ticket #106 attempt 1

devplacepy/models.py

@@ -470,9 +470,19 @@ class SeoRunForm(BaseModel):
         text = value.strip()
         if not text:
             raise ValueError("A URL is required")
+        if "://" in text:
+            scheme = text.split("://", 1)[0]
+            if scheme not in ("http", "https"):
+                raise ValueError(f"Only http and https URLs are allowed; got '{scheme}://'")
+        else:
+            text = f"https://{text}"
+        if not SEO_URL_PATTERN.match(text):
+            raise ValueError("URL must be a valid http or https source location")
         return text
 
 
+SEO_URL_PATTERN = re.compile(r"^https?://[a-zA-Z0-9][\w./:@~^?&#%=;-]*$")
+
 ISSLOP_URL_PATTERN = re.compile(r"^(https?://|git://|ssh://|git@)[\w./:@~^-]+$", re.IGNORECASE)
 ISSLOP_SINGLE_SLASH_PATTERN = re.compile(r"^(https?|git|ssh):/(?!/)", re.IGNORECASE)
 ISSLOP_SCHEME_PATTERN = re.compile(r"^[a-z][a-z0-9+.-]*://", re.IGNORECASE)

devplacepy/services/jobs/deepsearch/crawl.py

@@ -22,8 +22,6 @@ from .pdf import MAX_PDF_BYTES, extract_pdf_text, is_pdf
 
 logger = logging.getLogger(__name__)
 
-_pw_lock = asyncio.Lock()
-
 RSEARCH_URL = "https://rsearch.app.molodetz.nl"
 RSEARCH_TIMEOUT_SECONDS = 45.0
 FETCH_TIMEOUT_SECONDS = 20.0
@@ -174,7 +172,13 @@ async def _render_with_playwright(
 ) -> tuple[str, str, int, list[tuple[str, str]]]:
     from playwright.async_api import async_playwright
 
-    async def _render(browser) -> tuple[str, str, int, list[tuple[str, str]]]:
+    own_browser = browser is None
+    if own_browser:
+        pw = await async_playwright().__aenter__()
+        browser = await pw.chromium.launch(
+            headless=True, args=["--no-sandbox", "--disable-dev-shm-usage"]
+        )
+    try:
         context = await browser.new_context(user_agent=USER_AGENT)
         page = await context.new_page()
         response = await page.goto(url, wait_until="load", timeout=30000)
@@ -185,18 +189,10 @@ async def _render_with_playwright(
         await context.close()
         extracted = extract_html(content, base_url=url)
         return extracted.title, extracted.text, status, extracted.links
-
+    finally:
-    if browser is None:
+        if own_browser:
-        async with async_playwright() as pw:
+            await browser.close()
-            browser = await pw.chromium.launch(
+            await pw.__aexit__(None, None, None)
-                headless=True, args=["--no-sandbox", "--disable-dev-shm-usage"]
-            )
-            try:
-                return await _render(browser)
-            finally:
-                await browser.close()
-    else:
-        return await _render(browser)
 
 
 async def fetch_page(url: str, depth: int, browser=None) -> CrawledPage | None:
@@ -246,20 +242,18 @@ async def fetch_page(url: str, depth: int, browser=None) -> CrawledPage | None:
         except (LookupError, ValueError) as exc:
             logger.info("deepsearch decode failed for %s: %s", url, exc)
     if len(text) < MIN_PAGE_CHARS:
-        async with _pw_lock:
+        try:
-            try:
+            r_title, r_text, r_status, r_links = await _render_with_playwright(url, browser)
-                r_title, r_text, r_status, r_links = await _render_with_playwright(url, browser)
+            if len(r_text) > len(text):
-            except Exception as exc:
+                title, text, status, source, links = (
-                logger.info("deepsearch render failed for %s: %s", url, exc)
+                    r_title or title,
-                r_title, r_text, r_status, r_links = "", "", 0, []
+                    r_text,
-        if len(r_text) > len(text):
+                    r_status or status,
-            title, text, status, source, links = (
+                    "playwright",
-                r_title or title,
+                    r_links,
-                r_text,
+                )
-                r_status or status,
+        except Exception as exc:
-                "playwright",
+            logger.info("deepsearch render failed for %s: %s", url, exc)
-                r_links,
-            )
     if len(text) < MIN_PAGE_CHARS:
         return None
     return CrawledPage(
@@ -302,99 +296,102 @@ async def crawl(
     total = min(len(level_candidates), max_pages)
     cancelled = False
 
