+ - {{.Title}} + {{.SafeTitle}} - + {{if .FaviconIconURL}} + + {{end}} {{.URL}} - {{.Engine}} + {{.Engine}} {{if .Content}} - {{.Content}} + {{.SafeContent}} {{end}} {{end}} diff --git a/internal/views/templates/results.html b/internal/views/templates/results.html index 7010a3a..f601a03 100644 --- a/internal/views/templates/results.html +++ b/internal/views/templates/results.html @@ -1,46 +1,43 @@ {{define "title"}}{{if .Query}}{{.Query}} — {{end}}{{end}} {{define "content"}} - - - - - - - - - - - - + + + + + + + + + samsa + + + + {{if and .ActiveCategory (ne .ActiveCategory "all")}} + + {{end}} + + + + + + + + + - - - {{template "results_inner" .}} + + All + General + IT + News + Images - - + + {{template "results_inner" .}} + {{end}} diff --git a/internal/views/templates/results_inner.html b/internal/views/templates/results_inner.html index 0f9450a..0dac375 100644 --- a/internal/views/templates/results_inner.html +++ b/internal/views/templates/results_inner.html @@ -1,24 +1,52 @@ {{define "results_inner"}} {{if .Corrections}} -{{range .Corrections}}{{.}} {{end}} +{{range .Corrections}}{{.}} {{end}} {{end}} -{{if or .Answers .Infoboxes}} - - {{range .Answers}} - {{.}} - {{end}} +{{if .Infoboxes}} + {{range .Infoboxes}} - - {{if .title}}{{.title}}{{end}} - {{if .content}}{{.content}}{{end}} - {{if .img_src}}{{end}} - + {{end}} {{end}} - +{{if .UnresponsiveEngines}} + + + Some search engines had errors + + {{range .UnresponsiveEngines}} + + {{index . 0}} + {{index . 1}} + + {{end}} + + + +{{end}} + +{{if .Answers}} + + {{range .Answers}} + {{.}} + {{end}} + +{{end}} + + {{if .NumberOfResults}} {{.NumberOfResults}} results {{end}} @@ -26,16 +54,28 @@ {{if .Results}} + {{if .IsImageSearch}} + + {{range .Results}} + {{if eq .Template "images"}} + {{template "image_item" .}} + {{end}} + {{end}} + + {{else}} {{range .Results}} {{if eq .Template "videos"}} {{template "video_item" .}} + {{else if eq .Template "images"}} + {{template "image_item" .}} {{else}} {{template "result_item" .}} {{end}} {{end}} - {{else if not .Answers}} + {{end}} + {{else if and (not .Answers) (not .Infoboxes)}} - 🔍 + 🔍 No results found Try different keywords or check your spelling. @@ -43,40 +83,26 @@ {{if .Pageno}} - + {{if gt .Pageno 1}} - - - - ← Prev - + ← Prev {{end}} {{range .PageNumbers}} {{if .IsCurrent}} - {{.Num}} + {{.Num}} {{else}} - - - - {{.Num}} - + {{.Num}} {{end}} {{end}} {{if .HasNext}} - - - - Next → - + Next → {{end}} {{end}} - - ↑ Back to top + + ↑ Back to top - -Searching… {{end}} diff --git a/internal/views/templates/video_item.html b/internal/views/templates/video_item.html index b94c061..1d0601a 100644 --- a/internal/views/templates/video_item.html +++ b/internal/views/templates/video_item.html @@ -1,5 +1,5 @@ {{define "video_item"}} - + {{if .Thumbnail}} @@ -9,13 +9,19 @@ {{end}} - {{.Title}} + {{.SafeTitle}} - youtube + {{if .FaviconIconURL}} + + {{end}} + {{if .URL}} + {{.URL}} + {{end}} + {{.Engine}} {{if .Content}} - {{.Content}} + {{.SafeContent}} {{end}} diff --git a/internal/views/views.go b/internal/views/views.go index 4d7289c..ee84d70 100644 --- a/internal/views/views.go +++ b/internal/views/views.go @@ -1,4 +1,4 @@ -// kafka — a privacy-respecting metasearch engine +// samsa — a privacy-respecting metasearch engine // Copyright (C) 2026-present metamorphosis-dev // // This program is free software: you can redistribute it and/or modify @@ -18,13 +18,17 @@ package views import ( "embed" + "encoding/xml" + "html" "html/template" "io/fs" "net/http" + "net/url" "strconv" "strings" - "github.com/metamorphosis-dev/kafka/internal/contracts" + "github.com/metamorphosis-dev/samsa/internal/contracts" + "github.com/metamorphosis-dev/samsa/internal/util" ) //go:embed all:templates @@ -50,6 +54,19 @@ type PageData struct { UnresponsiveEngines [][2]string PageNumbers []PageNumber ShowHeader bool + IsImageSearch bool + // Theme is the user's selected theme (light/dark) from cookie + Theme string + FaviconService string + // New fields for three-column layout + Categories []string + CategoryIcons map[string]string + DisabledCategories []string + ActiveCategory string + TimeFilters []FilterOption + TypeFilters []FilterOption + ActiveTime string + ActiveType string } // ResultView is a template-friendly wrapper around a MainResult. @@ -58,12 +75,20 @@ type ResultView struct { // TemplateName is the actual template to dispatch to, computed from Template. // "videos" maps to "video_item", everything else maps to "result_item". TemplateName string + // Domain is the hostname extracted from the result URL, used for favicon proxying. + Domain string + // FaviconIconURL is the resolved favicon image URL for the user's favicon preference (empty = hide). + FaviconIconURL string + // SafeTitle and SafeContent are HTML-unescaped versions for rendering. + // The API returns HTML entities which Go templates escape by default. + SafeTitle template.HTML + SafeContent template.HTML } // PageNumber represents a numbered pagination button. type PageNumber struct { - Num int - IsCurrent bool + Num int + IsCurrent bool } // InfoboxView is a template-friendly infobox. @@ -71,12 +96,20 @@ type InfoboxView struct { Title string Content string ImgSrc string + URL string +} + +// FilterOption represents a filter radio option for the sidebar. +type FilterOption struct { + Label string + Value string } var ( - tmplFull *template.Template - tmplIndex *template.Template - tmplFragment *template.Template + tmplFull *template.Template + tmplIndex *template.Template + tmplFragment *template.Template + tmplPreferences *template.Template ) func init() { @@ -88,13 +121,16 @@ func init() { } tmplFull = template.Must(template.New("").Funcs(funcMap).ParseFS(tmplFS, - "base.html", "results.html", "results_inner.html", "result_item.html", "video_item.html", + "base.html", "results.html", "results_inner.html", "result_item.html", "video_item.html", "image_item.html", )) tmplIndex = template.Must(template.New("").Funcs(funcMap).ParseFS(tmplFS, "base.html", "index.html", )) tmplFragment = template.Must(template.New("").Funcs(funcMap).ParseFS(tmplFS, - "results_inner.html", "result_item.html", "video_item.html", + "results.html", "results_inner.html", "result_item.html", "video_item.html", "image_item.html", + )) + tmplPreferences = template.Must(template.New("").Funcs(funcMap).ParseFS(tmplFS, + "base.html", "preferences.html", )) } @@ -103,25 +139,90 @@ func StaticFS() (fs.FS, error) { return fs.Sub(staticFS, "static") } -// OpenSearchXML returns the OpenSearch description XML with {baseUrl} -// replaced by the provided base URL. +// OpenSearchXML returns the OpenSearch description XML with the base URL +// safely embedded via xml.EscapeText (no raw string interpolation). func OpenSearchXML(baseURL string) ([]byte, error) { tmplFS, _ := fs.Sub(templatesFS, "templates") data, err := fs.ReadFile(tmplFS, "opensearch.xml") if err != nil { return nil, err } - result := strings.ReplaceAll(string(data), "{baseUrl}", baseURL) + + var buf strings.Builder + xml.Escape(&buf, []byte(baseURL)) + escapedBaseURL := buf.String() + + result := strings.ReplaceAll(string(data), "{baseUrl}", escapedBaseURL) return []byte(result), nil } +// faviconIconURL returns a safe img src for the given service and hostname, or "" for none/invalid. +func faviconIconURL(service, domain string) string { + domain = strings.TrimSpace(domain) + if domain == "" { + return "" + } + switch service { + case "google": + return "https://www.google.com/s2/favicons?domain=" + url.QueryEscape(domain) + "&sz=32" + case "duckduckgo": + return "https://icons.duckduckgo.com/ip3/" + domain + ".ico" + case "self": + return "/favicon/" + domain + default: + return "" + } +} + // FromResponse builds PageData from a search response and request params. -func FromResponse(resp contracts.SearchResponse, query string, pageno int) PageData { +func FromResponse(resp contracts.SearchResponse, query string, pageno int, activeCategory, activeTime, activeType, faviconService string) PageData { + // Set defaults + if activeCategory == "" { + activeCategory = "all" + } + pd := PageData{ Query: query, Pageno: pageno, NumberOfResults: resp.NumberOfResults, UnresponsiveEngines: resp.UnresponsiveEngines, + FaviconService: faviconService, + + // New: categories with icons + Categories: []string{"all", "news", "images", "videos", "maps"}, + DisabledCategories: []string{"shopping", "music", "weather"}, + CategoryIcons: map[string]string{ + "all": "🌐", + "news": "📰", + "images": "🖼️", + "videos": "🎬", + "maps": "🗺️", + "shopping": "🛒", + "music": "🎵", + "weather": "🌤️", + }, + ActiveCategory: activeCategory, + IsImageSearch: activeCategory == "images", + + // Time filters + TimeFilters: []FilterOption{ + {Label: "Any time", Value: ""}, + {Label: "Past hour", Value: "h"}, + {Label: "Past 24 hours", Value: "d"}, + {Label: "Past week", Value: "w"}, + {Label: "Past month", Value: "m"}, + {Label: "Past year", Value: "y"}, + }, + ActiveTime: activeTime, + + // Type filters + TypeFilters: []FilterOption{ + {Label: "All results", Value: ""}, + {Label: "News", Value: "news"}, + {Label: "Videos", Value: "video"}, + {Label: "Images", Value: "image"}, + }, + ActiveType: activeType, } // Convert results. @@ -131,7 +232,24 @@ func FromResponse(resp contracts.SearchResponse, query string, pageno int) PageD if r.Template == "videos" { tmplName = "video_item" } - pd.Results[i] = ResultView{MainResult: