Summary

This PR addresses multiple security vulnerabilities in the sitemap index parsing and generation functionality by adding comprehensive validation and security checks.

Security Fixes

🔴 HIGH: Protocol Injection Prevention

• Added URL validation to prevent javascript:, data:, file:, and ftp: protocol injection attacks
• Uses centralized validateURL() for consistent security enforcement
• Enforces http/https protocol restriction
• Validates URL format and structure

🟡 MEDIUM: URL Length DoS Protection

• Enforced 2048 character URL limit per sitemaps.org specification
• Prevents resource exhaustion attacks via excessively long URLs

🟡 MEDIUM: Memory Exhaustion Protection

• Added maxEntries parameter to parseSitemapIndex() with default limit of 50,000 entries
• Prevents DoS attacks via maliciously large sitemap indexes
• Configurable limit for different use cases

🟡 MEDIUM: Inconsistent Validation Fixed

• Replaced basic URL validation in stream with centralized validateURL()
• Ensures consistent security policies across all code paths

🟢 LOW-MEDIUM: Date Format Validation

• Added ISO 8601 date format validation for lastmod fields
• Prevents arbitrary text injection in date fields
• Ensures XML schema compliance

🟢 LOW: Empty URL Leakage Fixed

• Fixed bug where items with failed validation were pushed with empty URLs
• Invalid entries are now properly filtered out

Changes

Modified Files

lib/sitemap-index-parser.ts

• Added URL validation in text/cdata handlers using validateURL()
• Added date format validation for lastmod fields using LIMITS.ISO_DATE_REGEX
• Added check to skip items with invalid/empty URLs in closetag handler
• Imported validateURL and LIMITS from validation/constants modules

lib/sitemap-index-stream.ts

• Replaced basic new URL() check with centralized validateURL()
• Improved error message formatting for consistency
• Imported validateURL from validation module

tests/sitemap-index-security.test.ts (NEW)

• 27 comprehensive security tests covering:
  • Protocol injection attacks (parser & stream, both WARN and THROW modes)
  • URL length limits (exceeding limit, at limit)
  • Date format validation (invalid formats, valid ISO 8601)
  • Memory exhaustion (50,001 entries test, custom limits)
  • CDATA handling security
  • Error level handling (SILENT, WARN, THROW)
  • Empty and malformed URL filtering

Test Results

✅ All 356 tests passing

• Coverage maintained above 90%
• New security tests validate all attack vectors
• Existing tests confirm backward compatibility

Backward Compatibility

✅ 100% backward compatible

• Default behavior unchanged (WARN level)
• Invalid entries are filtered in WARN mode (existing behavior)
• THROW mode properly rejects invalid data when explicitly requested
• New maxEntries parameter is optional with sensible default (50,000)
• Error messages maintain expected format for existing tests

Example Usage

// Default behavior - warns and filters invalid URLs
const items = await parseSitemapIndex(xmlStream);

// Strict mode - throws on invalid data
const stream = new XMLToSitemapIndexStream({ level: ErrorLevel.THROW });

// Custom memory limit
const items = await parseSitemapIndex(xmlStream, 10000);

Security Impact

This PR protects against:

• ✅ XSS attacks via javascript: protocol injection
• ✅ Local file access via file: protocol
• ✅ Data URL injection attacks
• ✅ Memory exhaustion DoS attacks
• ✅ URL length-based resource exhaustion
• ✅ Date field injection attacks

Checklist

• All tests passing (356/356)
• Code coverage maintained (>90%)
• Backward compatibility preserved
• Security tests added for all vulnerabilities
• Documentation in code comments
• Follows existing code patterns
• Pre-commit hooks passed (eslint, prettier)

🤖 Generated with Claude Code

Co-Authored-By: Claude [email protected]