+    pw = None
     browser = None
-    async with async_playwright() as pw:
+    try:
-        try:
+        pw = await async_playwright().__aenter__()
-            browser = await pw.chromium.launch(
+        browser = await pw.chromium.launch(
-                headless=True, args=["--no-sandbox", "--disable-dev-shm-usage"]
+            headless=True, args=["--no-sandbox", "--disable-dev-shm-usage"]
-            )
+        )
-        except Exception as exc:
+    except Exception as exc:
-            logger.warning("deepsearch playwright launch failed, pages will use httpx only: %s", exc)
+        logger.warning("deepsearch playwright launch failed, pages will use httpx only: %s", exc)
 
-        try:
+    try:
-            for level in range(max(1, depth)):
+        for level in range(max(1, depth)):
-                if cancelled or fetched >= max_pages or not level_candidates:
+            if cancelled or fetched >= max_pages or not level_candidates:
+                break
+            next_candidates: list[dict] = []
+            for start in range(0, len(level_candidates), CRAWL_CONCURRENCY):
+                if fetched >= max_pages:
                     break
-                next_candidates: list[dict] = []
+                if await should_stop():
-                for start in range(0, len(level_candidates), CRAWL_CONCURRENCY):
+                    emit({"type": "stage", "stage": "cancelled", "message": "Crawl cancelled"})
+                    cancelled = True
+                    break
+                batch = level_candidates[start : start + CRAWL_CONCURRENCY][: max_pages - fetched]
+                for candidate in batch:
+                    emit(
+                        {
+                            "type": "progress",
+                            "done": fetched,
+                            "total": total,
+                            "url": candidate["url"],
+                            "depth": level,
+                            "message": f"Reading {candidate['url']}",
+                        }
+                    )
+                    if is_cached(candidate["url"]):
+                        emit({"type": "page_cached", "url": candidate["url"], "reason": "seen in a prior run"})
+                fetch_start = time.perf_counter()
+                results = await asyncio.gather(
+                    *(_resolve_candidate(candidate, level, browser) for candidate in batch),
+                    return_exceptions=True,
+                )
+                elapsed_ms = int((time.perf_counter() - fetch_start) * 1000)
+                for candidate, page in zip(batch, results):
+                    url = candidate["url"]
+                    if isinstance(page, BaseException):
+                        logger.info("deepsearch fetch crashed for %s: %s", url, page)
+                        page = None
+                    if page is None:
+                        emit(
+                            {
+                                "type": "page_skipped",
+                                "url": url,
+                                "reason": "no readable content",
+                                "elapsed_ms": elapsed_ms,
+                            }
+                        )
+                        continue
                     if fetched >= max_pages:
                         break
-                    if await should_stop():
+                    digest = content_hash(page.text)
-                        emit({"type": "stage", "stage": "cancelled", "message": "Crawl cancelled"})
+                    if digest in outcome.seen_hashes:
-                        cancelled = True
-                        break
-                    batch = level_candidates[start : start + CRAWL_CONCURRENCY][: max_pages - fetched]
-                    for candidate in batch:
                         emit(
                             {
-                                "type": "progress",
+                                "type": "page_duplicate",
-                                "done": fetched,
+                                "url": url,
-                                "total": total,
+                                "reason": "duplicate content",
-                                "url": candidate["url"],
-                                "depth": level,
-                                "message": f"Reading {candidate['url']}",
-                            }
-                        )
-                        if is_cached(candidate["url"]):
-                            emit({"type": "page_cached", "url": candidate["url"], "reason": "seen in a prior run"})
-                    fetch_start = time.perf_counter()
-                    results = await asyncio.gather(
-                        *(_resolve_candidate(candidate, level, browser) for candidate in batch),
-                        return_exceptions=True,
-                    )
-                    elapsed_ms = int((time.perf_counter() - fetch_start) * 1000)
-                    for candidate, page in zip(batch, results):
-                        url = candidate["url"]
-                        if isinstance(page, BaseException):
-                            logger.info("deepsearch fetch crashed for %s: %s", url, page)
-                            page = None
-                        if page is None:
-                            emit(
-                                {
-                                    "type": "page_skipped",
-                                    "url": url,
-                                    "reason": "no readable content",
-                                    "elapsed_ms": elapsed_ms,
-                                }
-                            )
-                            continue
-                        if fetched >= max_pages:
-                            break
-                        digest = content_hash(page.text)
-                        if digest in outcome.seen_hashes:
-                            emit(
-                                {
-                                    "type": "page_duplicate",
-                                    "url": url,
-                                    "reason": "duplicate content",
-                                    "elapsed_ms": elapsed_ms,
-                                }
-                            )
-                            continue
-                        outcome.seen_hashes.add(digest)
-                        outcome.pages.append(page)
-                        fetched += 1
-                        emit(
-                            {
-                                "type": "page_loaded",
-                                "url": page.url,
-                                "title": page.title,
-                                "source": page.source,
-                                "depth": level,
-                                "render": page.source == "playwright",
                                 "elapsed_ms": elapsed_ms,
-                                "done": fetched,
-                                "total": total,
                             }
                         )
-                        if level + 1 < depth:
+                        continue
-                            for link in relevant_links(page.links, query, LINKS_PER_PAGE):
+                    outcome.seen_hashes.add(digest)
-                                if link not in seen_urls:
+                    outcome.pages.append(page)
-                                    seen_urls.add(link)
+                    fetched += 1
-                                    next_candidates.append({"url": link})
+                    emit(
-                level_candidates = next_candidates
+                        {
-                total = min(total + len(next_candidates), max_pages)
+                            "type": "page_loaded",
-        finally:
+                            "url": page.url,
-            if browser is not None:
+                            "title": page.title,
-                await browser.close()
+                            "source": page.source,
+                            "depth": level,
+                            "render": page.source == "playwright",
+                            "elapsed_ms": elapsed_ms,
+                            "done": fetched,
+                            "total": total,
+                        }
+                    )
+                    if level + 1 < depth:
+                        for link in relevant_links(page.links, query, LINKS_PER_PAGE):
+                            if link not in seen_urls:
+                                seen_urls.add(link)
+                                next_candidates.append({"url": link})
+            level_candidates = next_candidates
+            total = min(total + len(next_candidates), max_pages)
+    finally:
+        if browser is not None:
+            await browser.close()
+        if pw is not None:
+            await pw.__aexit__(None, None, None)
     return outcome

