4",
+              "size" => "123",
+              "type" => "Link"
+            }
+          ]
+        },
+        %{
+          "url" => [
+            %{
+              "href" => "https://peertube.moe/notes.pdf",
+              "mediaType" => "application/pdf",
               "type" => "Link"
             }
           ]
@@ -64,6 +74,13 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
 
     assert xpath(xml, ~x"//feed/entry/author/name/text()"ls) == [user.nickname, user.nickname]
 
+    assert xpath(xml, ~x"//feed/entry/link[@rel='enclosure']/@href"sl) == [
+             "https://peertube.moe/video.mp4?first=one&second=two",
+             "https://peertube.moe/notes.pdf"
+           ]
+
+    assert xpath(xml, ~x"//feed/entry/link[@rel='enclosure']/@length"sl) == ["123"]
+
     conn =
       conn
       |> put_req_header("accept", "application/atom+xml")
@@ -97,8 +114,18 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
           "url" => [
             %{
               "href" =>
-                "https://peertube.moe/static/webseed/df5f464b-be8d-46fb-ad81-2d4c2d1630e3-480.mp4",
+                "https://peertube.moe/video.mp4?first=one&second=two",
               "mediaType" => "video/mp4",
+              "size" => "123",
+              "type" => "Link"
+            }
+          ]
+        },
+        %{
+          "url" => [
+            %{
+              "href" => "https://peertube.moe/notes.pdf",
+              "mediaType" => "application/pdf",
               "type" => "Link"
             }
           ]
@@ -147,9 +174,16 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
              FeedView.to_rfc2822(edited_at)
 
     assert xpath(xml, ~x"//channel/item/media:content/@url"sl) == [
-             "https://peertube.moe/static/webseed/df5f464b-be8d-46fb-ad81-2d4c2d1630e3-480.mp4"
+             "https://peertube.moe/video.mp4?first=one&second=two",
+             "https://peertube.moe/notes.pdf"
            ]
 
+    assert xpath(xml, ~x"//channel/item/enclosure/@url"sl) == [
+             "https://peertube.moe/video.mp4?first=one&second=two"
+           ]
+
+    assert xpath(xml, ~x"//channel/item/enclosure/@length"sl) == ["123"]
+
     obj1 = Object.normalize(activity1, fetch: false)
     obj2 = Object.normalize(activity2, fetch: false)
 
diff --git a/test/pleroma/web/feed/user_controller_test.exs b/test/pleroma/web/feed/user_controller_test.exs
index 5dfe6aa89..e1f9fd403 100644
--- a/test/pleroma/web/feed/user_controller_test.exs
+++ b/test/pleroma/web/feed/user_controller_test.exs
@@ -150,6 +150,63 @@ defmodule Pleroma.Web.Feed.UserControllerTest do
       end
     end
 
+    test "does not expose sensitive attachments as enclosures", %{
+      conn: conn,
+      object: object,
+      user: user
+    } do
+      object
+      |> Ecto.Changeset.change(data: Map.put(object.data, "sensitive", true))
+      |> Pleroma.Repo.update!()
+
+      atom_response =
+        conn
+        |> get("/users/#{user.nickname}/feed.atom")
+        |> response(200)
+
+      rss_response =
+        conn
+        |> get("/users/#{user.nickname}/feed.rss")
+        |> response(200)
+
+      refute atom_response =~ "rel=\"enclosure\""
+      refute rss_response =~ "<enclosure "
+    end
+
+    test "uses enclosure fallbacks for user feeds", %{conn: conn, object: object, user: user} do
+      attachment = %{"url" => [%{"href" => "https://example.com/file.bin"}]}
+
+      object
+      |> Ecto.Changeset.change(data: Map.put(object.data, "attachment", [attachment]))
+      |> Pleroma.Repo.update!()
+
+      atom_xml =
+        conn
+        |> get("/users/#{user.nickname}/feed.atom")
+        |> response(200)
+        |> parse()
+
+      assert xpath(atom_xml, ~x"//entry/link[@rel='enclosure']/@href"sl) == [
+               "https://example.com/file.bin"
+             ]
+
+      assert xpath(atom_xml, ~x"//entry/link[@rel='enclosure']/@type"sl) == [
+               "application/octet-stream"
+             ]
+
+      assert xpath(atom_xml, ~x"//entry/link[@rel='enclosure']/@length"sl) == []
+
+      rss_xml =
+        conn
+        |> get("/users/#{user.nickname}/feed.rss")
+        |> response(200)
+        |> parse()
+
+      assert xpath(rss_xml, ~x"//item/enclosure/@url"sl) == ["https://example.com/file.bin"]
+      assert xpath(rss_xml, ~x"//item/enclosure/@type"sl) == ["application/octet-stream"]
+      assert xpath(rss_xml, ~x"//item/enclosure/@length"sl) == ["0"]
+    end
+
     test "returns 404 for a missing feed", %{conn: conn} do
       conn =
         conn

