Merge pull request #9629 from alphagov/validate-landing-page-base-path

Validate landing page base paths must start with /

app/models/landing_page.rb

@@ -4,7 +4,7 @@ class LandingPage < Edition
   include Edition::Images
 
   skip_callback :validation, :before, :update_document_slug
-  validates :base_path, presence: true
+  validates :base_path, presence: true, format: { with: /\A\/.*\z/, message: "must start with a slash (/)" }
   validate :base_path_must_not_be_taken
   validate :body_must_be_valid_yaml
 

test/functional/admin/landing_pages_controller_test.rb

@@ -47,7 +47,8 @@ class Admin::LandingPagesControllerTest < ActionController::TestCase
   end
 
   test "GET :edit fetches the supplied instance" do
-    page = create(:landing_page, organisations: [@organisation])
+    document = create(:document, slug: "/some-slug-starting-with-slash")
+    page = create(:landing_page, organisations: [@organisation], document:)
 
     get :edit, params: { id: page }
 
@@ -58,7 +59,8 @@ class Admin::LandingPagesControllerTest < ActionController::TestCase
 
   test "PUT :update changes the supplied instance with the supplied params" do
     attrs = attributes_for(:landing_page, title: "Hello there")
-    page = create(:landing_page, organisations: [@organisation], title: "Goodbye")
+    document = create(:document, slug: "/some-slug-starting-with-slash")
+    page = create(:landing_page, organisations: [@organisation], title: "Goodbye", document:)
 
     post :update, params: {
       id: page,
@@ -72,7 +74,8 @@ class Admin::LandingPagesControllerTest < ActionController::TestCase
 
   test "PUT :update doesn't save the new instance when the supplied params are invalid" do
     attrs = attributes_for(:landing_page, title: "")
-    page = create(:landing_page, organisations: [@organisation], title: "Goodbye")
+    document = create(:document, slug: "/some-slug-starting-with-slash")
+    page = create(:landing_page, organisations: [@organisation], title: "Goodbye", document:)
 
     post :update, params: { id: page, edition: attrs }
 

test/unit/app/models/landing_page_test.rb

@@ -20,6 +20,12 @@ class LandingPageTest < ActiveSupport::TestCase
     assert_equal :base_path, landing_page.errors.first.attribute
   end
 
+  test "landing-page is not valid if base_path does not start with a slash" do
+    document = build(:document, slug: "landing-page/test")
+    landing_page = build(:landing_page, document:, body: "blocks: []")
+    assert_not landing_page.valid?
+  end
+
   test "landing-page is valid if body is YAML with at least the blocks: element" do
     document = build(:document, slug: "/landing-page/test")
     landing_page = build(:landing_page, document:, body: "blocks:\nother:\n")