A url item stored as javascript://%0aalert(1)%0a//x passed Url::to and
reached <loc>, which sitemap.xsl renders as a link on the site origin.
- The definitions form refuses, per row, a url that is not a path or an
http(s) URL (classes.AllowedItemURL) and a urlPattern that is not a
path (signpost.ValidItemPattern), keyed data.<i>.url / .urlPattern.
- Generator.addItem drops a loc or alternate that is not http(s).
- sitemap:import-winter drops such url items and clears such patterns
with a report line; sitemap:import refuses such an entry.
- golem15.sitemap plugin: golem15_sitemap_definitions migration, Definition
model (Fillable theme and data) with tolerant PHP-shaped item decoding and
PHP toArray item encoding
- Url::to and buildUrl port, libxml-format serializer, generator for url and
registry items
- GET /sitemap.xml serves the definition with theme default (404 without one,
empty body without items)
- tests/php/gen-goldens.php and the tracer golden; TestSitemapGolden and the
Postgres TestSitemapTracer
