The escaping bug that only shows up with a second query param

My affiliate-link package has a function that retargets already-rendered HTML for reposts: swap the canonical site’s Amazon tag for a Medium-specific one, say, without recompiling the page. It builds a map of default URL to channel URL and does exact string substitution against the rendered output.

It had exactly one latent bug, and the bug only exists in URLs that don’t exist yet.

A bug with no current victim

buildChannelRewriteMap keys its substitution map on the raw resolved URL. rewriteAffiliateLinksForChannel does exact string matching against rendered HTML looking for that key.

The problem: rendered HTML escapes & as & inside href attributes. A URL with two query params - ?tag=example-20&ref=homepage - renders as ?tag=example-20&ref=homepage in the actual page. The raw map key never matches. The repost silently keeps the default tag, and nothing tells you it failed. Not a build error, not a warning, just wrong attribution data flowing quietly into a dashboard somewhere.

Today, every URL this function touches has exactly one query param. No & anywhere. The bug has never fired in production. It’s one added query param away from being a real, silent data-quality problem, the kind you discover weeks later staring at Associates reporting numbers that don’t add up.

Writing a test for a bug that isn’t there yet

The existing fixtures were all single-param URLs, which meant they’d pass whether or not the fix worked. A test suite that’s green today isn’t proof of anything if none of your fixtures can exercise the failure mode. I added a second program with a two-param URL specifically so there was a real ampersand to escape, then a test that checks the rewrite against HTML shaped like what a browser actually renders - the escaped form, not the raw one:

const html = '<a href="https://example.com/deal?ref=site&amp;utm_source=site">Deal</a>';
const rewritten = rewriteAffiliateLinksForChannel(html, config, 'medium');
assert.equal(rewritten, '<a href="https://example.com/deal?ref=site-medium&amp;utm_source=site">Deal</a>');

The fix itself is small: add the escaped variant of each ampersand-bearing default URL to the map, pointing at the escaped channel URL, guarded so single-param URLs don’t get a pointless duplicate entry.

map[defaultResolved.url] = channelResolved.url;
const escapedDefault = defaultResolved.url.replace(/&/g, '&');
if (escapedDefault !== defaultResolved.url) {
  map[escapedDefault] = channelResolved.url.replace(/&/g, '&');
}

Also in this batch

Three smaller items landed in the same release, since they touched the same package. The URL builder hardcoded www.amazon.com; a planned Brazilian-market post needs amazon.com.br with its own Associates tag, so that’s now a domain field on the program config, defaulting to the US domain so nothing existing changes. AffiliateDisclosure has accepted a locale prop and a localized disclosure-text shape since early on, and the README never mentioned either - a real, working feature invisible to anyone who hadn’t read the source. And three of the four sibling packages in this family carry a conventions file for future agent sessions; this one didn’t, so it got the template with one adjustment for the thing this package does differently.

What I’d check next time

“This has never broken in production” is not the same claim as “this can’t break.” The Amazon URLs are single-param by accident of what Amazon’s scheme happens to need today, not by any guarantee that stays true. Test fixtures that can only exercise the working path give you false confidence. When a report describes a class of input your fixtures don’t cover, add a fixture that covers it before touching the fix, so the test can actually fail on the old code.