From ab3b109652a2dce9dbd0616d72921e64f4c2f431 Mon Sep 17 00:00:00 2001
From: Marco Pedone <m.pedone98@gmail.com>
Date: Fri, 23 Jan 2026 13:55:44 +0100
Subject: [PATCH] fix: escape URLs in sitemap generation to ensure valid XML
 output

---
 apps/infoalloggi/src/pages/sitemap.xml.ts | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/apps/infoalloggi/src/pages/sitemap.xml.ts b/apps/infoalloggi/src/pages/sitemap.xml.ts
index f3c294a..187984d 100644
--- a/apps/infoalloggi/src/pages/sitemap.xml.ts
+++ b/apps/infoalloggi/src/pages/sitemap.xml.ts
@@ -5,7 +5,10 @@ import { generateSSGHelper } from "~/server/utils/ssgHelper";
 
 async function generateSiteMap() {
 	const helper = generateSSGHelper();
-	const dynamicUrls = await helper.annunci.getCodici.fetch();
+	const codici = await helper.annunci.getCodici.fetch();
+	const dynamicUrls = codici.map((cod) => {
+		return `${env.NEXT_PUBLIC_BASE_URL}/annuncio/${cod}`;
+	});
 	const staticUrls = [
 		env.NEXT_PUBLIC_BASE_URL,
 		`${env.NEXT_PUBLIC_BASE_URL}/contatti`,
@@ -27,9 +30,16 @@ async function generateSiteMap() {
     <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.sitemaps.org/schemas/sitemap/0.9 http://www.sitemaps.org/schemas/sitemap/0.9/sitemap.xsd">
       ${allUrls
 				.map((url) => {
+					const escapedUrl = url
+						.replace(/&/g, "&amp;")
+						.replace(/'/g, "&apos;")
+						.replace(/"/g, "&quot;")
+						.replace(/>/g, "&gt;")
+						.replace(/</g, "&lt;");
+
 					return `
             <url>
-              <loc>${url}</loc>
+              <loc>${escapedUrl}</loc>
               <lastmod>${new Date().toISOString()}</lastmod>
               <changefreq>hourly</changefreq>
               <priority>0.7</priority>