r, TemplateName: tmplName} + // Sanitize URLs to prevent javascript:/data: scheme injection. + var domain string + if r.URL != nil { + safe := util.SanitizeResultURL(*r.URL) + r.URL = &safe + if u, err := url.Parse(safe); err == nil { + domain = u.Hostname() + } + } + r.Thumbnail = util.SanitizeResultURL(r.Thumbnail) + pd.Results[i] = ResultView{ + MainResult: r, + TemplateName: tmplName, + Domain: domain, + FaviconIconURL: faviconIconURL(faviconService, domain), + SafeTitle: template.HTML(html.UnescapeString(r.Title)), + SafeContent: template.HTML(html.UnescapeString(r.Content)), + } } // Convert answers (they're map[string]any — extract string values). @@ -154,9 +272,12 @@ func FromResponse(resp contracts.SearchResponse, query string, pageno int) PageD iv.Title = v } if v, ok := ib["img_src"].(string); ok { - iv.ImgSrc = v + iv.ImgSrc = util.SanitizeResultURL(v) } - if iv.Title != "" || iv.Content != "" { + if v, ok := ib["url"].(string); ok { + iv.URL = util.SanitizeResultURL(v) + } + if iv.Title != "" || iv.Content != "" || iv.ImgSrc != "" { pd.Infoboxes = append(pd.Infoboxes, iv) } } @@ -188,9 +309,9 @@ func FromResponse(resp contracts.SearchResponse, query string, pageno int) PageD } // RenderIndex renders the homepage (search box only). -func RenderIndex(w http.ResponseWriter, sourceURL string) error { +func RenderIndex(w http.ResponseWriter, sourceURL, theme string) error { w.Header().Set("Content-Type", "text/html; charset=utf-8") - return tmplIndex.ExecuteTemplate(w, "base", PageData{ShowHeader: true, SourceURL: sourceURL}) + return tmplIndex.ExecuteTemplate(w, "base", PageData{ShowHeader: true, SourceURL: sourceURL, Theme: theme}) } // RenderSearch renders the full search results page (with base layout). @@ -233,4 +354,13 @@ func RenderSearchAuto(w http.ResponseWriter, r *http.Request, data PageData) err return RenderSearch(w, data) } -var _ = strconv.Itoa +// RenderPreferences renders the full preferences page. +func RenderPreferences(w http.ResponseWriter, sourceURL, theme, faviconService string) error { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + return tmplPreferences.ExecuteTemplate(w, "base", PageData{ + ShowHeader: true, + SourceURL: sourceURL, + Theme: theme, + FaviconService: faviconService, + }) +} diff --git a/internal/views/views_test.go b/internal/views/views_test.go index 1a38db4..f83c017 100644 --- a/internal/views/views_test.go +++ b/internal/views/views_test.go @@ -1,9 +1,10 @@ package views import ( + "strings" "testing" - "github.com/metamorphosis-dev/kafka/internal/contracts" + "github.com/metamorphosis-dev/samsa/internal/contracts" ) func mockSearchResponse(query string, numResults int) contracts.SearchResponse { @@ -36,11 +37,11 @@ func mockEmptyResponse() contracts.SearchResponse { } func TestFromResponse_Basic(t *testing.T) { - resp := mockSearchResponse("kafka trial", 42) - data := FromResponse(resp, "kafka trial", 1) + resp := mockSearchResponse("samsa trial", 42) + data := FromResponse(resp, "samsa trial", 1, "", "", "", "none") - if data.Query != "kafka trial" { - t.Errorf("expected query 'kafka trial', got %q", data.Query) + if data.Query != "samsa trial" { + t.Errorf("expected query 'samsa trial', got %q", data.Query) } if data.NumberOfResults != 42 { t.Errorf("expected 42 results, got %d", data.NumberOfResults) @@ -55,7 +56,7 @@ func TestFromResponse_Basic(t *testing.T) { func TestFromResponse_Pagination(t *testing.T) { resp := mockSearchResponse("test", 100) - data := FromResponse(resp, "test", 3) + data := FromResponse(resp, "test", 3, "", "", "", "none") if data.PrevPage != 2 { t.Errorf("expected PrevPage 2, got %d", data.PrevPage) @@ -80,7 +81,7 @@ func TestFromResponse_Pagination(t *testing.T) { } func TestFromResponse_Empty(t *testing.T) { - data := FromResponse(mockEmptyResponse(), "", 1) + data := FromResponse(mockEmptyResponse(), "", 1, "", "", "", "none") if data.NumberOfResults != 0 { t.Errorf("expected 0 results, got %d", data.NumberOfResults) @@ -90,6 +91,31 @@ func TestFromResponse_Empty(t *testing.T) { } } +func TestFromResponse_FaviconIconURL(t *testing.T) { + u := "https://example.com/path" + resp := contracts.SearchResponse{ + Query: "q", + NumberOfResults: 1, + Results: []contracts.MainResult{{Title: "t", URL: &u, Engine: "bing"}}, + Answers: []map[string]any{}, + Corrections: []string{}, + Infoboxes: []map[string]any{}, + Suggestions: []string{}, + UnresponsiveEngines: [][2]string{}, + } + data := FromResponse(resp, "q", 1, "", "", "", "google") + if len(data.Results) != 1 { + t.Fatalf("expected 1 result, got %d", len(data.Results)) + } + got := data.Results[0].FaviconIconURL + if got == "" || !strings.Contains(got, "google.com/s2/favicons") { + t.Fatalf("expected google favicon URL, got %q", got) + } + if !strings.Contains(got, "example.com") { + t.Fatalf("expected domain in favicon URL, got %q", got) + } +} + func TestIsHTMXRequest(t *testing.T) { tests := []struct { name string
