storytime 2.1.6 → 2.1.7

data/spec/lib/storytime/constraints/page_constraint_spec.rb

@@ -0,0 +1,40 @@
+require 'spec_helper'
+
+describe Storytime::Constraints::PageConstraint do
+  let(:site) { FactoryBot.create(:site) }
+  let(:constraint) { described_class.new }
+
+  def request_for(id)
+    instance_double("ActionDispatch::Request", params: { id: id }, host: site.custom_domain)
+  end
+
+  before do
+    Storytime::Site.current_id = site.id
+  end
+
+  after do
+    Storytime::Site.current_id = nil
+  end
+
+  it "matches an existing page slug" do
+    page = FactoryBot.create(:page, site: site)
+    expect(constraint.matches?(request_for(page.slug))).to be true
+  end
+
+  it "does not match an unknown slug" do
+    expect(constraint.matches?(request_for("no-such-page"))).to be false
+  end
+
+  context "with a path-traversal payload" do
+    let(:payload) { "a/../../../../../../../../etc/passwd" }
+
+    it "does not match" do
+      expect(constraint.matches?(request_for(payload))).to be false
+    end
+
+    it "never reaches the filesystem check" do
+      expect(File).not_to receive(:exist?)
+      constraint.matches?(request_for(payload))
+    end
+  end
+end

data/spec/lib/storytime_helpers_spec.rb

@@ -6,7 +6,7 @@ include Storytime::StorytimeHelpers
 describe "Storytime::StorytimeHelpers", :type => :helper do
   describe "storytime_snippet" do
     before(:each) do
-      @site = FactoryGirl.create(:site)
+      @site = FactoryBot.create(:site)
       expect_any_instance_of(Storytime::StorytimeHelpers).to receive(:current_storytime_site).at_least(:once).and_return(@site)
       expect_any_instance_of(ApplicationHelper).to receive(:logged_in_storytime_user?).at_least(:once).and_return(false)
     end
@@ -27,7 +27,7 @@ describe "Storytime::StorytimeHelpers", :type => :helper do
 
     describe "when snippet is found" do
       it "returns snippet partial" do
-        snippet = FactoryGirl.create(:snippet, site: @site)
+        snippet = FactoryBot.create(:snippet, site: @site)
         snippet_div = storytime_snippet(snippet.name)
 
         expect(snippet_div).to include(snippet.content)

data/spec/models/navigation_spec.rb

@@ -3,17 +3,17 @@ require 'spec_helper'
 describe Storytime::Navigation do
   describe "#handle" do
     it "parameterizes the title to set the handle" do
-      nav = FactoryGirl.create(:navigation, handle: nil)
+      nav = FactoryBot.create(:navigation, handle: nil)
       expect(nav.handle).to eq nav.name.parameterize
     end
 
     it "parameterizes the handle" do
-      nav = FactoryGirl.create(:navigation, handle: "my Handle")
+      nav = FactoryBot.create(:navigation, handle: "my Handle")
       expect(nav.handle).to eq "my-handle"
     end
 
     it "does not change the handle if the title changes" do
-      nav = FactoryGirl.create(:navigation, handle: "my Handle")
+      nav = FactoryBot.create(:navigation, handle: "my Handle")
       nav.update(name: "New Name")
       expect(nav.handle).to eq "my-handle"
     end

data/spec/models/post_spec.rb

@@ -7,11 +7,11 @@ describe Storytime::Post do
     after{ Storytime::BlogPost.instance_variable_set "@_to_partial_path", nil }
 
     it "includes site in the path" do
-      allow(File).to receive(:exists?).and_return(true)
+      allow(File).to receive(:exist?).and_return(true)
+
+      site = FactoryBot.create(:site, title: "Test Site")
+      blog_post = FactoryBot.create(:post, site: site)
 
-      site = FactoryGirl.create(:site, title: "Test Site")
-      blog_post = FactoryGirl.create(:post, site: site)
-      
       partial_path = blog_post.to_partial_path
       expect(partial_path).to eq("storytime/test-site/blog_posts/blog_post")
       Storytime::BlogPost.instance_variable_set "@_to_partial_path", nil
@@ -20,7 +20,7 @@ describe Storytime::Post do
     it "looks up the inheritance chain" do
       allow(File).to receive(:exists?).and_return(false)
 