From ecd8a14435428dcfed4e8389f65074215846da05 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 24 Jul 2026 20:38:25 +0400
Subject: [PATCH 07/12] fix(feed): correct Atom entry links

---
 lib/pleroma/web/templates/feed/feed/_activity.atom.eex    | 3 +--
 .../web/templates/feed/feed/_tag_activity.atom.eex        | 3 +--
 test/pleroma/web/feed/tag_controller_test.exs             | 2 ++
 test/pleroma/web/feed/user_controller_test.exs            | 8 ++++----
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/lib/pleroma/web/templates/feed/feed/_activity.atom.eex b/lib/pleroma/web/templates/feed/feed/_activity.atom.eex
index 604805211..bc67e12b3 100644
--- a/lib/pleroma/web/templates/feed/feed/_activity.atom.eex
+++ b/lib/pleroma/web/templates/feed/feed/_activity.atom.eex
@@ -15,8 +15,7 @@
     <summary><%= escape(@data["summary"]) %></summary>
   <% end %>
 
-  <link type="application/atom+xml" href='<%= activity_link(@activity, @data) %>' rel="self"/>
-  <link type="text/html" href='<%= activity_link(@activity, @data) %>' rel="alternate"/>
+  <link type="text/html" href='<%= escape(activity_link(@activity, @data) || "") %>' rel="alternate"/>
 
   <%= for tag <- Pleroma.Object.hashtags(@object) do %>
     <category term="<%= tag %>"></category>
diff --git a/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex b/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex
index 1720ccd37..ce5d62de6 100644
--- a/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex
+++ b/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex
@@ -18,8 +18,7 @@
     <summary><%= escape(@data["summary"]) %></summary>
   <% end %>
 
-  <link type="application/atom+xml" href='<%= activity_link(@activity, @data) %>' rel="self"/>
-  <link type="text/html" href='<%= activity_link(@activity, @data) %>' rel="alternate"/>
+  <link type="text/html" href='<%= escape(activity_link(@activity, @data) || "") %>' rel="alternate"/>
 
   <%= for tag <- Pleroma.Object.hashtags(@object) do %>
     <category term="<%= tag %>"></category>
diff --git a/test/pleroma/web/feed/tag_controller_test.exs b/test/pleroma/web/feed/tag_controller_test.exs
index 0d12f500a..9e8874455 100644
--- a/test/pleroma/web/feed/tag_controller_test.exs
+++ b/test/pleroma/web/feed/tag_controller_test.exs
@@ -73,6 +73,8 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
            ]
 
     assert xpath(xml, ~x"//feed/entry/author/name/text()"ls) == [user.nickname, user.nickname]
+    assert xpath(xml, ~x"//feed/entry/link[@rel='self']/@href"sl) == []
+    assert length(xpath(xml, ~x"//feed/entry/link[@rel='alternate']/@href"sl)) == 2
 
     assert xpath(xml, ~x"//feed/entry/link[@rel='enclosure']/@href"sl) == [
              "https://peertube.moe/video.mp4?first=one&second=two",
diff --git a/test/pleroma/web/feed/user_controller_test.exs b/test/pleroma/web/feed/user_controller_test.exs
index e1f9fd403..f363fc0a5 100644
--- a/test/pleroma/web/feed/user_controller_test.exs
+++ b/test/pleroma/web/feed/user_controller_test.exs
@@ -83,12 +83,12 @@ defmodule Pleroma.Web.Feed.UserControllerTest do
         |> get(user_feed_path(conn, :feed, user.nickname))
         |> response(200)
 
