Restore default template binding across browser sessions

核桃派软件源代码/tests/test_api.py

@@ -23,6 +23,16 @@ def solid_scene(color=(12, 34, 56)):
     }
 
 
+def test_homepage_exposes_escaped_boot_session_without_changing_rest_contract(tmp_path):
+    boot_id = 'boot-"<unsafe>&'
+    with TestClient(create_app(project_root=tmp_path, driver_kind="mock", startup_boot_id=boot_id)) as client:
+        response = client.get("/")
+        assert response.status_code == 200
+        assert '<meta name="device-boot-id" content="boot-&quot;&lt;unsafe&gt;&amp;">' in response.text
+        assert response.headers["cache-control"] == "no-store"
+        assert 'name="device-boot-id"' not in client.get("/api/status").text
+
+
 def test_status_config_and_display_api(tmp_path):
     client = TestClient(create_app(project_root=tmp_path, driver_kind="mock"))