-      site = FactoryGirl.build(:site, title: "Test Site")
+      site = FactoryBot.build(:site, title: "Test Site")
       video_post = VideoPost.new(site: site)
       partial_path = video_post.to_partial_path
       expect(partial_path).to eq("storytime/posts/post")
@@ -28,60 +28,60 @@ describe Storytime::Post do
   end
 
   it "sets the page slug on create" do
-    post = FactoryGirl.create(:post)
-    post.slug.should == post.title.parameterize
+    post = FactoryBot.create(:post)
+    expect(post.slug).to eq(post.title.parameterize)
   end
 
   it "sets slug to user inputted value" do
-    post = FactoryGirl.create(:post)
+    post = FactoryBot.create(:post)
 
     post.slug = "random slug here"
     post.save
 
-    post.slug.should == "random-slug-here"
+    expect(post.slug).to eq("random-slug-here")
   end
 
   it "does not allow the same slug" do
-    post_1 = FactoryGirl.create(:post)
-    post_2 = FactoryGirl.create(:post)
+    post_1 = FactoryBot.create(:post)
+    post_2 = FactoryBot.create(:post)
 
     post_2.slug = post_1.slug
     post_2.save
 
-    post_2.slug.should_not == post_1.slug
-    post_2.slug.should include(post_1.slug)
+    expect(post_2.slug).to_not eq(post_1.slug)
+    expect(post_2.slug).to include(post_1.slug)
   end
 
   it "does not allow a blank slug" do
-    post = FactoryGirl.create(:post)
+    post = FactoryBot.create(:post)
     post.slug = ""
     post.save
 
-    post.slug.should_not == ""
-    post.slug.should == post.title.parameterize
+    expect(post.slug).to_not eq("")
+    expect(post.slug).to eq(post.title.parameterize)
   end
 
   it "creates tags from tag_list attribute" do
-    post = FactoryGirl.create(:post)
+    post = FactoryBot.create(:post)
     post.tag_list = ["tag1", "tag2"]
-    post.tags.count.should == 2
+    expect(post.tags.count).to eq(2)
   end
 
   it "scopes posts by tag" do
-    post_1 = FactoryGirl.create(:post, tag_list: ["tag1", "tag2"])
-    post_2 = FactoryGirl.create(:post, tag_list: ["tag1"])
+    post_1 = FactoryBot.create(:post, tag_list: ["tag1", "tag2"])
+    post_2 = FactoryBot.create(:post, tag_list: ["tag1"])
 
-    Storytime::Post.tagged_with("tag1").should include(post_1)
-    Storytime::Post.tagged_with("tag1").should include(post_2)
-    Storytime::Post.tagged_with("tag2").should include(post_1)
-    Storytime::Post.tagged_with("tag2").should_not include(post_2)
+    expect(Storytime::Post.tagged_with("tag1")).to include(post_1)
+    expect(Storytime::Post.tagged_with("tag1")).to include(post_2)
+    expect(Storytime::Post.tagged_with("tag2")).to include(post_1)
+    expect(Storytime::Post.tagged_with("tag2")).to_not include(post_2)
   end
 
   it "counts tags across posts" do
-    post_1 = FactoryGirl.create(:post, tag_list: ["tag1", "tag2"])
-    post_2 = FactoryGirl.create(:post, tag_list: ["tag1"])
+    post_1 = FactoryBot.create(:post, tag_list: ["tag1", "tag2"])
+    post_2 = FactoryBot.create(:post, tag_list: ["tag1"])
 
-    Storytime::Post.tag_counts.find_by(name: "tag1").count.should == 2
-    Storytime::Post.tag_counts.find_by(name: "tag2").count.should == 1
+    expect(Storytime::Post.tag_counts.find_by(name: "tag1").count).to eq(2)
+    expect(Storytime::Post.tag_counts.find_by(name: "tag2").count).to eq(1)
   end
-end
+end