-      activity_titles =
-        resp
-        |> SweetXml.parse()
-        |> SweetXml.xpath(~x"//entry/title/text()"l)
+      xml = SweetXml.parse(resp)
+      activity_titles = SweetXml.xpath(xml, ~x"//entry/title/text()"l)
 
       assert activity_titles == [~c"Won't, didn'...", ~c"2hu", ~c"2hu & as"]
+      assert SweetXml.xpath(xml, ~x"//entry/link[@rel='self']/@href"sl) == []
+      assert length(SweetXml.xpath(xml, ~x"//entry/link[@rel='alternate']/@href"sl)) == 3
       assert resp =~ FeedView.escape(object.data["content"])
       assert resp =~ FeedView.escape(object.data["summary"])
       assert resp =~ FeedView.escape(object.data["context"])

From c5183193495ac38ac8caff5fab90113b50dddfe0 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 24 Jul 2026 20:43:40 +0400
Subject: [PATCH 08/12] fix(feed): correct RSS permalink metadata

---
 .../web/templates/feed/feed/_activity.rss.eex |  4 +--
 .../templates/feed/feed/_tag_activity.xml.eex |  4 +--
 test/pleroma/web/feed/tag_controller_test.exs | 33 +++++++++++++++++++
 3 files changed, 37 insertions(+), 4 deletions(-)

diff --git a/lib/pleroma/web/templates/feed/feed/_activity.rss.eex b/lib/pleroma/web/templates/feed/feed/_activity.rss.eex
index 2127f554f..393501dad 100644
--- a/lib/pleroma/web/templates/feed/feed/_activity.rss.eex
+++ b/lib/pleroma/web/templates/feed/feed/_activity.rss.eex
@@ -1,7 +1,7 @@
 <item>
   <activity:object-type>http://activitystrea.ms/schema/1.0/note</activity:object-type>
   <activity:verb>http://activitystrea.ms/schema/1.0/post</activity:verb>
-  <guid isPermaLink="true"><%= @data["id"] %></guid>
+  <guid isPermaLink="true"><%= escape(@data["id"] || "") %></guid>
   <title><%= activity_title(@data, Keyword.get(@feed_config, :post_title, %{})) %></title>
   <description><%= activity_description(@data) %></description>
   <content:encoded><![CDATA[<%= rss_content_encoded(@data) %>]]></content:encoded>
@@ -10,7 +10,7 @@
     <%= activity_context(@activity) %>
   </ostatus:conversation>
 
-  <link><%= activity_link(@activity, @data) %></link>
+  <link><%= escape(activity_link(@activity, @data) || "") %></link>
 
   <%= for tag <- Pleroma.Object.hashtags(@object) do %>
     <%= if tag && tag != "" do %>
diff --git a/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex b/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex
index 09945605c..a8796353f 100644
--- a/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex
+++ b/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex
@@ -1,6 +1,6 @@
 <item>
-  <guid isPermalink="true"><%= activity_link(@activity, @data) %></guid>
-  <link><%= activity_link(@activity, @data) %></link>
+  <guid isPermaLink="true"><%= escape(activity_link(@activity, @data) || "") %></guid>
+  <link><%= escape(activity_link(@activity, @data) || "") %></link>
   <pubDate><%= to_rfc2822(@data["published"]) %></pubDate>
   <title><%= activity_title(@data, Keyword.get(@feed_config, :post_title, %{})) %></title>
   <description><%= activity_description(@data) %></description>
diff --git a/test/pleroma/web/feed/tag_controller_test.exs b/test/pleroma/web/feed/tag_controller_test.exs
index 9e8874455..eef524cc4 100644
--- a/test/pleroma/web/feed/tag_controller_test.exs
+++ b/test/pleroma/web/feed/tag_controller_test.exs
@@ -167,6 +167,8 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
              ~c"yeah #PleromaArt"
            ]
 
