[vdusek]

The XML sitemap handler appended every characters() callback to a string. Expat can split one text node into many callbacks, so assembling a long <loc> took quadratic time. The handler now collects the pieces in a list and joins them once in endElement.

Sitemaps never declare entities, so the XML parser now rejects entity declarations. Such a sitemap is logged as a parse failure and yields no URLs.

✍️ Drafted by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.11%. Comparing base (5f91c27) to head (32e0ccf).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2369      +/-   ##
==========================================
- Coverage   94.14%   94.11%   -0.04%     
==========================================
  Files         184      184              
  Lines       13647    13654       +7     
==========================================
+ Hits        12848    12850       +2     
- Misses        799      804       +5     

Flag	Coverage Δ
unit	94.11% <100.00%> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Mantisus]

LGTM

[apify-approval-mirror]

Mirroring approval from @Mantisus.

[apify-factory]

Looks good, nothing blocking.

🏭 Factory review — ℹ️ not auto-approved

This change was reviewed but cannot be auto-approved: a human review is active (Mantisus: APPROVED, apify-approval-mirror[bot]: APPROVED).

check	result
Static gates	✅ 16/16
Review findings	✅ none
Reviewer escalation	❌ The change adds input-validation hardening to the parser for untrusted sitemap XML, and now rejects whole sitemaps that declare entities.
Juror 1 — claude-sonnet-5-5, adversarial	⏭️ skipped — the reviewer escalated

Why it was not auto-approved

The comments above are the review itself; this section only explains the approval decision. Push a change and request @apify-factory again to re-run it, or ask a human to review.

_{Reviewed 32e0ccf3d · workflow run}