tests/api/tools/seo.py

@@ -89,6 +89,53 @@ def test_run_clamps_max_pages_above_cap(app_server):
         _clear_seo_jobs()
 
 
+def test_run_rejects_malformed_scheme(app_server):
+    r = requests.post(
+        f"{BASE_URL}/tools/seo/run",
+        headers=_json_headers(),
+        data={"url": "ahttps://devplace.net/sitem", "mode": "url"},
+        allow_redirects=False,
+    )
+    assert r.status_code in (400, 422), r.text
+
+
+def test_run_rejects_relative_path(app_server):
+    r = requests.post(
+        f"{BASE_URL}/tools/seo/run",
+        headers=_json_headers(),
+        data={"url": "/feed", "mode": "url"},
+        allow_redirects=False,
+    )
+    assert r.status_code in (400, 422), r.text
+
+
+def test_run_normalizes_missing_scheme(app_server):
+    try:
+        r = requests.post(
+            f"{BASE_URL}/tools/seo/run",
+            headers=_json_headers(),
+            data={"url": "example.com", "mode": "url", "max_pages": "5"},
+        )
+        assert r.status_code == 200, r.text
+        uid = r.json()["uid"]
+        refresh_snapshot()
+        job = queue.get_job(uid)
+        assert job is not None
+        assert job["payload"]["url"] == "https://example.com"
+    finally:
+        _clear_seo_jobs()
+
+
+def test_run_rejects_non_http_scheme(app_server):
+    r = requests.post(
+        f"{BASE_URL}/tools/seo/run",
+        headers=_json_headers(),
+        data={"url": "ftp://example.com", "mode": "url"},
+        allow_redirects=False,
+    )
+    assert r.status_code in (400, 422), r.text
+
+
 def test_run_enforces_one_active_job_per_owner(app_server):
     try:
         first = requests.post(