+    assert xpath(xml, ~x"//channel/item/guid/@isPermaLink"sl) == ["true", "true"]
+
     assert xpath(xml, ~x"//channel/item/pubDate/text()"sl) == [
              FeedView.to_rfc2822(activity2.data["published"]),
              FeedView.to_rfc2822(activity1.data["published"])
@@ -232,6 +234,37 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
     refute response =~ "<lastBuildDate>"
   end
 
+  test "escapes and round-trips RSS item permalinks", %{conn: conn} do
+    user = insert(:user, local: false)
+    permalink = "https://remote.example/post?first=one&second=two"
+
+    note =
+      insert(:note,
+        user: user,
+        object_local: false,
+        data: %{
+          "content" => "remote #rsslink",
+          "external_url" => permalink,
+          "summary" => "",
+          "tag" => ["rsslink"]
+        }
+      )
+
+    insert(:note_activity, user: user, note: note, local: false, object_local: false)
+
+    response =
+      conn
+      |> put_req_header("accept", "application/rss+xml")
+      |> get(tag_feed_path(conn, :feed, "rsslink.rss"))
+      |> response(200)
+
+    assert response =~ "https://remote.example/post?first=one&amp;second=two"
+
+    xml = parse(response)
+    assert xpath(xml, ~x"//channel/item/guid/text()"s) == permalink
+    assert xpath(xml, ~x"//channel/item/link/text()"s) == permalink
+  end
+
   describe "private instance" do
     setup do: clear_config([:instance, :public], false)
 

From 2d667e1d2a2cfecea99cdcd660460882b2dfbf20 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 24 Jul 2026 20:44:58 +0400
Subject: [PATCH 09/12] style(feed): format enclosure fixtures

---
 test/pleroma/web/feed/tag_controller_test.exs | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/test/pleroma/web/feed/tag_controller_test.exs b/test/pleroma/web/feed/tag_controller_test.exs
index eef524cc4..a23c25274 100644
--- a/test/pleroma/web/feed/tag_controller_test.exs
+++ b/test/pleroma/web/feed/tag_controller_test.exs
@@ -30,8 +30,7 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
         %{
           "url" => [
             %{
-              "href" =>
-                "https://peertube.moe/video.mp4?first=one&second=two",
+              "href" => "https://peertube.moe/video.mp4?first=one&second=two",
               "mediaType" => "video/mp4",
               "size" => "123",
               "type" => "Link"
@@ -115,8 +114,7 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
         %{
           "url" => [
             %{
-              "href" =>
-                "https://peertube.moe/video.mp4?first=one&second=two",
+              "href" => "https://peertube.moe/video.mp4?first=one&second=two",
               "mediaType" => "video/mp4",
               "size" => "123",
               "type" => "Link"

From 5f71532442c7ad45c34663a6b3cf08f081a35132 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 24 Jul 2026 20:59:13 +0400
Subject: [PATCH 10/12] fix(feed): tighten enclosure metadata

---
 lib/pleroma/web/feed/feed_view.ex                   | 10 ++++++----
 .../web/templates/feed/feed/_activity.atom.eex      |  2 +-
 .../web/templates/feed/feed/_activity.rss.eex       |  9 ++++-----
 .../web/templates/feed/feed/_tag_activity.atom.eex  |  2 +-
 .../web/templates/feed/feed/_tag_activity.xml.eex   |  9 ++++-----
 test/pleroma/web/feed/feed_view_test.exs            | 13 +++++++++++++
 test/pleroma/web/feed/user_controller_test.exs      |  9 ++++++---
 7 files changed, 35 insertions(+), 19 deletions(-)

diff --git a/lib/pleroma/web/feed/feed_view.ex b/lib/pleroma/web/feed/feed_view.ex
index dcbb8404f..fc29db2b7 100644
--- a/lib/pleroma/web/feed/feed_view.ex
+++ b/lib/pleroma/web/feed/feed_view.ex
@@ -131,7 +131,7 @@ defmodule Pleroma.Web.Feed.FeedView do
       end
 
     attachments_html =
-      if data["sensitive"] do
+      if sensitive?(data) do
         ""
       else
         (data["attachment"] || [])
@@ -181,6 +181,8 @@ defmodule Pleroma.Web.Feed.FeedView do
 
   def activity_context(activity), do: escape(activity.data["context"])
 
