Quality Assurance · End-to-End Test Report
HTML Code Page — E2E Testing Report
Appy Pie Website Builder (Snappy) · Store RE · Free PWA & Custom Domain
✓ VERDICT: GO — PRODUCTION-USABLE1Executive Summary
The HTML Code page feature works well end-to-end on the live Store RE site. Authoring (HTML/CSS/JS), tab isolation, live Preview, Save-persistence, and live-domain serving all function correctly, and the feature has a strong, verified XSS-sanitization posture across editor → preview → save → live. No High/Critical defects were found. The remaining items are known low-severity UX / validation gaps, not functional breakages.
Key facts: Save is coupled to instant live publish to the custom domain (with an explicit success modal), plus a separate silent draft-autosave. Pages serve over valid HTTPS at clean, non-tokenised URLs (no 403 on direct access), so the App-Builder 48h-token risk (RISK-1) does not apply here.
2Environment & Scope
| Editor | snappy.appypie.com/website/creator-software/build (single Ace instance, HTML/CSS/JS tabs, Preview + Save) |
| Plan | Grow Monthly |
| Free PWA domain | Site bound to the custom domain; free *.pwastore.com subdomain shows “Site Not Published” |
| Custom domain | www.onlinestore.casino — Active, valid HTTPS, no mixed content |
| Coverage | 16 scenarios: positive, negative, edge & security |
3Per-Scenario Results
| # | Scenario | Actual observed | Status |
|---|---|---|---|
| 1 | Create HTML Code page | Created, in list + nav; 3-tab editor opens (pre-filled starter template) | PASS |
| 2 | Author HTML / CSS / JS | All authored; content lengths verified | PASS |
| 3 | Tab isolation | HTML/CSS/JS retained across cycling; no bleed | PASS |
| 4 | Preview renders | HTML rendered, CSS applied, JS executed, iframe rendered | PASS |
| 5 | Save persists (reload) | All content intact & rendering after full reload | PASS |
| 6 | Live serving on domain | Renders live over HTTPS; direct-URL OK, no 403; JS runs live | PASS |
| 7 | Empty save (all tabs blank) | Allowed with no warning; blank page published live | DEF-2 |
| 8 | Navigate away unsaved | No prompt, but edit retained as draft → no data loss | DEF-1 |
| 9 | Save confirmation | Explicit success modal “changes are now live” | PASS |
| 10 | Malformed / unclosed HTML | Parser auto-corrected; builder did not crash | PASS |
| 11 | HTML Code vs Codepage | Genuinely different features (see findings) | NOTE |
| 12 | <script> injection | Never executed; script stripped on save | SANITIZED |
| 13 | <img onerror> XSS | Never executed; onerror attribute stripped | SANITIZED |
| 14 | iframe / external embed | Renders in preview + live; no mixed content | BY DESIGN |
| 15 | Bootstrap class collision | Bare .dropdown-menu → display:none; namespaced class works | RISK-2 |
| 16 | Custom domain SSL + token gating | Valid HTTPS; clean non-token URLs; no 403 | PASS |
4Defects & Findings
F1 — Empty page saves & publishes with no validation (DEF-2)
Clearing all three tabs and saving publishes a blank page live with no warning. Re-verified. Recommend blocking or confirming empty saves.
F2 — Bootstrap class collision (RISK-2)
The site loads Bootstrap; a bare .dropdown-menu computes display:none, silently hiding un-namespaced custom UI on the live page. Workaround: namespace author classes.
F3 — No unsaved/unpublished-changes guard (DEF-1)
No prompt when leaving the editor, but edits auto-retain as a draft (survive nav + reload) — so no data is lost. Residual risk: a user may not realise the draft differs from what is published.
F4 — “HTML Code” vs “Codepage” ambiguity (DEF-4)
Both surface under the “HTML” search. HTML Code = free 3-tab HTML/CSS/JS editor + live Preview. Codepage = premium, single “Body” textarea + in-app-nav/lock toggles. Near-identical naming confuses users.
F5 — Save = instant live publish
Each Save pushes changes to the live custom domain and shows a success modal; a separate silent draft-autosave keeps edits across reload. Documented behaviour, not a defect.
5Regression Status of Known Issues
| ID | Issue | Status |
|---|---|---|
| DEF-1 | Unsaved-changes guard | Still absent — but no data loss (draft retained) |
| DEF-2 | Empty save allowed | Still present |
| DEF-3 | No save confirmation | Not reproduced — modal shown (a “Don’t show again” checkbox can suppress it) |
| DEF-4 | HTML Code vs Codepage | Confirmed — real naming ambiguity |
| RISK-1 | 48h token / direct-URL 403 | Not applicable — clean non-token URLs, no 403 |
| RISK-2 | Bootstrap collision | Still present (confirmed on live) |
6Security Assessment
| XSS | Sanitized end-to-end (strong). <script> never executes; inline onerror removed on save. Verified at 4 layers: persisted editor value, preview iframe, live DOM, and raw server HTML. The dedicated JS tab runs by design (owner code, editor-auth-gated). |
| SSL | Custom domain over HTTPS; no certificate warning; no mixed content. |
| iframe | External embeds allowed and render (author’s responsibility). |
| URL gating | Clean public paths, no token, no 403 — appropriate for a website builder. |
7Recommendations
- 1Block/confirm empty saves before publishing a blank live page (DEF-2). Low-Med
- 2Isolate author CSS/HTML (iframe / shadow-DOM or documented namespacing) so Bootstrap class names don’t break custom UI (RISK-2). Low-Med
- 3Add an “unpublished changes” indicator when leaving the editor (DEF-1). Low
- 4Disambiguate HTML Code vs Codepage naming/icons (DEF-4). Low
- 5Reconcile “Site Not Published” vs “changes are now live” states for clarity. Low
- 6Keep the current XSS sanitization; document that scripting belongs in the JS tab. Info
