Refine footer links and fix search and index edge cases

tests/test_audit_poc_links.py

@@ -1,9 +1,11 @@
 from __future__ import annotations
 
+import io
 import sys
 import unittest
 from pathlib import Path
 from unittest.mock import patch
+from urllib.error import HTTPError
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "scripts"))
 
@@ -59,5 +61,29 @@ class RepositorySurveyTests(unittest.TestCase):
         }, ["owner/poc", "owner/healthy"]), (set(), {"owner/healthy": [10, "2026-10-06"]}))
 
 
+class ReferenceAuditTests(unittest.TestCase):
+    def test_head_not_found_keeps_reference_when_get_succeeds(self) -> None:
+        url = "https://example.com/poc"
+        for code in (404, 410):
+            with self.subTest(code=code), patch.object(
+                audit_poc_links.request,
+                "urlopen",
+                side_effect=[HTTPError(url, code, "No HEAD route", {}, None), io.BytesIO(b"PoC")],
+            ) as fetch:
+                self.assertEqual(audit_poc_links.dead_references([url], workers=1, timeout=1), set())
+                self.assertEqual([call.args[0].method for call in fetch.call_args_list], ["HEAD", "GET"])
+
+    def test_get_confirms_reference_is_missing(self) -> None:
+        url = "https://example.com/poc"
+        for code in (404, 410):
+            with self.subTest(code=code), patch.object(
+                audit_poc_links.request,
+                "urlopen",
+                side_effect=[HTTPError(url, code, "Missing", {}, None), HTTPError(url, code, "Missing", {}, None)],
+            ) as fetch:
+                self.assertEqual(audit_poc_links.dead_references([url], workers=1, timeout=1), {url})
+                self.assertEqual([call.args[0].method for call in fetch.call_args_list], ["HEAD", "GET"])
+
+
 if __name__ == "__main__":
     unittest.main()

tests/test_build_pages.py

@@ -177,6 +177,26 @@ class HomepageTests(unittest.TestCase):
             build_pages.homepage([], {}, {"total_cves": 1, "with_pocs": 1})
 
 
+class AssessmentRenderingTests(unittest.TestCase):
+    def test_zero_cvss_score_is_visible_in_chip_and_assessment(self) -> None:
+        entry = {"cve": "CVE-1999-0497", "poc": ["https://example.com/poc"]}
+        data = {
+            "cves": [entry],
+            "meta": {entry["cve"]: {"cvss": [[
+                "2.0", 0.0, "LOW", "AV:N/AC:L/Au:N/C:N/I:N/A:N", "[email protected]", "Primary",
+            ]]}},
+            "epss": {}, "kev": {}, "nuclei": {}, "repo_meta": {}, "related": {},
+            "lastmod": {entry["cve"]: "2026-10-06"},
+        }
+        markup = build_pages.page(entry, data)
+        self.assertIn("LOW 0.0</span>", markup)
+        self.assertIn("<dd>0.0 LOW<code>", markup)
+
+    def test_ibm_assessment_names_its_scorer(self) -> None:
+        row = ["3.0", 7.1, "HIGH", "", "[email protected]", "Secondary"]
+        self.assertEqual(build_pages.assessor(row), "IBM")
+
+
 class RepositoryMetadataTests(unittest.TestCase):
     def test_repository_advisories_do_not_inherit_repository_metadata(self) -> None:
         url = "https://github.com/vendor/project/security/advisories/GHSA-1234"

tests/test_search.js

@@ -64,6 +64,23 @@ test('a stalled trending feed does not block a bookmarked search', async t => {
   assert.match(elements.get('[data-results]').innerHTML, /href="\/CVE-2026-1234"/);
 });
 
+test('a bookmarked typo is corrected when indexing finishes without changing filters', async t => {
+  const { elements, context } = startPage(t, {
+    search: '?q=wdiget&src=github&kev=1&sort=newest',
+    trending: new Promise(() => {}),
+    kev: { 'CVE-2026-1234': ['2026-10-06', false] }
+  });
+  await new Promise(setImmediate);
+  assert.equal(vm.runInContext('wordIndex.ready', context), true);
+  assert.match(elements.get('[data-results]').innerHTML, /href="\/CVE-2026-1234"/);
+  assert.match(elements.get('[data-status]').textContent, /widget for wdiget/);
+  assert.equal(elements.get('[data-search]').value, 'wdiget');
+  assert.equal(vm.runInContext('state.query', context), 'wdiget');
+  assert.equal(vm.runInContext('state.sort', context), 'NEWEST');
+  assert.equal(vm.runInContext('state.kevOnly', context), true);
+  assert.equal(vm.runInContext("[...state.filters.source].join(',')", context), 'GITHUB');
+});
+
 test('a failed trending feed preserves the published homepage rows', async t => {
   const { elements } = startPage(t, { trending: Promise.reject(new Error('Feed unavailable')) });
   await new Promise(setImmediate);

tests/test_update_cves.py

@@ -416,6 +416,24 @@ ui.run(port=8080)
 
 
 class PublishedLinkDeduplicationTests(unittest.TestCase):
+    def test_published_links_require_absolute_http_urls(self) -> None:
+        valid = [
+            "https://Example.com/PoC.py?Version=One#Example",
+            "http://example.com/poc",
+            "HTTPS://example.com/CaseSensitive",
+        ]
+        invalid = [
+            "javascript:alert(1)",
+            "data:text/html,test",
+            "//example.com/poc",
+            "/relative/poc",
+            "https:///missing-host",
+            "https://[invalid/poc",
+            "ordinary description text",
+        ]
+        block = "\n".join(f"- {url}" for url in [*invalid, *valid])
+        self.assertEqual(build_site.collect_links(block), valid)
+
     def test_unverified_reference_is_not_a_poc(self) -> None:
         cve_id = "CVE-2024-41968"
         url = "https://cert.vde.com/en/advisories/VDE-2024-047"