+  def sensitive?(data), do: data["sensitive"] in [true, "true"]
+
   def feed_self_url(conn) do
     conn
     |> Phoenix.Controller.current_url()
@@ -237,15 +239,15 @@ defmodule Pleroma.Web.Feed.FeedView do
     end
   end
 
-  def attachment_previewable?(attachment) do
-    attachment_medium(attachment) in ["image", "video", "audio"]
+  def rss_enclosure_attachment(attachments) do
+    Enum.find(attachments || [], &(not is_nil(attachment_size_positive(&1))))
   end
 
   def attachment_description(attachment) do
     attachment["name"] || ""
   end
 
-  def media_content_xml(_attachment, true), do: ""
+  def media_content_xml(_attachment, sensitive) when sensitive in [true, "true"], do: ""
 
   def media_content_xml(attachment, _sensitive) do
     href = escape(attachment_href(attachment) || "")
diff --git a/lib/pleroma/web/templates/feed/feed/_activity.atom.eex b/lib/pleroma/web/templates/feed/feed/_activity.atom.eex
index bc67e12b3..91ef947f7 100644
--- a/lib/pleroma/web/templates/feed/feed/_activity.atom.eex
+++ b/lib/pleroma/web/templates/feed/feed/_activity.atom.eex
@@ -21,7 +21,7 @@
     <category term="<%= tag %>"></category>
   <% end %>
 
-  <%= unless @data["sensitive"] do %>
+  <%= unless sensitive?(@data) do %>
     <%= for attachment <- @data["attachment"] || [] do %>
       <%= if size = attachment_size_positive(attachment) do %>
         <link rel="enclosure" href="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= size %>"/>
diff --git a/lib/pleroma/web/templates/feed/feed/_activity.rss.eex b/lib/pleroma/web/templates/feed/feed/_activity.rss.eex
index 393501dad..4d71a45c7 100644
--- a/lib/pleroma/web/templates/feed/feed/_activity.rss.eex
+++ b/lib/pleroma/web/templates/feed/feed/_activity.rss.eex
@@ -18,15 +18,14 @@
     <% end %>
   <% end %>
 
-  <%= unless @data["sensitive"] do %>
-    <%= with [attachment | _] <- @data["attachment"] || [] do %>
-      <%= size = attachment_size_positive(attachment) %>
-      <enclosure url="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= size || 0 %>" />
+  <%= unless sensitive?(@data) do %>
+    <%= with attachment when not is_nil(attachment) <- rss_enclosure_attachment(@data["attachment"]) do %>
+      <enclosure url="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= attachment_size_positive(attachment) %>" />
     <% end %>
   <% end %>
 
   <%= for attachment <- @data["attachment"] || [] do %>
-    <%= media_content_xml(attachment, @data["sensitive"]) %>
+    <%= media_content_xml(attachment, sensitive?(@data)) %>
   <% end %>
 
   <%= if @data["inReplyTo"] do %>
diff --git a/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex b/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex
index ce5d62de6..44c4806cf 100644
--- a/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex
+++ b/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex
@@ -24,7 +24,7 @@
     <category term="<%= tag %>"></category>
   <% end %>
 
-  <%= unless @data["sensitive"] do %>
+  <%= unless sensitive?(@data) do %>
     <%= for attachment <- @data["attachment"] || [] do %>
       <%= if size = attachment_size_positive(attachment) do %>
         <link rel="enclosure" href="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= size %>"/>
diff --git a/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex b/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex
index a8796353f..64e4c1d81 100644
--- a/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex
+++ b/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex
@@ -6,15 +6,14 @@
   <description><%= activity_description(@data) %></description>
   <content:encoded><![CDATA[<%= rss_content_encoded(@data) %>]]></content:encoded>
 
