OWASP / OWASP/Nest

Snapshot sitemap URLs point to /snapshots but the route is /community/snapshots

Open
#5,349 1 comment 0 reactions 1 assignee Claimed by @anshul23102 View on GitHub
Dominant language
Python
Stars
451
Forks
707
Avg merge
22h 59m
Merged PRs (30d)
91

Description

**Describe the bug**

Every snapshot URL published in the sitemap points at a route that does not exist, so all of them are 404s for crawlers.

`SnapshotSitemap.prefix` is `/snapshots` (`backend/src/apps/sitemap/views/snapshot.py`), and `BaseSitemap.location` builds detail URLs as `f"{self.prefix}/{obj.key}"`, producing `/snapshots/`. `/snapshots` is also listed in `BaseSitemap.STATIC_ROUTES` (`backend/src/apps/sitemap/views/base.py`) and mapped in `StaticSitemap.path_to_model` (`backend/src/apps/sitemap/views/static.py`).

The actual frontend routes are `/community/snapshots` and `/community/snapshots/[id]`. There is no `frontend/src/app/snapshots` directory, and `next.config` defines no `redirects()`, so nothing rewrites `/snapshots` to `/community/snapshots`.

Everything else in the app agrees on the `/community/snapshots` form:

- `frontend/src/utils/communityData.ts:49` links to `/community/snapshots`
- `frontend/src/app/community/snapshots/page.tsx:40` navigates to `/community/snapshots/${snapshot.key}`
- `frontend/src/app/community/snapshots/[id]/layout.tsx:21` declares `canonicalPath: /community/snapshots/${snapshotKey}`

So in addition to emitting 404s, the sitemap contradicts the canonical URL the snapshot detail page declares for itself, which is a conflicting signal to search engines.

This appears to date from when snapshots moved under `/community`; the sitemap prefix was not updated with the routes.

**To Reproduce**

Steps to reproduce the behavior:

1. Generate the sitemap and look at the snapshot entries.
2. They render as `/snapshots` and `/snapshots/`, for example `/snapshots/2026-07`.
3. Request either path against the frontend. Both 404.
4. Compare with the link the app itself uses from the Community page, `/community/snapshots/2026-07`, which resolves.

**Expected behavior**

Sitemap URLs for snapshots should match the routes that exist and the canonical paths the pages declare:

- static route `/community/snapshots`
- detail routes `/community/snapshots/`

**Are you going to work on fixing this?**

- [x] Yes
- [ ] No

**Additional context**

Why CI did not catch it: `backend/tests/unit/apps/sitemap/views/snapshot_test.py:32` asserts the current behaviour directly.

```python
assert sitemap.location(MagicMock(key="bar")) == "/snapshots/bar"
```

The test encodes the incorrect path, so the mismatch was locked in rather than flagged.

Proposed fix, which I would be happy to implement:

- Set `SnapshotSitemap.prefix` to `/community/snapshots`.
- Update the `/snapshots` entry in `BaseSitemap.STATIC_ROUTES` and the corresponding `StaticSitemap.path_to_model` key to `/community/snapshots`. These stay consistent with each other, so `get_static_priority` still resolves.
- Update `snapshot_test.py` to assert the corrected path.
- Add a regression test asserting that every entry in `STATIC_ROUTES` corresponds to a real frontend route, so a future route move fails CI instead of silently publishing 404s.

@arkid15r @kasya could you assign this to me?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.