"""Contract tests for landing page routes""" import pytest import os import yaml @pytest.fixture def test_products(app): """Create test products with various configurations""" with app.app_context(): products_dir = os.path.join(app.config['DATA_DIR'], 'products') # Product 1: Active with description product1_dir = os.path.join(products_dir, 'product-001') os.makedirs(product1_dir, exist_ok=True) with open(os.path.join(product1_dir, 'config.yaml'), 'w') as f: yaml.dump({ 'product_id': 'product-001', 'name': 'Zebra Product', 'submission_url_slug': 'zebra-product', 'owner_language': 'en', 'assigned_owner_ids': [], 'status': 'active', 'description': 'A product for testing' }, f) # Product 2: Active without description product2_dir = os.path.join(products_dir, 'product-002') os.makedirs(product2_dir, exist_ok=True) with open(os.path.join(product2_dir, 'config.yaml'), 'w') as f: yaml.dump({ 'product_id': 'product-002', 'name': 'Apple Product', 'submission_url_slug': 'apple-product', 'owner_language': 'en', 'assigned_owner_ids': [], 'status': 'active' }, f) # Product 3: Archived (should not appear) product3_dir = os.path.join(products_dir, 'product-003') os.makedirs(product3_dir, exist_ok=True) with open(os.path.join(product3_dir, 'config.yaml'), 'w') as f: yaml.dump({ 'product_id': 'product-003', 'name': 'Archived Product', 'submission_url_slug': 'archived-product', 'owner_language': 'en', 'assigned_owner_ids': [], 'status': 'archived', 'description': 'This product is archived' }, f) # Product 4: Active but missing slug (should not appear) product4_dir = os.path.join(products_dir, 'product-004') os.makedirs(product4_dir, exist_ok=True) with open(os.path.join(product4_dir, 'config.yaml'), 'w') as f: yaml.dump({ 'product_id': 'product-004', 'name': 'No Slug Product', 'submission_url_slug': '', 'owner_language': 'en', 'assigned_owner_ids': [], 'status': 'active', 'description': 'Product with missing slug' }, f) # Product 5: XSS test product product5_dir = os.path.join(products_dir, 'product-005') os.makedirs(product5_dir, exist_ok=True) with open(os.path.join(product5_dir, 'config.yaml'), 'w') as f: yaml.dump({ 'product_id': 'product-005', 'name': 'Evil Product', 'submission_url_slug': 'xss-product', 'owner_language': 'en', 'assigned_owner_ids': [], 'status': 'active', 'description': 'Malicious description' }, f) yield @pytest.mark.contract def test_get_landing_page_with_products(client, test_products): """T002: GET / with active products returns 200 with product list HTML""" response = client.get('/') assert response.status_code == 200 assert b'' not in html, "Script tag not escaped in product name" assert 'alert("xss")' not in html or '<script>' in html, "XSS vulnerability in product name" # Image onerror should be escaped assert '