data/spec/models/snippet_spec.rb

@@ -0,0 +1,31 @@
+require 'spec_helper'
+
+describe Storytime::Snippet do
+  describe "#sanitize_content" do
+    it "strips script-bearing attributes from content on save" do
+      snippet = FactoryBot.create(:snippet, content: %(<img src=x onerror="alert(1)">))
+      expect(snippet.content).to_not include("onerror")
+    end
+
+    it "strips <script> tags from content on save" do
+      snippet = FactoryBot.create(:snippet, content: %(hello<script>alert(1)</script>))
+      expect(snippet.content).to_not include("<script")
+    end
+
+    it "re-sanitizes content on update" do
+      snippet = FactoryBot.create(:snippet, content: "safe")
+      snippet.update(content: %(<a href="javascript:alert(1)">x</a>))
+      expect(snippet.content).to_not include("javascript:")
+    end
+
+    it "preserves allowed markup" do
+      snippet = FactoryBot.create(:snippet, content: %(<p>hello <strong>world</strong></p>))
+      expect(snippet.content).to include("<strong>world</strong>")
+    end
+
+    it "leaves plain text unchanged" do
+      snippet = FactoryBot.create(:snippet, content: "just plain text")
+      expect(snippet.content).to eq("just plain text")
+    end
+  end
+end

data/spec/models/subscription_spec.rb

@@ -3,7 +3,7 @@ require 'spec_helper'
 describe Storytime::Subscription do
   describe "generate_token" do
     it "generates a token before creation" do
-      subscription = FactoryGirl.build(:subscription)
+      subscription = FactoryBot.build(:subscription)
 
       expect(subscription.token).to eq(nil)
 
@@ -13,10 +13,10 @@ describe Storytime::Subscription do
     end
 
     it "generates a token that can be regenerated from the email" do
-      subscription = FactoryGirl.create(:subscription)
+      subscription = FactoryBot.create(:subscription)
       token = subscription.token
 
-      key = Rails.application.secrets.secret_key_base
+      key = Rails.application.secret_key_base
       digest = OpenSSL::Digest.new('sha1')
       regenerated_token = OpenSSL::HMAC.hexdigest(digest, key, subscription.email)
 
@@ -26,7 +26,7 @@ describe Storytime::Subscription do
 
   describe "unsubscribe!" do
     it "sets subscribed to false" do
-      subscription = FactoryGirl.create(:subscription)
+      subscription = FactoryBot.create(:subscription)
 
       expect(subscription.subscribed?).to eq(true)
 

data/spec/models/tagging_spec.rb

@@ -2,28 +2,28 @@ require 'spec_helper'
 
 describe Storytime::Tagging do
   it "unused tags remain after deleting a post" do
-    post_1 = FactoryGirl.create(:post, tag_list: ["tag1", "tag2"])
-    post_2 = FactoryGirl.create(:post, tag_list: ["tag1"])
-    Storytime::Tag.all.count.should == 2
+    post_1 = FactoryBot.create(:post, tag_list: ["tag1", "tag2"])
+    post_2 = FactoryBot.create(:post, tag_list: ["tag1"])
+    expect(Storytime::Tag.all.count).to eq(2)
     post_1.destroy
-    Storytime::Tag.all.count.should == 2
+    expect(Storytime::Tag.all.count).to eq(2)
     post_2.destroy
-    Storytime::Tag.all.count.should == 2
+    expect(Storytime::Tag.all.count).to eq(2)
   end
 
   it "does not remove unused tags after updating tag list" do
-    post_1 = FactoryGirl.create(:post, tag_list: ["tag1", "tag2"])
-    Storytime::Tag.all.count.should == 2
+    post_1 = FactoryBot.create(:post, tag_list: ["tag1", "tag2"])
+    expect(Storytime::Tag.all.count).to eq(2)
     post_1.update(tag_list: ["tag1"])
-    Storytime::Tag.all.count.should == 2
-    post_1.tags.count.should == 1
+    expect(Storytime::Tag.all.count).to eq(2)
+    expect(post_1.tags.count).to eq(1)
   end
 
   it "does not removes tags used by other posts after updating tag list" do
-    post_1 = FactoryGirl.create(:post, tag_list: ["tag1", "tag2"])
-    post_2 = FactoryGirl.create(:post, tag_list: ["tag2"])
-    Storytime::Tag.all.count.should == 2
+    post_1 = FactoryBot.create(:post, tag_list: ["tag1", "tag2"])
+    post_2 = FactoryBot.create(:post, tag_list: ["tag2"])
+    expect(Storytime::Tag.all.count).to eq(2)
     post_1.update(tag_list: ["tag1"])
-    Storytime::Tag.all.count.should == 2
+    expect(Storytime::Tag.all.count).to eq(2)
   end
-end
+end