-  <%= unless @data["sensitive"] do %>
-    <%= with [attachment | _] <- @data["attachment"] || [] do %>
-      <%= size = attachment_size_positive(attachment) %>
-      <enclosure url="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= size || 0 %>"/>
+  <%= unless sensitive?(@data) do %>
+    <%= with attachment when not is_nil(attachment) <- rss_enclosure_attachment(@data["attachment"]) do %>
+      <enclosure url="<%= escape(attachment_href(attachment) || "") %>" type="<%= escape(attachment_type(attachment) || "application/octet-stream") %>" length="<%= attachment_size_positive(attachment) %>"/>
     <% end %>
   <% end %>
 
   <%= for attachment <- @data["attachment"] || [] do %>
-    <%= media_content_xml(attachment, @data["sensitive"]) %>
+    <%= media_content_xml(attachment, sensitive?(@data)) %>
   <% end %>
 
   <%= for tag <- Pleroma.Object.hashtags(@object) do %>
diff --git a/test/pleroma/web/feed/feed_view_test.exs b/test/pleroma/web/feed/feed_view_test.exs
index 45ed3c3ff..786b6df07 100644
--- a/test/pleroma/web/feed/feed_view_test.exs
+++ b/test/pleroma/web/feed/feed_view_test.exs
@@ -35,6 +35,7 @@ defmodule Pleroma.Web.Feed.FeedViewTest do
     assert FeedView.atom_content_encoded(data) == "content warning"
     assert FeedView.rss_content_encoded(data) == "content warning"
     assert FeedView.media_content_xml(attachment, true) == ""
+    assert FeedView.media_content_xml(attachment, "true") == ""
 
     media_content = FeedView.media_content_xml(attachment, false)
     assert media_content =~ "<media:description type=\"plain\">spoiler</media:description>"
@@ -43,4 +44,16 @@ defmodule Pleroma.Web.Feed.FeedViewTest do
     assert FeedView.media_content_xml(Map.delete(attachment, "name"), false) ==
              ~s(<media:content url="https://example.com/spoiler.png" type="image/png" medium="image"/>\n)
   end
+
+  test "does not treat a legacy false string as sensitive" do
+    data = %{
+      "attachment" => [
+        %{"url" => [%{"href" => "https://example.com/image.png", "mediaType" => "image/png"}]}
+      ],
+      "content" => "visible",
+      "sensitive" => "false"
+    }
+
+    assert FeedView.atom_content_encoded(data) =~ "<img"
+  end
 end
diff --git a/test/pleroma/web/feed/user_controller_test.exs b/test/pleroma/web/feed/user_controller_test.exs
index f363fc0a5..b78ddb63a 100644
--- a/test/pleroma/web/feed/user_controller_test.exs
+++ b/test/pleroma/web/feed/user_controller_test.exs
@@ -202,9 +202,12 @@ defmodule Pleroma.Web.Feed.UserControllerTest do
         |> response(200)
         |> parse()
 
-      assert xpath(rss_xml, ~x"//item/enclosure/@url"sl) == ["https://example.com/file.bin"]
-      assert xpath(rss_xml, ~x"//item/enclosure/@type"sl) == ["application/octet-stream"]
-      assert xpath(rss_xml, ~x"//item/enclosure/@length"sl) == ["0"]
+      assert xpath(rss_xml, ~x"//item/enclosure/@url"sl) == []
+      assert xpath(rss_xml, ~x"//item/media:content/@url"sl) == ["https://example.com/file.bin"]
+
+      assert xpath(rss_xml, ~x"//item/media:content/@type"sl) == [
+               "application/octet-stream"
+             ]
     end
 
     test "returns 404 for a missing feed", %{conn: conn} do

From c5230d98c5bbb4ba70516f825fec4d1fb60d836d Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 24 Jul 2026 21:04:35 +0400
Subject: [PATCH 11/12] fix(feed): complete Atom XML metadata

