astro-rss: Generate feed with proper XML escaping

[andersk]

Changes

Generating XML using string concatenation is dangerous and can lead to underescaping.

Just to preemptively dismiss some excuses for this unsafety 😛:

• “But most of the content was surrounded with with <![CDATA[…]]>, so it was fine!” Wrong. The content might contain ]]> itself and break out of the <![CDATA[ early.
• “But URLs don’t need to be escaped, so it was fine!” Wrong. & commonly appears in URLs and needs to be escaped for XML or HTML serialization.
• “But we were validating the output XML, so it was fine!” Wrong. A bug that’s caught at generation time is still a bug; also, some cases of underescaping could lead to incorrect output that isn’t invalid.
• “But there’s no user-generated content for an attacker to control, so it was fine!” Wrong. Underescaping is still a bug even when it’s not a security vulnerability.

So let’s take the fast-xml-parser library that we were using to validate our hand-rolled XML, and use it to properly generate XML instead.

Testing

I updated the existing tests to compare the XML using chai-xml, so that the snapshotted XML strings didn’t need to change. This verifies that the new output is semantically equivalent.

Docs

This doesn’t need any documentation changes. I even preserve support for the existing customData option by parsing and re-serializing the XML string.

[changeset-bot]

🦋 Changeset detected

Latest commit: beeef3a

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[natemoo-re]

Makes sense to me, thanks for contributing!