implementation tip:

see core/includes/Parser/Parser.php

		if ( !$text && $this->mOptions->getEnableImageWhitelist()
			 && preg_match( self::EXT_IMAGE_REGEX, $url ) ) {
			$whitelist = explode( "\n", wfMessage( 'external_image_whitelist' )->inContentLanguage()->text() );
			foreach ( $whitelist as $entry ) {
				# Sanitize the regex fragment, make it case-insensitive, ignore blank entries/comments
				if ( strpos( $entry, '#' ) === 0 || $entry === '' ) {
					continue;
				}
				if ( preg_match( '/' . str_replace( '/', '\\/', $entry ) . '/i', $url ) ) {
					# Image matches a whitelist entry
					$text = Linker::makeExternalImage( $url );
					break;
				}
			}

• Bug 55940 has been marked as a duplicate of this bug. ***

The summary is completely incomprehensible for me, but according to what you said on bug 45857 this blocks bug 56287.

(In reply to comment #3)

The summary is completely incomprehensible for me,

Harmonization of "whitelist" handling inside the extension RSS (in other words: E:RSS should use same code and syntax as MediaWiki core does for $wgEnableImageWhitelist)

but according to what you
said on bug 45857 this blocks bug 56287.

Yes

What is the security threat model for rss whitelisting anyways? Mostly asking from a curiosity pov, but also one should make sure the threat models are compatible before copying the image whitelist from core.

(In reply to comment #5)

What is the security threat model for rss whitelisting anyways? Mostly asking
from a curiosity pov, but also one should make sure the threat models are
compatible before copying the image whitelist from core.

The whitelist method was introduced long time ago, requested by Brion, as far as I remember, because RSS should only be included from trusted sources. Brion, pls. can you comment on that?