Summary

This PR enhances the security and code quality of lib/sitemap-xml.ts through comprehensive validation, improved XML entity escaping, and detailed documentation.

Security Improvements

🔒 Enhanced XML Entity Escaping

• Added > character escaping (>) to text() function for defense-in-depth
• Prevents CDATA injection and ensures complete XML safety
• Text content: now escapes &, <, >
• Attribute values: escape &, <, >, ", '

🛡️ Attribute Name Validation

• New validateAttributeName() function prevents injection via malformed attribute names
• Validates against XML spec (alphanumeric, hyphens, underscores, colons, periods)
• New error class: InvalidXMLAttributeNameError
• Throws on attribute names with invalid characters (e.g., <script>)

🔍 Type Safety

• Added runtime type validation to all functions (text, otag, ctag, element)
• Functions throw TypeError for non-string inputs
• Descriptive error messages for debugging

Code Quality Improvements

📚 Comprehensive Documentation

• Added detailed JSDoc comments to all exported functions
• Documented security model and escaping rationale
• Explained Unicode regex with references to XML 1.0 spec
• Added usage examples for all functions

✅ Test Coverage

• Expanded tests from 70 to 88 test cases (+25%)
• Achieved 100% code coverage for sitemap-xml.ts
• Added security-focused tests for XML injection attempts
• Added tests for attribute name validation
• Added tests for type validation edge cases

Breaking Changes

These are defensive breaking changes that improve security:

1. otag() throws InvalidXMLAttributeNameError for invalid attribute names
2. All functions throw TypeError for non-string inputs
3. Text content now escapes > character (outputs >)

⚠️ Impact: These changes only affect code passing malformed data, catching bugs early rather than generating invalid XML.

Test Results

• ✅ All 325 tests passing
• ✅ 100% code coverage for sitemap-xml.ts (Statements: 100%, Branches: 100%, Functions: 100%, Lines: 100%)
• ✅ Overall project coverage: 90.7% statements, 84.85% branches, 94.08% functions
• ✅ XML schema validation passes
• ✅ Lint and TypeScript compilation successful (ESM + CJS)

Files Changed

• lib/sitemap-xml.ts - Complete rewrite with security enhancements and documentation
• lib/errors.ts - Added InvalidXMLAttributeNameError class
• tests/sitemap-xml.test.ts - Comprehensive test suite expansion
• tests/mocks/generator.ts - Updated test fixtures for new escaping
• tests/sitemap-item-stream.test.ts - Updated one attribute escape sequence

Related Issues

Addresses security audit requirements for XML generation code.

🤖 Generated with Claude Code