- {{.Title}} + {{.SafeTitle}} - + {{if .FaviconIconURL}} + + {{end}} {{.URL}} - {{.Engine}} + {{.Engine}} {{if .Content}} - {{.Content}} + {{.SafeContent}} {{end}}
+ {{if .Thumbnail}} @@ -9,13 +9,19 @@ {{end}} - {{.Title}} + {{.SafeTitle}} - youtube + {{if .FaviconIconURL}} + + {{end}} + {{if .URL}} + {{.URL}} + {{end}} + {{.Engine}} {{if .Content}} - {{.Content}} + {{.SafeContent}} {{end}} diff --git a/internal/views/views.go b/internal/views/views.go index 4d7289c..ee84d70 100644 --- a/internal/views/views.go +++ b/internal/views/views.go @@ -1,4 +1,4 @@ -// kafka — a privacy-respecting metasearch engine +// samsa — a privacy-respecting metasearch engine // Copyright (C) 2026-present metamorphosis-dev // // This program is free software: you can redistribute it and/or modify @@ -18,13 +18,17 @@ package views import ( "embed" + "encoding/xml" + "html" "html/template" "io/fs" "net/http" + "net/url" "strconv" "strings" - "github.com/metamorphosis-dev/kafka/internal/contracts" + "github.com/metamorphosis-dev/samsa/internal/contracts" + "github.com/metamorphosis-dev/samsa/internal/util" ) //go:embed all:templates @@ -50,6 +54,19 @@ type PageData struct { UnresponsiveEngines [][2]string PageNumbers []PageNumber ShowHeader bool + IsImageSearch bool + // Theme is the user's selected theme (light/dark) from cookie + Theme string + FaviconService string + // New fields for three-column layout + Categories []string + CategoryIcons map[string]string + DisabledCategories []string + ActiveCategory string + TimeFilters []FilterOption + TypeFilters []FilterOption + ActiveTime string + ActiveType string } // ResultView is a template-friendly wrapper around a MainResult. @@ -58,12 +75,20 @@ type ResultView struct { // TemplateName is the actual template to dispatch to, computed from Template. // "videos" maps to "video_item", everything else maps to "result_item". TemplateName string + // Domain is the hostname extracted from the result URL, used for favicon proxying. + Domain string + // FaviconIconURL is the resolved favicon image URL for the user's favicon preference (empty = hide). + FaviconIconURL string + // SafeTitle and SafeContent are HTML-unescaped versions for rendering. + // The API returns HTML entities which Go templates escape by default. + SafeTitle template.HTML + SafeContent template.HTML } // PageNumber represents a numbered pagination button. type PageNumber struct { - Num int - IsCurrent bool + Num int + IsCurrent bool } // InfoboxView is a template-friendly infobox. @@ -71,12 +96,20 @@ type InfoboxView struct { Title string Content string ImgSrc string + URL string +} + +// FilterOption represents a filter radio option for the sidebar. +type FilterOption struct { + Label string + Value string } var ( - tmplFull *template.Template - tmplIndex *template.Template - tmplFragment *template.Template + tmplFull *template.Template + tmplIndex *template.Template + tmplFragment *template.Template + tmplPreferences *template.Template ) func init() { @@ -88,13 +121,16 @@ func init() { } tmplFull = template.Must(template.New("").Funcs(funcMap).ParseFS(tmplFS, - "base.html", "results.html", "results_inner.html", "result_item.html", "video_item.html", + "base.html", "results.html", "results_inner.html", "result_item.html", "video_item.html", "image_item.html", )) tmplIndex = template.Must(template.New("").Funcs(funcMap).ParseFS(tmplFS, "base.html", "index.html", )) tmplFragment = template.Must(template.New("").Funcs(funcMap).ParseFS(tmplFS, - "results_inner.html", "result_item.html", "video_item.html", + "results.html", "results_inner.html", "result_item.html", "video_item.html", "image_item.html", + )) + tmplPreferences = template.Must(template.New("").Funcs(funcMap).ParseFS(tmplFS, + "base.html", "preferences.html", )) } @@ -103,25 +139,90 @@ func StaticFS() (fs.FS, error) { return fs.Sub(staticFS, "static") } -// OpenSearchXML returns the OpenSearch description XML with {baseUrl} -// replaced by the provided base URL. +// OpenSearchXML returns the OpenSearch description XML with the base URL +// safely embedded via xml.EscapeText (no raw string interpolation). func OpenSearchXML(baseURL string) ([]byte, error) { tmplFS, _ := fs.Sub(templatesFS, "templates") data, err := fs.ReadFile(tmplFS, "opensearch.xml") if err != nil { return nil, err } - result := strings.ReplaceAll(string(data), "{baseUrl}", baseURL) + + var buf strings.Builder + xml.Escape(&buf, []byte(baseURL)) + escapedBaseURL := buf.String() + + result := strings.ReplaceAll(string(data), "{baseUrl}", escapedBaseURL) return []byte(result), nil } +// faviconIconURL returns a safe img src for the given service and hostname, or "" for none/invalid. +func faviconIconURL(service, domain string) string { + domain = strings.TrimSpace(domain) + if domain == "" { + return "" + } + switch service { + case "google": + return "https://www.google.com/s2/favicons?domain=" + url.QueryEscape(domain) + "&sz=32" + case "duckduckgo": + return "https://icons.duckduckgo.com/ip3/" + domain + ".ico" + case "self": + return "/favicon/" + domain + default: + return "" + } +} + // FromResponse builds PageData from a search response and request params. -func FromResponse(resp contracts.SearchResponse, query string, pageno int) PageData { +func FromResponse(resp contracts.SearchResponse, query string, pageno int, activeCategory, activeTime, activeType, faviconService string) PageData { + // Set defaults + if activeCategory == "" { + activeCategory = "all" + } + pd := PageData{ Query: query, Pageno: pageno, NumberOfResults: resp.NumberOfResults, UnresponsiveEngines: resp.UnresponsiveEngines, + FaviconService: faviconService, + + // New: categories with icons + Categories: []string{"all", "news", "images", "videos", "maps"}, + DisabledCategories: []string{"shopping", "music", "weather"}, + CategoryIcons: map[string]string{ + "all": "🌐", + "news": "📰", + "images": "🖼️", + "videos": "🎬", + "maps": "🗺️", + "shopping": "🛒", + "music": "🎵", + "weather": "🌤️", + }, + ActiveCategory: activeCategory, + IsImageSearch: activeCategory == "images", + + // Time filters + TimeFilters: []FilterOption{ + {Label: "Any time", Value: ""}, + {Label: "Past hour", Value: "h"}, + {Label: "Past 24 hours", Value: "d"}, + {Label: "Past week", Value: "w"}, + {Label: "Past month", Value: "m"}, + {Label: "Past year", Value: "y"}, + }, + ActiveTime: activeTime, + + // Type filters + TypeFilters: []FilterOption{ + {Label: "All results", Value: ""}, + {Label: "News", Value: "news"}, + {Label: "Videos", Value: "video"}, + {Label: "Images", Value: "image"}, + }, + ActiveType: activeType, } // Convert results. @@ -131,7 +232,24 @@ func FromResponse(resp contracts.SearchResponse, query string, pageno int) PageD if r.Template == "videos" { tmplName = "video_item" } - pd.Results[i] = ResultView{MainResult: r, TemplateName: tmplName} + // Sanitize URLs to prevent javascript:/data: scheme injection. + var domain string + if r.URL != nil { + safe := util.SanitizeResultURL(*r.URL) + r.URL = &safe + if u, err := url.Parse(safe); err == nil { + domain = u.Hostname() + } + } + r.Thumbnail = util.SanitizeResultURL(r.Thumbnail) + pd.Results[i] = ResultView{ + MainResult: r, + TemplateName: tmplName, + Domain: domain, + FaviconIconURL: faviconIconURL(faviconService, domain), + SafeTitle: template.HTML(html.UnescapeString(r.Title)), + SafeContent: template.HTML(html.UnescapeString(r.Content)), + } } // Convert answers (they're map[string]any — extract string values). @@ -154,9 +272,12 @@ func FromResponse(resp contracts.SearchResponse, query string, pageno int) PageD iv.Title = v } if v, ok := ib["img_src"].(string); ok { - iv.ImgSrc = v + iv.ImgSrc = util.SanitizeResultURL(v) } - if iv.Title != "" || iv.Content != "" { + if v, ok := ib["url"].(string); ok { + iv.URL = util.SanitizeResultURL(v) + } + if iv.Title != "" || iv.Content != "" || iv.ImgSrc != "" { pd.Infoboxes = append(pd.Infoboxes, iv) } } @@ -188,9 +309,9 @@ func FromResponse(resp contracts.SearchResponse, query string, pageno int) PageD } // RenderIndex renders the homepage (search box only). -func RenderIndex(w http.ResponseWriter, sourceURL string) error { +func RenderIndex(w http.ResponseWriter, sourceURL, theme string) error { w.Header().Set("Content-Type", "text/html; charset=utf-8") - return tmplIndex.ExecuteTemplate(w, "base", PageData{ShowHeader: true, SourceURL: sourceURL}) + return tmplIndex.ExecuteTemplate(w, "base", PageData{ShowHeader: true, SourceURL: sourceURL, Theme: theme}) } // RenderSearch renders the full search results page (with base layout). @@ -233,4 +354,13 @@ func RenderSearchAuto(w http.ResponseWriter, r *http.Request, data PageData) err return RenderSearch(w, data) } -var _ = strconv.Itoa +// RenderPreferences renders the full preferences page. +func RenderPreferences(w http.ResponseWriter, sourceURL, theme, faviconService string) error { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + return tmplPreferences.ExecuteTemplate(w, "base", PageData{ + ShowHeader: true, + SourceURL: sourceURL, + Theme: theme, + FaviconService: faviconService, + }) +} diff --git a/internal/views/views_test.go b/internal/views/views_test.go index 1a38db4..f83c017 100644 --- a/internal/views/views_test.go +++ b/internal/views/views_test.go @@ -1,9 +1,10 @@ package views import ( + "strings" "testing" - "github.com/metamorphosis-dev/kafka/internal/contracts" + "github.com/metamorphosis-dev/samsa/internal/contracts" ) func mockSearchResponse(query string, numResults int) contracts.SearchResponse { @@ -36,11 +37,11 @@ func mockEmptyResponse() contracts.SearchResponse { } func TestFromResponse_Basic(t *testing.T) { - resp := mockSearchResponse("kafka trial", 42) - data := FromResponse(resp, "kafka trial", 1) + resp := mockSearchResponse("samsa trial", 42) + data := FromResponse(resp, "samsa trial", 1, "", "", "", "none") - if data.Query != "kafka trial" { - t.Errorf("expected query 'kafka trial', got %q", data.Query) + if data.Query != "samsa trial" { + t.Errorf("expected query 'samsa trial', got %q", data.Query) } if data.NumberOfResults != 42 { t.Errorf("expected 42 results, got %d", data.NumberOfResults) @@ -55,7 +56,7 @@ func TestFromResponse_Basic(t *testing.T) { func TestFromResponse_Pagination(t *testing.T) { resp := mockSearchResponse("test", 100) - data := FromResponse(resp, "test", 3) + data := FromResponse(resp, "test", 3, "", "", "", "none") if data.PrevPage != 2 { t.Errorf("expected PrevPage 2, got %d", data.PrevPage) @@ -80,7 +81,7 @@ func TestFromResponse_Pagination(t *testing.T) { } func TestFromResponse_Empty(t *testing.T) { - data := FromResponse(mockEmptyResponse(), "", 1) + data := FromResponse(mockEmptyResponse(), "", 1, "", "", "", "none") if data.NumberOfResults != 0 { t.Errorf("expected 0 results, got %d", data.NumberOfResults) @@ -90,6 +91,31 @@ func TestFromResponse_Empty(t *testing.T) { } } +func TestFromResponse_FaviconIconURL(t *testing.T) { + u := "https://example.com/path" + resp := contracts.SearchResponse{ + Query: "q", + NumberOfResults: 1, + Results: []contracts.MainResult{{Title: "t", URL: &u, Engine: "bing"}}, + Answers: []map[string]any{}, + Corrections: []string{}, + Infoboxes: []map[string]any{}, + Suggestions: []string{}, + UnresponsiveEngines: [][2]string{}, + } + data := FromResponse(resp, "q", 1, "", "", "", "google") + if len(data.Results) != 1 { + t.Fatalf("expected 1 result, got %d", len(data.Results)) + } + got := data.Results[0].FaviconIconURL + if got == "" || !strings.Contains(got, "google.com/s2/favicons") { + t.Fatalf("expected google favicon URL, got %q", got) + } + if !strings.Contains(got, "example.com") { + t.Fatalf("expected domain in favicon URL, got %q", got) + } +} + func TestIsHTMXRequest(t *testing.T) { tests := []struct { name string
{{if .Thumbnail}} @@ -9,13 +9,19 @@ {{end}} - {{.Title}} + {{.SafeTitle}} - youtube + {{if .FaviconIconURL}} + + {{end}} + {{if .URL}} + {{.URL}} + {{end}} + {{.Engine}} {{if .Content}} - {{.Content}} + {{.SafeContent}} {{end}} diff --git a/internal/views/views.go b/internal/views/views.go index 4d7289c..ee84d70 100644 --- a/internal/views/views.go +++ b/internal/views/views.go @@ -1,4 +1,4 @@ -// kafka — a privacy-respecting metasearch engine +// samsa — a privacy-respecting metasearch engine // Copyright (C) 2026-present metamorphosis-dev // // This program is free software: you can redistribute it and/or modify @@ -18,13 +18,17 @@ package views import ( "embed" + "encoding/xml" + "html" "html/template" "io/fs" "net/http" + "net/url" "strconv" "strings" - "github.com/metamorphosis-dev/kafka/internal/contracts" + "github.com/metamorphosis-dev/samsa/internal/contracts" + "github.com/metamorphosis-dev/samsa/internal/util" ) //go:embed all:templates @@ -50,6 +54,19 @@ type PageData struct { UnresponsiveEngines [][2]string PageNumbers []PageNumber ShowHeader bool + IsImageSearch bool + // Theme is the user's selected theme (light/dark) from cookie + Theme string + FaviconService string + // New fields for three-column layout + Categories []string + CategoryIcons map[string]string + DisabledCategories []string + ActiveCategory string + TimeFilters []FilterOption + TypeFilters []FilterOption + ActiveTime string + ActiveType string } // ResultView is a template-friendly wrapper around a MainResult. @@ -58,12 +75,20 @@ type ResultView struct { // TemplateName is the actual template to dispatch to, computed from Template. // "videos" maps to "video_item", everything else maps to "result_item". TemplateName string + // Domain is the hostname extracted from the result URL, used for favicon proxying. + Domain string + // FaviconIconURL is the resolved favicon image URL for the user's favicon preference (empty = hide). + FaviconIconURL string + // SafeTitle and SafeContent are HTML-unescaped versions for rendering. + // The API returns HTML entities which Go templates escape by default. + SafeTitle template.HTML + SafeContent template.HTML } // PageNumber