OWASP / OWASP/Nest

Repositories static sitemap lastmod always uses current time instead of latest repository update

Open Beginner friendly
#5,259 9 comments 0 reactions 0 assignees View on GitHub
good first issue
Dominant language
Python
Stars
451
Forks
707
Avg merge
22h 59m
Merged PRs (30d)
91

Description

**Describe the bug**

`StaticSitemap.lastmod` (`backend/src/apps/sitemap/views/static.py`) maps each static route to a model so it can compute `lastmod` from that model's most recent `updated_at`. The `/repositories` route is listed in `BaseSitemap.STATIC_ROUTES` but is missing from the `path_to_model` mapping, so it falls through to the `datetime.now(UTC)` fallback that is meant for unknown paths.

As a result, the `/repositories` entry in the static sitemap reports the current time as its `lastmod` on every regeneration, instead of the latest repository update like the other seven routes.

**To Reproduce**

Steps to reproduce the behavior:

1. Generate the static sitemap.
2. Compare the `` value for `/repositories` against `/chapters`, `/projects`, etc.
3. `/repositories` shows the regeneration timestamp, while the other routes show their model's latest `updated_at`.

**Expected behavior**

`/repositories` should derive its `lastmod` from the most recently updated Repository (`Repository.objects.aggregate(Max("updated_at"))`), consistent with the other content routes. The `datetime.now(UTC)` fallback is only intended for paths that have no corresponding model (the existing test covers this with `/unknown-path`).

**Additional context**

The fix is to add `"/repositories": Repository` to the `path_to_model` dict (and import the model). A test asserting that every `STATIC_ROUTES` path maps to a model would prevent this from regressing.

**Are you going to work on fixing this?**

- [x] Yes
- [ ] No

Contributor guide

Open the contributing guide

Research direction

Start in backend/src/apps/sitemap/views/static.py and inspect StaticSitemap.lastmod, BaseSitemap.STATIC_ROUTES, and the path_to_model mapping. Run the existing sitemap test covering /unknown-path, then add coverage for /repositories and verify its lastmod comes from the latest Repository.updated_at rather than the regeneration time.

Written by the indexing model from the issue text.

Assessment

Tech stack
django, python
Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
85/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.