Publish valid RSS and sitemap feeds with public event URLs

app/package.json

@@ -107,6 +107,7 @@
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "drizzle-kit": "^0.31.4",
+    "fast-xml-parser": "^5.11.1",
     "openimg": "^1.1.0",
     "prettier": "^3.6.2",
     "tailwindcss": "^4",

app/src/app/rss/route.ts

@@ -1,36 +1,11 @@
-import { NextRequest, NextResponse } from "next/server";
+import { NextResponse } from "next/server";
 import { getPublishedEvents } from "@/lib/published-events";
-import { mainConfig } from "@/lib/config";
+import { generateRSS } from "@/lib/event-feeds";
 
-function generateRSS(
-  events: Awaited<ReturnType<typeof getPublishedEvents>>,
-  origin: string,
-) {
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<rss version="2.0">
-    <channel>
-        <title>All Things Web Bay Area events</title>
-        <description>Sup! Subscribe to stay up to date with our monthly events.</description>
-        <link>${origin}</link>
-        <lastBuildDate>${new Date().toUTCString()}</lastBuildDate>
-        ${events
-          .map(
-            (event) => `<item>
-            <title>${event.name}</title>
-            <description>${event.tagline}</description>
-            <link>${origin}/${event.slug}</link>
-            <pubDate>${event.createdAt.toUTCString()}</pubDate>
-        </item>`,
-          )
-          .join("\n")}
-    </channel>
-</rss>`;
-}
-
-export async function GET(request: NextRequest) {
+export async function GET() {
   try {
     const events = await getPublishedEvents();
-    const content = generateRSS(events, mainConfig.instance.origin);
+    const content = generateRSS(events);
 
     return new NextResponse(content, {
       headers: {

app/src/app/sitemap.xml/route.ts

@@ -1,36 +1,11 @@
-import { NextRequest, NextResponse } from "next/server";
+import { NextResponse } from "next/server";
 import { getPublishedEvents } from "@/lib/published-events";
-import { mainConfig } from "@/lib/config";
+import { generateSiteMap } from "@/lib/event-feeds";
 
-function getUrlElementWithDate(url: string, date: string) {
-  return `<url>
-        <loc>${url}</loc>
-        <lastmod>${date}</lastmod>
-        </url>`;
-}
-
-function generateSiteMap(
-  events: Awaited<ReturnType<typeof getPublishedEvents>>,
-  origin: string,
-) {
-  return `<?xml version="1.0" encoding="UTF-8"?>
-        <urlset xmlns="https://www.sitemaps.org/schemas/sitemap/0.9">
-            ${getUrlElementWithDate(`${origin}/`, new Date().toISOString())}
-            ${getUrlElementWithDate(`${origin}/speakers`, new Date().toISOString())}
-            ${getUrlElementWithDate(`${origin}/about`, new Date().toISOString())}
-            ${events
-              .map(
-                (event) =>
-                  `${getUrlElementWithDate(`${origin}/${event.slug}`, event.updatedAt.toISOString())}`,
-              )
-              .join("\n")}
-        </urlset>`;
-}
-
-export async function GET(request: NextRequest) {
+export async function GET() {
   try {
     const events = await getPublishedEvents();
-    const content = generateSiteMap(events, mainConfig.instance.origin);
+    const content = generateSiteMap(events);
 
