From e377c4de03b6606c6f964ee9ce23774c97c880b1 Mon Sep 17 00:00:00 2001
From: Emi Griffith <me@emigriffith.dev>
Date: Sat, 25 Jul 2026 01:35:59 -0700
Subject: [PATCH] content: write the entities literally in pages.yaml titles
 and descriptions

pages.yaml's title/description are interpolated as plain strings into <title>
and <meta name="description">, so html/template escapes them. Writing an HTML
entity in the YAML therefore escapes it a second time and the user sees the
source. Live on main right now:

  <meta name="description" content="... a &amp;plusmn;7-day seasonal window ...">
  <title>Weather &amp;amp; climate glossary: ...</title>

which renders as a literal "&plusmn;7-day" in the SERP snippet and "&amp;" in
the browser tab, on the about and glossary pages. The Python->Go rewrite did not
change this: the entities live in the shared data file and both engines
autoescape identically.

glossary.yaml is deliberately NOT touched. Its `body` is typed template.HTML and
rendered raw (glossary_term.html.tmpl), so the entities and <b> tags there are
correct and would break if "fixed".

The regression test runs against the real content dir, which the frontend
Dockerfile already copies into the builder stage, so it gates the image rather
than only local runs.
---
 frontend/content/pages.yaml                   |  4 +--
 .../internal/contentdata/loader_test.go       | 36 +++++++++++++++++++
 2 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/frontend/content/pages.yaml b/frontend/content/pages.yaml
index a379964..7e3fca1 100644
--- a/frontend/content/pages.yaml
+++ b/frontend/content/pages.yaml
@@ -6,7 +6,7 @@ pages:
   about:
     title: "About Thermograph: how the weather grades are calculated"
     description: >-
-      How Thermograph works: ~45 years of ERA5 climate history, a &plusmn;7-day
+      How Thermograph works: ~45 years of ERA5 climate history, a ±7-day
       seasonal window, and empirical percentiles that grade each day relative to
       its own location.
   privacy:
@@ -21,7 +21,7 @@ pages:
       temperatures by month, all-time records, and how today's weather compares
       to local history.
   glossary_index:
-    title: "Weather &amp; climate glossary: heat index, feels-like, percentile, and more"
+    title: "Weather & climate glossary: heat index, feels-like, percentile, and more"
     description: >-
       Plain-language definitions of weather and climate terms: climate normal,
       percentile, temperature anomaly, feels-like, heat index, wind chill,
diff --git a/frontend/server/internal/contentdata/loader_test.go b/frontend/server/internal/contentdata/loader_test.go
index ab23ca5..4ea8cba 100644
--- a/frontend/server/internal/contentdata/loader_test.go
+++ b/frontend/server/internal/contentdata/loader_test.go
@@ -3,6 +3,7 @@ package contentdata
 import (
 	"os"
 	"path/filepath"
+	"regexp"
 	"testing"
 )
 
@@ -109,3 +110,38 @@ func TestLoadRealContentFiles(t *testing.T) {
 		}
 	}
 }
+
+// pages.yaml's title/description are interpolated as plain strings into
+// <title> and <meta name="description"> (base.html.tmpl), so html/template
+// escapes them. An HTML entity written in the YAML is therefore escaped a
+// second time and the user sees the literal source: "&plusmn;7-day" in the
+// SERP snippet, "Weather &amp; climate glossary" in the browser tab. Both
+// shipped live until this test existed.
+//
+// glossary.yaml's `body` is deliberately NOT checked: it is typed
+// template.HTML (see glossary_term.html.tmpl) and rendered raw, so entities
+// and <b> tags there are correct and must stay.
+func TestRealPagesHaveNoDoubleEscapedEntities(t *testing.T) {
+	dir := filepath.Join("..", "..", "..", "content")
+	if _, err := os.Stat(filepath.Join(dir, "pages.yaml")); err != nil {
+		t.Skipf("real content dir not available: %v", err)
+	}
+	pages, err := LoadPages(dir)
+	if err != nil {
+		t.Fatalf("LoadPages(real): %v", err)
+	}
+	// Named (&amp;), decimal (&#177;) and hex (&#xB1;) entity forms.
+	entity := regexp.MustCompile(`&([a-zA-Z][a-zA-Z0-9]*|#[0-9]+|#[xX][0-9a-fA-F]+);`)
+	for key, p := range pages {
+		for field, value := range map[string]string{
+			"title": p.Title, "description": p.Description,
+		} {
+			if m := entity.FindString(value); m != "" {
+				t.Errorf("pages.yaml[%s].%s contains the HTML entity %q; "+
+					"write the character literally (this field is escaped at "+
+					"render time, so the entity reaches the user as source)",
+					key, field, m)
+			}
+		}
+	}
+}