fix: strip non-XML output from feed response to prevent script tag injection

[ahuininga-orisha]

When third-party modules (such as the Stape server-side GTM module) attempt to set cookies or modify headers during a feed request, their output gets buffered in Magento's output buffer stack. When that buffer is eventually flushed, the garbage content (e.g. a <script> redirect tag) ends up prepended to the XML feed. Tweakwise then rejects the feed during import because the XML is no longer valid.

The fix clears all active output buffers immediately before streaming the feed, discarding any garbage already written by other modules, and then sets the Content-Type header explicitly. FeedContent writes directly to php://output bypassing PHP's OB layer, so the XML stream itself is unaffected — only the pre-feed buffered garbage is discarded.

Changes

File	What changed
Controller/Feed/Export.php	Drains all active output buffers with ob_end_clean() and sets Content-Type: application/xml explicitly before FeedContent streams the feed

---

How to test

Scenario 1 — Normal feed renders correctly without third-party interference

1. Clear cache: php bin/magento cache:clean
2. Visit the feed URL: https://{domain}/tweakwise/feed/export?key={feed_key}
3. Verify the response starts with <?xml version="1.0" encoding="UTF-8"?> and ends with </tweakwise>
4. Verify no <script> tags are present anywhere in the response

---

Scenario 2 — Feed renders correctly when a module outputs garbage before XML

1. Temporarily add echo "<script>alert(1)</script>"; at the top of Controller/Feed/Export.php::execute() before the ob_end_clean() loop to simulate a rogue module
2. Visit the feed URL
3. Verify the response still starts cleanly with <?xml — the injected script tag must not appear
4. Remove the temporary echo

---

Scenario 3 — Feed is valid XML and can be parsed

1. Download the feed: curl -o /tmp/feed.xml "https://{domain}/tweakwise/feed/export?key={feed_key}"
2. Validate: xmllint --noout /tmp/feed.xml — must exit with code 0 and no errors
3. Verify file size is comparable to previous exports (no content truncation)

---