data/spec/models/version_spec.rb

@@ -3,55 +3,55 @@ require 'spec_helper'
 describe Storytime::Version do
 
   it "creates a version when creating a Post" do
-    Storytime::Version.all.count.should == 0
-    user = FactoryGirl.create(:user)
-    post = FactoryGirl.create(:post, published_at: nil, user: user, draft_user_id: user.id, draft_content: "Testing 123")
-    post.should_not be_published
-    Storytime::Version.all.count.should == 1
-    post.latest_version.should == Storytime::Version.last
-    post.latest_version.content.should == "Testing 123"
-    post.latest_version.user.should == user
+    expect(Storytime::Version.all.count).to eq(0)
+    user = FactoryBot.create(:user)
+    post = FactoryBot.create(:post, published_at: nil, user: user, draft_user_id: user.id, draft_content: "Testing 123")
+    expect(post).to_not be_published
+    expect(Storytime::Version.all.count).to eq(1)
+    expect(post.latest_version).to eq(Storytime::Version.last)
+    expect(post.latest_version.content).to eq("Testing 123")
+    expect(post.latest_version.user).to eq(user)
   end
 
   it "publishes a post with latest_version content" do
-    user = FactoryGirl.create(:user)
-    post = FactoryGirl.create(:post, published_at: nil, user: user, draft_user_id: user.id, draft_content: "Testing 123")
-    post.should_not be_published
-    post.content.should_not == "Testing 123"
+    user = FactoryBot.create(:user)
+    post = FactoryBot.create(:post, published_at: nil, user: user, draft_user_id: user.id, draft_content: "Testing 123")
+    expect(post).to_not be_published
+    expect(post.content).to_not eq("Testing 123")
     post.publish!
-    post.should be_published
-    post.content.should == "Testing 123"
+    expect(post).to be_published
+    expect(post.content).to eq("Testing 123")
   end
 
   it "returns the latest version content as draft_content" do
-    user = FactoryGirl.create(:user)
-    post = FactoryGirl.create(:post, published_at: nil, user: user, draft_user_id: user.id, draft_content: "Testing 123")
+    user = FactoryBot.create(:user)
+    post = FactoryBot.create(:post, published_at: nil, user: user, draft_user_id: user.id, draft_content: "Testing 123")
     post.reload
-    post.draft_content.should == post.latest_version.content
+    expect(post.draft_content).to eq(post.latest_version.content)
   end
 
   it "does not create a version when content does not change" do
-    post = FactoryGirl.create(:post, published_at: nil, draft_content: "Testing 123")
-    Storytime::Version.all.count.should == 1
+    post = FactoryBot.create(:post, published_at: nil, draft_content: "Testing 123")
+    expect(Storytime::Version.all.count).to eq(1)
     post.update(excerpt: "New Excerpt")
-    Storytime::Version.all.count.should == 1
+    expect(Storytime::Version.all.count).to eq(1)
   end
 
   it "creates a version when content is updated" do
-    post = FactoryGirl.create(:post, draft_content: "Testing 123")
-    Storytime::Version.all.count.should == 1
+    post = FactoryBot.create(:post, draft_content: "Testing 123")
+    expect(Storytime::Version.all.count).to eq(1)
     post.update(draft_content: "New Content")
-    Storytime::Version.all.count.should == 2
-    post.content.should == "New Content"
+    expect(Storytime::Version.all.count).to eq(2)
+    expect(post.content).to eq("New Content")
   end
 
   it "reverts to a previous version" do
-    user = FactoryGirl.create(:user)
-    post = FactoryGirl.create(:post, user: user)
+    user = FactoryBot.create(:user)
+    post = FactoryBot.create(:post, user: user)
     version1 = Storytime::Version.last
     post.update(draft_content: "New Content", draft_user_id: user.id)
-    post.content.should == "New Content"
+    expect(post.content).to eq("New Content")
     post.update(draft_version_id: version1.id)
-    post.content.should == version1.content
+    expect(post.content).to eq(version1.content)
   end
-end
+end

data/spec/policies/comment_policy_spec.rb

@@ -2,8 +2,8 @@ require 'spec_helper'
 
 describe Storytime::CommentPolicy do
   subject { Storytime::CommentPolicy.new(user, comment) }
-  let(:site) { FactoryGirl.create(:site) }
-  let(:post) { FactoryGirl.create(:post) }
+  let(:site) { FactoryBot.create(:site) }
+  let(:post) { FactoryBot.create(:post) }
 
   context "as a normal user" do
     before do
@@ -11,10 +11,10 @@ describe Storytime::CommentPolicy do
       allow_any_instance_of(Storytime.user_class).to receive(:storytime_editor?).and_return(false)
     end
 
