Summary

This PR addresses security vulnerabilities and code quality issues identified during a comprehensive code review of lib/types.ts, lib/utils.ts, lib/validation.ts, lib/xmllint.ts, and lib/errors.ts.

Security Fixes (Critical)

🔒 Command Injection Prevention

• File: lib/xmllint.ts
• Issue: Function accepted file paths that could be exploited for command injection
• Fix: Always pipe XML content via stdin; never accept file paths as arguments
• Impact: Prevents arbitrary command execution via malicious file path arguments

🔒 Enhanced Path Traversal Protection

• File: lib/validation.ts
• Issue: Incomplete detection of .. path traversal sequences
• Fix: Detect .. in all positions (beginning, middle, end, standalone)
• Details:
  • Check before and after path normalization
  • Validate individual path components
  • Handle both Unix (/) and Windows (\) separators
• Impact: Prevents accessing files outside intended directories

🔒 XSL URL Security Hardening

• File: lib/validation.ts
• Issue: Case-sensitive validation missed obfuscated attacks
• Fix: Case-insensitive validation for malicious patterns
• Blocks:
  • Script tags: <script, <ScRiPt, <SCRIPT>, etc.
  • Dangerous protocols: javascript:, data:, vbscript:, file:, about:
  • URL-encoded attacks: %3cscript, javascript%3a, etc.
• Impact: Comprehensive XSS and protocol injection protection

Quality Improvements

✅ Number Validation

• File: lib/utils.ts
• Issue: parseFloat() and parseInt() could produce NaN that propagated to XML
• Fix: Validate parsed values and throw descriptive errors
• Validates:
  • Video ratings are valid numbers (not NaN)
  • View counts are valid non-negative integers

✅ Date Validation

• File: lib/utils.ts
• Issue: Invalid date strings created Invalid Date objects
• Fix: Check Number.isNaN(date.getTime()) to detect invalid dates
• Impact: Prevents Invalid Date objects in XML output

✅ Language Regex Fix

• File: lib/types.ts
• Issue: Regex /^zh-cn|zh-tw|([a-z]{2,3})$/ had incorrect grouping
• Fix: Changed to /^(zh-cn|zh-tw|[a-z]{2,3})$/ for proper validation
• Impact: Correctly validates ISO 639 language codes

✅ Path Resolution Robustness

• File: lib/xmllint.ts
• Issue: Fragile relative path resolution depended on execution context
• Fix: Use process.cwd() based search with fallback paths
• Impact: Works reliably in source, ESM build, CJS build, and test environments

📝 Type Documentation

• File: lib/types.ts
• Added: JSDoc comments for PriceType and Resolution types
• Documents: Google Video Sitemap spec allows case variations

Documentation

📖 Security Documentation

• File: api.md
• Added: Comprehensive security section to simpleSitemapAndIndex
• Documents:
  • URL validation rules and limits
  • Path traversal protection mechanisms
  • XSL stylesheet security measures
  • Resource limits and data validation
• Added: Security note to xmlLint documentation about stdin piping
• Updated: Examples to show secure usage patterns

📖 JSDoc Security Comments

• Added security-focused comments to all validation functions
• Explain what attacks each validation prevents
• Document security rationale and best practices

Testing

✅ Test Updates

• Updated tests/xmllint.test.ts to pass XML content instead of file paths
• Added 7 new XSL URL security tests covering:
  • Mixed-case script tag detection
  • URL-encoded malicious content
  • Multiple dangerous protocol checks
• All 291 tests passing with coverage exceeding requirements:
  • Statements: 90.23% (required: 90%)
  • Branches: 84.03% (required: 80%)
  • Functions: 94.08% (required: 90%)
  • Lines: 90.34% (required: 90%)

Breaking Changes

⚠️ Note: This PR includes breaking changes for improved security:

1. Stricter path traversal detection - May reject paths containing .. that were previously accepted
2. Enhanced XSL URL validation - Blocks more dangerous patterns (case-insensitive checks)
3. Number/date parsing - Throws errors on invalid input instead of silently creating NaN/Invalid Date
4. Language regex - May reject invalid language codes that previously passed
5. xmlLint API change - No longer accepts file paths, only string or stream content

All breaking changes are documented in the updated api.md.

Checklist

• Security vulnerabilities fixed
• Code quality improved
• Tests updated and passing (291/291)
• Documentation updated with security notes
• Coverage exceeds requirements (>90%)
• Pre-commit hooks passed (eslint, prettier)
• Breaking changes documented

🤖 Generated with Claude Code