"""The server-rendered SEO layer.
ProductVariant names come from retailer feeds, which makes them untrusted input into
our own HTML head -- the escaping cases here are load-bearing, not pedantry.
"""
import json
import re
from app.services.seo import (
DEFAULT_TITLE,
Head,
parse_product_slug,
product_path,
public_base,
slugify,
)
SHELL = (
""
f"{DEFAULT_TITLE}"
''
""
)
class TestSlugs:
def test_accents_flatten(self):
assert slugify("Rémy Martin XO 1L") == "remy-martin-xo-1l"
def test_roundtrip(self):
path = product_path(60, "Johnnie Walker Blue Label 1L")
assert path == "/products/johnnie-walker-blue-label-1l-60"
assert parse_product_slug(path.rsplit("/", 1)[-1]) == 60
def test_bare_numeric_still_resolves(self):
"""Old /products/60 links keep working (and then 301 to the slug)."""
assert parse_product_slug("60") == 60
def test_no_id_means_no_product(self):
assert parse_product_slug("just-words") is None
def test_empty_name_still_produces_a_slug(self):
assert product_path(7, "???") == "/products/product-7"
class TestHeadInjection:
def test_title_and_description_are_replaced_not_duplicated(self):
page = Head("My Title", "My description", canonical_path="/x").apply(
SHELL, "https://example.com"
)
assert "My Title" in page
assert page.count("") == 1
assert 'content="My description"' in page
assert "old description" not in page
def test_canonical_and_og_are_absolute(self):
page = Head("T", "D", canonical_path="/products/x-1").apply(SHELL, "https://example.com")
assert '<link rel="canonical" href="https://example.com/products/x-1" />' in page
assert '<meta property="og:url" content="https://example.com/products/x-1" />' in page
def test_noindex_pages_say_so(self):
page = Head("T", "D", noindex=True).apply(SHELL, "https://example.com")
assert '<meta name="robots" content="noindex, nofollow" />' in page
def test_html_in_a_product_name_is_escaped(self):
"""A feed name like 'Gin <b>"Special"</b>' must not become markup."""
page = Head('Gin <b>"Special"</b>', 'A & B').apply(SHELL, "https://example.com")
assert "<b>" not in page.split("<title>")[1].split("")[0]
assert "<b>" in page
assert "A & B" in page
def test_jsonld_cannot_break_out_of_its_script_tag(self):
"""The classic: a value containing must stay inert."""
page = Head("T", "D", jsonld=[{"name": 'x', page).group(1)
assert json.loads(blob)["name"] == "Rémy Martin XO"
class TestPublicBase:
def test_public_hosts_are_https(self):
assert public_base("dutyfreeprofessor.demoing.info") == "https://dutyfreeprofessor.demoing.info"
def test_internal_hosts_are_http(self):
assert public_base("172.17.0.1:3149") == "http://172.17.0.1:3149"
def test_garbage_hosts_yield_nothing(self):
"""A hostile Host header must not be reflected into canonicals."""
assert public_base('evil">