-    let(:user) { FactoryGirl.create(:user) }
+    let(:user) { FactoryBot.create(:user) }
 
     context "a comment owned by the user" do
-      let(:comment) { FactoryGirl.build(:comment, user: user, post: post, site: site) }
+      let(:comment) { FactoryBot.build(:comment, user: user, post: post, site: site) }
 
       it { should permit!(:create)  }
       it { should permit!(:destroy)  }
@@ -22,7 +22,7 @@ describe Storytime::CommentPolicy do
 
 
     context "a comment not owned by the user" do
-      let(:comment) { FactoryGirl.build(:comment, post: post, site: site) }
+      let(:comment) { FactoryBot.build(:comment, post: post, site: site) }
 
       it { should_not permit!(:create)  }
       it { should_not permit!(:destroy)  }
@@ -35,17 +35,17 @@ describe Storytime::CommentPolicy do
       allow_any_instance_of(Storytime.user_class).to receive(:storytime_editor?).and_return(true)
     end
 
-    let(:user){ FactoryGirl.create(:editor) }
+    let(:user){ FactoryBot.create(:editor) }
 
     context "a comment owned by the user" do
-      let(:comment) { FactoryGirl.build(:comment, user: user, post: post, site: site) }
+      let(:comment) { FactoryBot.build(:comment, user: user, post: post, site: site) }
 
       it { should permit!(:create)  }
       it { should permit!(:destroy)  }
     end
 
     context "a comment not owned by the user" do
-      let(:comment) { FactoryGirl.build(:comment, post: post, site: site) }
+      let(:comment) { FactoryBot.build(:comment, post: post, site: site) }
 
       it { should_not permit!(:create)  }
       it { should permit!(:destroy)  }
@@ -57,17 +57,17 @@ describe Storytime::CommentPolicy do
       allow_any_instance_of(Storytime.user_class).to receive(:storytime_admin?).and_return(true)
       allow_any_instance_of(Storytime.user_class).to receive(:storytime_editor?).and_return(false)
     end
-    let(:user){ FactoryGirl.create(:admin) }
+    let(:user){ FactoryBot.create(:admin) }
 
     context "a comment owned by the user" do
-      let(:comment) { FactoryGirl.build(:comment, user: user, post: post, site: site) }
+      let(:comment) { FactoryBot.build(:comment, user: user, post: post, site: site) }
 
       it { should permit!(:create)  }
       it { should permit!(:destroy)  }
     end
 
     context "a comment not owned by the user" do
-      let(:comment) { FactoryGirl.build(:comment, post: post, site: site) }
+      let(:comment) { FactoryBot.build(:comment, post: post, site: site) }
 
       it { should_not permit!(:create)  }
       it { should permit!(:destroy)  }

data/spec/policies/post_policy_spec.rb

@@ -5,7 +5,7 @@ require 'spec_helper'
 describe Storytime::PostPolicy do
   subject { Storytime::PostPolicy.new(user, post) }
 
-  let(:site) { FactoryGirl.create(:site) }
+  let(:site) { FactoryBot.create(:site) }
   before do
     site.save_with_seeds(user)
     allow(Storytime::Site).to receive(:current).and_return(site)
@@ -17,17 +17,17 @@ describe Storytime::PostPolicy do
       allow_any_instance_of(Storytime.user_class).to receive(:storytime_role_in_site).and_return(Storytime::Role.find_by(name: "writer"))
     end
 
-    let(:user) { FactoryGirl.create(:writer) }
+    let(:user) { FactoryBot.create(:writer) }
 
     context "creating a new post" do
-      let(:post) { FactoryGirl.build(:post, user: user) }
+      let(:post) { FactoryBot.build(:post, user: user) }
 
       it { should permit!(:new)     }
       it { should permit!(:create)  }
     end
     
     context "who owns the post" do
-      let(:post) { FactoryGirl.build_stubbed :post, user: user }
+      let(:post) { FactoryBot.build_stubbed :post, user: user }
 
       it { should permit!(:index)   }
       it { should permit!(:manage)  } # edit, update, destroy
@@ -35,7 +35,7 @@ describe Storytime::PostPolicy do
     end
     
     context "who does not own the post" do
-      let(:post) { FactoryGirl.build_stubbed :post, user: FactoryGirl.build(:user) }
+      let(:post) { FactoryBot.build_stubbed :post, user: FactoryBot.build(:user) }
 
       it { should     permit!(:index)   }
       it { should_not permit!(:manage)  } # edit, update, destroy
@@ -48,17 +48,17 @@ describe Storytime::PostPolicy do
       allow_any_instance_of(Storytime.user_class).to receive(:storytime_role).and_return(Storytime::Role.find_by(name: "editor"))
     end
 
