From bfa945aeadaf2a666d35ba47696292fe2644d84f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Noah=20Gro=C3=9F?= <me@codesalat.dev>
Date: Thu, 27 Feb 2025 11:19:47 +0000
Subject: [PATCH] Properly escape search queries in URIs

---
 python_picnic_api2/client.py | 3 ++-
 tests/test_client.py         | 8 ++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/python_picnic_api2/client.py b/python_picnic_api2/client.py
index 415504e..b1b04bd 100644
--- a/python_picnic_api2/client.py
+++ b/python_picnic_api2/client.py
@@ -1,5 +1,6 @@
 import re
 from hashlib import md5
+from urllib.parse import quote
 
 import typing_extensions
 
@@ -95,7 +96,7 @@ def get_user(self):
         return self._get("/user")
 
     def search(self, term: str):
-        path = f"/pages/search-page-results?search_term={term}"
+        path = f"/pages/search-page-results?search_term={quote(term)}"
         raw_results = self._get(path, add_picnic_headers=True)
         return _extract_search_results(raw_results)
 
diff --git a/tests/test_client.py b/tests/test_client.py
index e56bdd9..727129c 100644
--- a/tests/test_client.py
+++ b/tests/test_client.py
@@ -98,6 +98,14 @@ def test_search(self):
             headers=PICNIC_HEADERS,
         )
 
+    def test_search_encoding(self):
+        self.client.search("Gut&Günstig H-Milch")
+        self.session_mock().get.assert_called_with(
+            self.expected_base_url
+            + "/pages/search-page-results?search_term=Gut%26G%C3%BCnstig%20H-Milch",
+            headers=PICNIC_HEADERS,
+        )
+
     def test_get_cart(self):
         self.client.get_cart()
         self.session_mock().get.assert_called_with(