represents a numbered pagination button. type PageNumber struct { - Num int - IsCurrent bool + Num int + IsCurrent bool } // InfoboxView is a template-friendly infobox. @@ -71,12 +96,20 @@ type InfoboxView struct { Title string Content string ImgSrc string + URL string +} + +// FilterOption represents a filter radio option for the sidebar. +type FilterOption struct { + Label string + Value string } var ( - tmplFull *template.Template - tmplIndex *template.Template - tmplFragment *template.Template + tmplFull *template.Template + tmplIndex *template.Template + tmplFragment *template.Template + tmplPreferences *template.Template ) func init() { @@ -88,13 +121,16 @@ func init() { } tmplFull = template.Must(template.New("").Funcs(funcMap).ParseFS(tmplFS, - "base.html", "results.html", "results_inner.html", "result_item.html", "video_item.html", + "base.html", "results.html", "results_inner.html", "result_item.html", "video_item.html", "image_item.html", )) tmplIndex = template.Must(template.New("").Funcs(funcMap).ParseFS(tmplFS, "base.html", "index.html", )) tmplFragment = template.Must(template.New("").Funcs(funcMap).ParseFS(tmplFS, - "results_inner.html", "result_item.html", "video_item.html", + "results.html", "results_inner.html", "result_item.html", "video_item.html", "image_item.html", + )) + tmplPreferences = template.Must(template.New("").Funcs(funcMap).ParseFS(tmplFS, + "base.html", "preferences.html", )) } @@ -103,25 +139,90 @@ func StaticFS() (fs.FS, error) { return fs.Sub(staticFS, "static") } -// OpenSearchXML returns the OpenSearch description XML with {baseUrl} -// replaced by the provided base URL. +// OpenSearchXML returns the OpenSearch description XML with the base URL +// safely embedded via xml.EscapeText (no raw string interpolation). func OpenSearchXML(baseURL string) ([]byte, error) { tmplFS, _ := fs.Sub(templatesFS, "templates") data, err := fs.ReadFile(tmplFS, "opensearch.xml") if err != nil { return nil, err } - result := strings.ReplaceAll(string(data), "{baseUrl}", baseURL) + + var buf strings.Builder + xml.Escape(&buf, []byte(baseURL)) + escapedBaseURL := buf.String() + + result := strings.ReplaceAll(string(data), "{baseUrl}", escapedBaseURL) return []byte(result), nil } +// faviconIconURL returns a safe img src for the given service and hostname, or "" for none/invalid. +func faviconIconURL(service, domain string) string { + domain = strings.TrimSpace(domain) + if domain == "" { + return "" + } + switch service { + case "google": + return "https://www.google.com/s2/favicons?domain=" + url.QueryEscape(domain) + "&sz=32" + case "duckduckgo": + return "https://icons.duckduckgo.com/ip3/" + domain + ".ico" + case "self": + return "/favicon/" + domain + default: + return "" + } +} + // FromResponse builds PageData from a search response and request params. -func FromResponse(resp contracts.SearchResponse, query string, pageno int) PageData { +func FromResponse(resp contracts.SearchResponse, query string, pageno int, activeCategory, activeTime, activeType, faviconService string) PageData { + // Set defaults + if activeCategory == "" { + activeCategory = "all" + } + pd := PageData{ Query: query, Pageno: pageno, NumberOfResults: resp.NumberOfResults, UnresponsiveEngines: resp.UnresponsiveEngines, + FaviconService: faviconService, + + // New: categories with icons + Categories: []string{"all", "news", "images", "videos", "maps"}, + DisabledCategories: []string{"shopping", "music", "weather"}, + CategoryIcons: map[string]string{ + "all": "🌐", + "news": "📰", + "images": "🖼️", + "videos": "🎬", + "maps": "🗺️", + "shopping": "🛒", + "music": "🎵", + "weather": "🌤️", + }, + ActiveCategory: activeCategory, + IsImageSearch: activeCategory == "images", + + // Time filters + TimeFilters: []FilterOption{ + {Label: "Any time", Value: ""}, + {Label: "Past hour", Value: "h"}, + {Label: "Past 24 hours", Value: "d"}, + {Label: "Past week", Value: "w"}, + {Label: "Past month", Value: "m"}, + {Label: "Past year", Value: "y"}, + }, + ActiveTime: activeTime, + + // Type filters + TypeFilters: []FilterOption{ + {Label: "All results", Value: ""}, + {Label: "News", Value: "news"}, + {Label: "Videos", Value: "video"}, + {Label: "Images", Value: "image"}, + }, + ActiveType: activeType, } // Convert results. @@ -131,7 +232,24 @@ func FromResponse(resp contracts.SearchResponse, query string, pageno int) PageD if r.Template == "videos" { tmplName = "video_item" } - pd.Results[i] = ResultView{MainResult: r, TemplateName: tmplName} + // Sanitize URLs to prevent javascript:/data: scheme injection. + var domain string + if r.URL != nil { + safe := util.SanitizeResultURL(*r.URL) + r.URL = &safe + if u, err := url.Parse(safe); err == nil { + domain = u.Hostname() + } + } + r.Thumbnail = util.SanitizeResultURL(r.Thumbnail) + pd.Results[i] = ResultView{ + MainResult: r, + TemplateName: tmplName, + Domain: domain, + FaviconIconURL: faviconIconURL(faviconService, domain), + SafeTitle: template.HTML(html.UnescapeString(r.Title)), + SafeContent: template.HTML(html.UnescapeString(r.Content)), + } } // Convert answers (they're map[string]any — extract string values). @@ -154,9 +272,12 @@ func FromResponse(resp contracts.SearchResponse, query string, pageno int) PageD iv.Title = v } if v, ok := ib["img_src"].