---
 lib/pleroma/web/feed/feed_view.ex             |  2 +-
 .../templates/feed/feed/_activity.atom.eex    |  2 +-
 .../feed/feed/_tag_activity.atom.eex          |  2 +-
 .../web/templates/feed/feed/tag.atom.eex      |  2 +-
 test/pleroma/web/feed/tag_controller_test.exs | 43 +++++++++++++++++++
 .../pleroma/web/feed/user_controller_test.exs | 28 ++++++++++++
 6 files changed, 75 insertions(+), 4 deletions(-)

diff --git a/lib/pleroma/web/feed/feed_view.ex b/lib/pleroma/web/feed/feed_view.ex
index fc29db2b7..b409b1923 100644
--- a/lib/pleroma/web/feed/feed_view.ex
+++ b/lib/pleroma/web/feed/feed_view.ex
@@ -43,7 +43,7 @@ defmodule Pleroma.Web.Feed.FeedView do
   def most_recent_update(activities, :rss) do
     activities
     |> Enum.map(fn activity ->
-      case Object.normalize(activity, fetch: false) do
+      case activity.object do
         %Object{updated_at: updated_at} -> updated_at
         _ -> activity.updated_at
       end
diff --git a/lib/pleroma/web/templates/feed/feed/_activity.atom.eex b/lib/pleroma/web/templates/feed/feed/_activity.atom.eex
index 91ef947f7..f94ba0793 100644
--- a/lib/pleroma/web/templates/feed/feed/_activity.atom.eex
+++ b/lib/pleroma/web/templates/feed/feed/_activity.atom.eex
@@ -1,7 +1,7 @@
 <entry>
   <activity:object-type>http://activitystrea.ms/schema/1.0/note</activity:object-type>
   <activity:verb>http://activitystrea.ms/schema/1.0/post</activity:verb>
-  <id><%= @data["id"] %></id>
+  <id><%= escape(@data["id"] || "") %></id>
   <title><%= activity_title(@data, Keyword.get(@feed_config, :post_title, %{})) %></title>
   <content type="html"><%= escape(atom_content_encoded(@data)) %></content>
   <published><%= to_rfc3339(@data["published"]) %></published>
diff --git a/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex b/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex
index 44c4806cf..6c74c2ab7 100644
--- a/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex
+++ b/lib/pleroma/web/templates/feed/feed/_tag_activity.atom.eex
@@ -4,7 +4,7 @@
 
     <%= render Phoenix.Controller.view_module(@conn), "_tag_author.atom", assigns %>
 
-  <id><%= @data["id"] %></id>
+  <id><%= escape(@data["id"] || "") %></id>
   <title><%= activity_title(@data, Keyword.get(@feed_config, :post_title, %{})) %></title>
   <content type="html"><%= escape(atom_content_encoded(@data)) %></content>
   <published><%= to_rfc3339(@data["published"]) %></published>
diff --git a/lib/pleroma/web/templates/feed/feed/tag.atom.eex b/lib/pleroma/web/templates/feed/feed/tag.atom.eex
index 1646aeec7..fb04544d3 100644
--- a/lib/pleroma/web/templates/feed/feed/tag.atom.eex
+++ b/lib/pleroma/web/templates/feed/feed/tag.atom.eex
@@ -13,7 +13,7 @@
     <subtitle><%= subtitle %></subtitle>
   <% end %>
   <logo><%= feed_logo() %></logo>
-  <updated><%= most_recent_update(@activities) %></updated>
+  <updated><%= most_recent_update(@activities) || to_rfc3339(NaiveDateTime.utc_now()) %></updated>
   <link rel="self" href="<%= feed_self_url(@conn) %>" type="application/atom+xml"/>
 
   <%= for activity <- @activities do %>
diff --git a/test/pleroma/web/feed/tag_controller_test.exs b/test/pleroma/web/feed/tag_controller_test.exs
index a23c25274..35e29ed8c 100644
--- a/test/pleroma/web/feed/tag_controller_test.exs
+++ b/test/pleroma/web/feed/tag_controller_test.exs
@@ -232,6 +232,49 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
     refute response =~ "<lastBuildDate>"
   end
 
