harden(feeds): Cody sweep — xmlEsc the channel-level <link> in feed.xml + deals.xml too (their item links were escaped but the Host-derived channel link wasn't — the same gap just closed in sitemap.xml). feed.json is safe (JSON.stringify). TDZ non-issue: handlers run post-load

b1faccd8b62fc8d2c123531d534b5e47d7f28d9b · 2026-08-06 11:55:16 -0700 · Steve

Files touched

M server.js

Diff

commit b1faccd8b62fc8d2c123531d534b5e47d7f28d9b
Author: Steve <steve@designerwallcoverings.com>
Date:   Thu Aug 6 11:55:16 2026 -0700

    harden(feeds): Cody sweep — xmlEsc the channel-level <link> in feed.xml + deals.xml too (their item links were escaped but the Host-derived channel link wasn't — the same gap just closed in sitemap.xml). feed.json is safe (JSON.stringify). TDZ non-issue: handlers run post-load
---
 server.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server.js b/server.js
index 9d300c94..2dbe3667 100644
--- a/server.js
+++ b/server.js
@@ -2025,7 +2025,7 @@ app.get('/feed.xml', (req, res) => {
     const link = `${B}/article.html?id=${encodeURIComponent(n.id)}`;
     return `    <item>\n      <title>${xmlEsc(n.title)}</title>\n      <link>${xmlEsc(link)}</link>\n      <guid isPermaLink="false">rentv-${xmlEsc(n.id)}</guid>\n      ${n.cat ? `<category>${xmlEsc(n.cat)}</category>` : ''}\n    </item>`;
   }).join('\n');
-  res.type('application/rss+xml').send(`<?xml version="1.0" encoding="UTF-8"?>\n<rss version="2.0"><channel>\n  <title>RENTV — Commercial Real Estate News</title>\n  <link>${B}/</link>\n  <description>Commercial real estate news, deals and financing across the Western U.S.</description>\n  <language>en-us</language>\n${body}\n</channel></rss>\n`);
+  res.type('application/rss+xml').send(`<?xml version="1.0" encoding="UTF-8"?>\n<rss version="2.0"><channel>\n  <title>RENTV — Commercial Real Estate News</title>\n  <link>${xmlEsc(B)}/</link>\n  <description>Commercial real estate news, deals and financing across the Western U.S.</description>\n  <language>en-us</language>\n${body}\n</channel></rss>\n`);
 });
 
 app.get('/feed.json', (req, res) => {
@@ -2053,7 +2053,7 @@ app.get('/deals.xml', (req, res) => {
     const desc = [d.property_type, [d.city, d.state].filter(Boolean).join(', '), d.amount_label].filter(Boolean).join(' · ');
     return `    <item>\n      <title>${xmlEsc(d.title)}</title>\n      <link>${xmlEsc(B + '/deals')}</link>\n      <guid isPermaLink="false">rentv-deal-${xmlEsc(d.id)}</guid>\n      <description>${xmlEsc(desc)}</description>\n      ${d.property_type ? `<category>${xmlEsc(d.property_type)}</category>` : ''}\n    </item>`;
   }).join('\n');
-  res.type('application/rss+xml').send(`<?xml version="1.0" encoding="UTF-8"?>\n<rss version="2.0"><channel>\n  <title>RENTV — CRE Deals &amp; Transactions</title>\n  <link>${B}/deals</link>\n  <description>Tracked commercial real estate transactions across the Western U.S.</description>\n  <language>en-us</language>\n${body}\n</channel></rss>\n`);
+  res.type('application/rss+xml').send(`<?xml version="1.0" encoding="UTF-8"?>\n<rss version="2.0"><channel>\n  <title>RENTV — CRE Deals &amp; Transactions</title>\n  <link>${xmlEsc(B)}/deals</link>\n  <description>Tracked commercial real estate transactions across the Western U.S.</description>\n  <language>en-us</language>\n${body}\n</channel></rss>\n`);
 });
 
 // ── Folded-in admin-only areas ──────────────────────────────────────────────

← 9cf5e94e consulting: skip daynight injection on /consulting (DTD verd · back to Rentv 2026 · consulting portal: remove dead theme-aware CSS (superseded b 0960554d →