(string); ok { - iv.ImgSrc = v + iv.ImgSrc = util.SanitizeResultURL(v) } - if iv.Title != "" || iv.Content != "" { + if v, ok := ib["url"].(string); ok { + iv.URL = util.SanitizeResultURL(v) + } + if iv.Title != "" || iv.Content != "" || iv.ImgSrc != "" { pd.Infoboxes = append(pd.Infoboxes, iv) } } @@ -188,9 +309,9 @@ func FromResponse(resp contracts.SearchResponse, query string, pageno int) PageD } // RenderIndex renders the homepage (search box only). -func RenderIndex(w http.ResponseWriter, sourceURL string) error { +func RenderIndex(w http.ResponseWriter, sourceURL, theme string) error { w.Header().Set("Content-Type", "text/html; charset=utf-8") - return tmplIndex.ExecuteTemplate(w, "base", PageData{ShowHeader: true, SourceURL: sourceURL}) + return tmplIndex.ExecuteTemplate(w, "base", PageData{ShowHeader: true, SourceURL: sourceURL, Theme: theme}) } // RenderSearch renders the full search results page (with base layout). @@ -233,4 +354,13 @@ func RenderSearchAuto(w http.ResponseWriter, r *http.Request, data PageData) err return RenderSearch(w, data) } -var _ = strconv.Itoa +// RenderPreferences renders the full preferences page. +func RenderPreferences(w http.ResponseWriter, sourceURL, theme, faviconService string) error { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + return tmplPreferences.ExecuteTemplate(w, "base", PageData{ + ShowHeader: true, + SourceURL: sourceURL, + Theme: theme, + FaviconService: faviconService, + }) +} diff --git a/internal/views/views_test.go b/internal/views/views_test.go index 1a38db4..f83c017 100644 --- a/internal/views/views_test.go +++ b/internal/views/views_test.go @@ -1,9 +1,10 @@ package views import ( + "strings" "testing" - "github.com/metamorphosis-dev/kafka/internal/contracts" + "github.com/metamorphosis-dev/samsa/internal/contracts" ) func mockSearchResponse(query string, numResults int) contracts.SearchResponse { @@ -36,11 +37,11 @@ func mockEmptyResponse() contracts.SearchResponse { } func TestFromResponse_Basic(t *testing.T) { - resp := mockSearchResponse("kafka trial", 42) - data := FromResponse(resp, "kafka trial", 1) + resp := mockSearchResponse("samsa trial", 42) + data := FromResponse(resp, "samsa trial", 1, "", "", "", "none") - if data.Query != "kafka trial" { - t.Errorf("expected query 'kafka trial', got %q", data.Query) + if data.Query != "samsa trial" { + t.Errorf("expected query 'samsa trial', got %q", data.Query) } if data.NumberOfResults != 42 { t.Errorf("expected 42 results, got %d", data.NumberOfResults) @@ -55,7 +56,7 @@ func TestFromResponse_Basic(t *testing.T) { func TestFromResponse_Pagination(t *testing.T) { resp := mockSearchResponse("test", 100) - data := FromResponse(resp, "test", 3) + data := FromResponse(resp, "test", 3, "", "", "", "none") if data.PrevPage != 2 { t.Errorf("expected PrevPage 2, got %d", data.PrevPage) @@ -80,7 +81,7 @@ func TestFromResponse_Pagination(t *testing.T) { } func TestFromResponse_Empty(t *testing.T) { - data := FromResponse(mockEmptyResponse(), "", 1) + data := FromResponse(mockEmptyResponse(), "", 1, "", "", "", "none") if data.NumberOfResults != 0 { t.Errorf("expected 0 results, got %d", data.NumberOfResults) @@ -90,6 +91,31 @@ func TestFromResponse_Empty(t *testing.T) { } } +func TestFromResponse_FaviconIconURL(t *testing.T) { + u := "https://example.com/path" + resp := contracts.SearchResponse{ + Query: "q", + NumberOfResults: 1, + Results: []contracts.MainResult{{Title: "t", URL: &u, Engine: "bing"}}, + Answers: []map[string]any{}, + Corrections: []string{}, + Infoboxes: []map[string]any{}, + Suggestions: []string{}, + UnresponsiveEngines: [][2]string{}, + } + data := FromResponse(resp, "q", 1, "", "", "", "google") + if len(data.Results) != 1 { + t.Fatalf("expected 1 result, got %d", len(data.Results)) + } + got := data.Results[0].FaviconIconURL + if got == "" || !strings.Contains(got, "google.com/s2/favicons") { + t.Fatalf("expected google favicon URL, got %q", got) + } + if !strings.Contains(got, "example.com") { + t.Fatalf("expected domain in favicon URL, got %q", got) + } +} + func TestIsHTMXRequest(t *testing.T) { tests := []struct { name string
+ {{else}}
+
+ {{end}}
+