- models.AllowedFrontendURL: empty, or an absolute http(s) URL with a host
and without whitespace, control characters, a double quote, <, > or &
- classes.Rewrite leaves the document unchanged for a refused value,
inserts through EscapeText/EscapeAttr and keeps a loc or href that would
not stay an http(s) URL
- TestRewriteUnsafeFrontendURL, TestAllowedFrontendURL and a stored-row
check in TestSitemapImportSmoke
A url item stored as javascript://%0aalert(1)%0a//x passed Url::to and
reached <loc>, which sitemap.xsl renders as a link on the site origin.
- The definitions form refuses, per row, a url that is not a path or an
http(s) URL (classes.AllowedItemURL) and a urlPattern that is not a
path (signpost.ValidItemPattern), keyed data.<i>.url / .urlPattern.
- Generator.addItem drops a loc or alternate that is not http(s).
- sitemap:import-winter drops such url items and clears such patterns
with a report line; sitemap:import refuses such an entry.
- generator in Definition::addItemToSet order: 50000 URL cap, lastmod from
the record or the updates manifest (regular file, 5 MiB cap, fail safe),
BeforeAddItem (skip) and AddItem (extra XML) festival events, tier or item
priority, per-alternate expansion of list type children
- priority tiers from golem15.sitemap.priority_tiers, compiled at boot,
defaults equal to the PHP getPriorityForUrl rules
- frontend_url rewrite of loc, xhtml:link href and the stylesheet href;
GET /sitemap.xsl serves the PHP stylesheet byte for byte
- golem15_sitemap_settings singleton and Settings model
- sitemap:import (PHP ImportCommand) and sitemap:import-winter with the
read-only Winter export SQL
- urlto and full goldens generated from PHP; TestSitemapImportSmoke
- golem15.sitemap plugin: golem15_sitemap_definitions migration, Definition
model (Fillable theme and data) with tolerant PHP-shaped item decoding and
PHP toArray item encoding
- Url::to and buildUrl port, libxml-format serializer, generator for url and
registry items
- GET /sitemap.xml serves the definition with theme default (404 without one,
empty body without items)
- tests/php/gen-goldens.php and the tracer golden; TestSitemapGolden and the
Postgres TestSitemapTracer