-    let(:user) { FactoryGirl.create(:editor) }
+    let(:user) { FactoryBot.create(:editor) }
 
     context "creating a new post" do
-      let(:post) { FactoryGirl.build(:post, user: user) }
+      let(:post) { FactoryBot.build(:post, user: user) }
 
       it { should permit!(:new)     }
       it { should permit!(:create)  }
     end
     
     context "who owns the post" do
-      let(:post) { FactoryGirl.build_stubbed :post, user: user }
+      let(:post) { FactoryBot.build_stubbed :post, user: user }
 
       it { should permit!(:index)   }
       it { should permit!(:manage)  } # edit, update, destroy
@@ -66,7 +66,7 @@ describe Storytime::PostPolicy do
     end
     
     context "who does not own the post" do
-      let(:post) { FactoryGirl.build_stubbed :post, user: FactoryGirl.build(:user) }
+      let(:post) { FactoryBot.build_stubbed :post, user: FactoryBot.build(:user) }
 
       it { should permit!(:index)   }
       it { should permit!(:manage)  } # edit, update, destroy
@@ -79,17 +79,17 @@ describe Storytime::PostPolicy do
       allow_any_instance_of(Storytime.user_class).to receive(:storytime_role).and_return(Storytime::Role.find_by(name: "admin"))
     end
 
-    let(:user) { FactoryGirl.create(:admin) }
+    let(:user) { FactoryBot.create(:admin) }
 
     context "creating a new post" do
-      let(:post) { FactoryGirl.build(:post, user: user) }
+      let(:post) { FactoryBot.build(:post, user: user) }
 
       it { should permit!(:new)     }
       it { should permit!(:create)  }
     end
     
     context "who owns the post" do
-      let(:post) { FactoryGirl.build_stubbed :post, user: user }
+      let(:post) { FactoryBot.build_stubbed :post, user: user }
 
       it { should permit!(:index)   }
       it { should permit!(:manage)  } # edit, update, destroy
@@ -97,7 +97,7 @@ describe Storytime::PostPolicy do
     end
     
     context "who does not own the post" do
-      let(:post) { FactoryGirl.build_stubbed :post, user: FactoryGirl.build(:user) }
+      let(:post) { FactoryBot.build_stubbed :post, user: FactoryBot.build(:user) }
 
       it { should permit!(:index)   }
       it { should permit!(:manage)  } # edit, update, destroy

data/spec/requests/pages_spec.rb

@@ -0,0 +1,37 @@
+require 'spec_helper'
+
+# Request spec rather than controller spec so we go through the real engine
+# routes – the bug only manifests after the route's PageConstraint admits the
+# request to the controller.
+describe "Pages", type: :request do
+  let(:user) { FactoryBot.create(:admin) }
+  let!(:site) do
+    s = FactoryBot.create(:site, custom_domain: "www.example.com")
+    s.save_with_seeds(user)
+    s
+  end
+
+  before do
+    # Force the route's PageConstraint to admit the request so we can exercise
+    # the controller for ids the constraint would normally reject (like the
+    # leading-slash slugs that bots probe).
+    allow_any_instance_of(Storytime::Constraints::PageConstraint)
+      .to receive(:matches?).and_return(true)
+  end
+
+  describe "GET /:id when no page or slug-specific template matches" do
+    it "404s instead of falling through to a show template that requires @page" do
+      get "http://www.example.com/no-such-page"
+      expect(response).to have_http_status(:not_found)
+    end
+
+    it "404s for malformed ids with a leading slash" do
+      # Bots hit URL-encoded paths like /%2Fcontact. The PageConstraint can let
+      # these through because POSIX collapses // in File.exist?, but the
+      # template resolver does not, so the controller must 404 explicitly
+      # rather than rendering the @page-dependent show template.
+      get "http://www.example.com/%2Fno-such-page"
+      expect(response).to have_http_status(:not_found)
+    end
+  end
+end