     return new NextResponse(content, {
       headers: {

app/src/lib/event-feeds.ts

@@ -0,0 +1,70 @@
+import type { Event } from "./events";
+
+const PUBLIC_SITE_ORIGIN = "https://allthingsweb.dev";
+type FeedEvent = Pick<
+  Event,
+  "name" | "tagline" | "slug" | "createdAt" | "updatedAt"
+>;
+
+function escapeXml(value: string): string {
+  return value
+    .replace(
+      /[^\u0009\u000A\u000D\u0020-\uD7FF\uE000-\uFFFD\u{10000}-\u{10FFFF}]/gu,
+      "",
+    )
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&apos;");
+}
+
+function eventUrl(slug: string): string {
+  return `${PUBLIC_SITE_ORIGIN}/${encodeURIComponent(slug)}`;
+}
+
+export function generateRSS(events: FeedEvent[]) {
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0">
+    <channel>
+        <title>All Things Web Bay Area events</title>
+        <description>Sup! Subscribe to stay up to date with our monthly events.</description>
+        <link>${PUBLIC_SITE_ORIGIN}</link>
+        <lastBuildDate>${new Date().toUTCString()}</lastBuildDate>
+        ${events
+          .map(
+            (event) => `<item>
+            <title>${escapeXml(event.name)}</title>
+            <description>${escapeXml(event.tagline)}</description>
+            <link>${escapeXml(eventUrl(event.slug))}</link>
+            <pubDate>${event.createdAt.toUTCString()}</pubDate>
+        </item>`,
+          )
+          .join("\n")}
+    </channel>
+</rss>`;
+}
+
+function getUrlElement(url: string, date?: string) {
+  return `<url>
+        <loc>${escapeXml(url)}</loc>
+        ${date ? `<lastmod>${date}</lastmod>` : ""}
+        </url>`;
+}
+
+export function generateSiteMap(events: FeedEvent[]) {
+  return `<?xml version="1.0" encoding="UTF-8"?>
+        <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+            ${getUrlElement(`${PUBLIC_SITE_ORIGIN}/`)}
+            ${getUrlElement(`${PUBLIC_SITE_ORIGIN}/speakers`)}
+            ${getUrlElement(`${PUBLIC_SITE_ORIGIN}/about`)}
+            ${events
+              .map((event) =>
+                getUrlElement(
+                  eventUrl(event.slug),
+                  event.updatedAt.toISOString(),
+                ),
+              )
+              .join("\n")}
+        </urlset>`;
+}

app/tests/event-feeds.test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, test } from "bun:test";
+import { XMLParser, XMLValidator } from "fast-xml-parser";
+import { generateRSS, generateSiteMap } from "../src/lib/event-feeds";
+
+const event = {
+  name: "Show & Tell <Web> 🚀",
+  tagline: 'Meet "developers" & share ideas </description><item>fake</item>',
+  slug: "2026-show-and-tell",
+  createdAt: new Date("2026-09-01T00:00:00Z"),
+  updatedAt: new Date("2026-09-16T02:00:00Z"),
+};
+
+describe("public event feeds", () => {
+  test("RSS parses special characters as text, never injected feed elements", () => {
+    const xml = generateRSS([event]);
+    expect(XMLValidator.validate(xml)).toBe(true);
+    const channel = new XMLParser().parse(xml).rss.channel;
+    expect(channel.item.title).toBe(event.name);
+    expect(channel.item.description).toBe(event.tagline);
+    expect(channel.item.link).toBe(
+      "https://allthingsweb.dev/2026-show-and-tell",
+    );
+    expect(channel.link).toBe("https://allthingsweb.dev");
+    expect(channel.item.pubDate).toBe(event.createdAt.toUTCString());
+    expect(Array.isArray(channel.item)).toBe(false);
+  });
+
+  test("RSS omits invalid XML characters while preserving Unicode and newlines", () => {
+    const xml = generateRSS([
+      { ...event, name: "Hello\u0000\uD800 🚀\nWorld" },
+    ]);
+    expect(XMLValidator.validate(xml)).toBe(true);
+    expect(new XMLParser().parse(xml).rss.channel.item.title).toBe(
+      "Hello 🚀\nWorld",
+    );
+  });
+
+  test("sitemap uses the protocol namespace and public URLs with stable modification dates", () => {
+    const xml = generateSiteMap([event, { ...event, slug: "a & b#c" }]);
+    expect(XMLValidator.validate(xml)).toBe(true);
+    const parsed = new XMLParser({ ignoreAttributes: false }).parse(xml).urlset;
+    expect(parsed["@_xmlns"]).toBe(
+      "http://www.sitemaps.org/schemas/sitemap/0.9",
+    );
+    expect(parsed.url.map((url: { loc: string }) => url.loc)).toEqual([
+      "https://allthingsweb.dev/",
+      "https://allthingsweb.dev/speakers",
+      "https://allthingsweb.dev/about",
+      "https://allthingsweb.dev/2026-show-and-tell",
+      "https://allthingsweb.dev/a%20%26%20b%23c",
+    ]);
+    expect(parsed.url[3].lastmod).toBe(event.updatedAt.toISOString());
+    expect(parsed.url[0].lastmod).toBeUndefined();
+  });
+
+  test("empty event feeds remain valid documents", () => {
+    expect(XMLValidator.validate(generateRSS([]))).toBe(true);
+    expect(XMLValidator.validate(generateSiteMap([]))).toBe(true);
+  });
+});