+  test "provides a valid updated timestamp for an empty Atom feed", %{conn: conn} do
+    response =
+      conn
+      |> put_req_header("accept", "application/atom+xml")
+      |> get(tag_feed_path(conn, :feed, "empty.atom"))
+      |> response(200)
+
+    updated = response |> parse() |> xpath(~x"//feed/updated/text()"s)
+    assert {:ok, _datetime, 0} = DateTime.from_iso8601(updated)
+  end
+
+  test "escapes Atom IDs and tag feed self links", %{conn: conn} do
+    user = insert(:user, local: false)
+    object_id = "https://remote.example/object?first=one&second=two"
+
+    note =
+      insert(:note,
+        user: user,
+        object_local: false,
+        data: %{
+          "content" => "remote #atomlink",
+          "external_url" => object_id,
+          "id" => object_id,
+          "summary" => "",
+          "tag" => ["atomlink"]
+        }
+      )
+
+    insert(:note_activity, user: user, note: note, local: false, object_local: false)
+
+    response =
+      conn
+      |> put_req_header("accept", "application/atom+xml")
+      |> get("/tags/atomlink.atom?third=three&fourth=four")
+      |> response(200)
+
+    assert response =~ "https://remote.example/object?first=one&amp;second=two"
+    assert response =~ "third=three&amp;fourth=four"
+
+    xml = parse(response)
+    assert xpath(xml, ~x"//feed/entry/id/text()"s) == object_id
+  end
+
   test "escapes and round-trips RSS item permalinks", %{conn: conn} do
     user = insert(:user, local: false)
     permalink = "https://remote.example/post?first=one&second=two"
diff --git a/test/pleroma/web/feed/user_controller_test.exs b/test/pleroma/web/feed/user_controller_test.exs
index b78ddb63a..458f5ec8d 100644
--- a/test/pleroma/web/feed/user_controller_test.exs
+++ b/test/pleroma/web/feed/user_controller_test.exs
@@ -150,6 +150,34 @@ defmodule Pleroma.Web.Feed.UserControllerTest do
       end
     end
 
+    test "keeps fallback summary markup inert in rendered Atom content", %{
+      conn: conn,
+      object: object,
+      user: user
+    } do
+      data =
+        object.data
+        |> Map.put("content", "")
+        |> Map.put("summary", "<script>alert('feed')</script>")
+
+      object
+      |> Ecto.Changeset.change(data: data)
+      |> Pleroma.Repo.update!()
+
+      response =
+        conn
+        |> get("/users/#{user.nickname}/feed.atom")
+        |> response(200)
+
+      assert response =~ "&amp;lt;script&amp;gt;alert(&amp;#39;feed&amp;#39;)&amp;lt;/script&amp;gt;"
+
+      content_values = response |> parse() |> xpath(~x"//entry/content/text()"sl)
+
+      assert Enum.any?(content_values, fn content ->
+               String.starts_with?(content, "&lt;script&gt;alert(&#39;feed&#39;)&lt;/script&gt;")
+             end)
+    end
+
     test "does not expose sensitive attachments as enclosures", %{
       conn: conn,
       object: object,

From 5d8b5a73d2d23dac3b79ff74431bca1b02a7fe70 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 24 Jul 2026 21:05:16 +0400
Subject: [PATCH 12/12] style(feed): format Atom fallback assertion

---
 test/pleroma/web/feed/user_controller_test.exs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/test/pleroma/web/feed/user_controller_test.exs b/test/pleroma/web/feed/user_controller_test.exs
index 458f5ec8d..d12904ec0 100644
--- a/test/pleroma/web/feed/user_controller_test.exs
+++ b/test/pleroma/web/feed/user_controller_test.exs
@@ -169,7 +169,8 @@ defmodule Pleroma.Web.Feed.UserControllerTest do
         |> get("/users/#{user.nickname}/feed.atom")
         |> response(200)
 
-      assert response =~ "&amp;lt;script&amp;gt;alert(&amp;#39;feed&amp;#39;)&amp;lt;/script&amp;gt;"
+      assert response =~
+               "&amp;lt;script&amp;gt;alert(&amp;#39;feed&amp;#39;)&amp;lt;/script&amp;gt;"
 
       content_values = response |> parse() |> xpath(~x"//entry/content/text()"sl)