feat: Implement a honeypot field on our main search

[petesfrench]

Done

This work aims to add a basic honeypot field to our search to catch automated attacks

• Adds a honeypot input field to the navigation search form and search.html search form
• Creates search.js, a script responsible for catching and redirecting submission to the honey pot field. This is made globally available through main.js

QA

The follow QA steps should be complete for the navigation search & the search found under /search

• Make a regular search submission and see everything goes through as normal and the is only one query string present in the url q=
• Using the inspection tool, find the honey pot field. It is an input with the name 'search'. Add something to the value of this field.
• Add a value to the regular search field (this is required) and submit
• You should be redirected to /search. With no query parameters present in the URL and no search result returned.

We should make sure this doesn't interfere with any other searches

Issue / Card

Fixes https://warthogs.atlassian.net/browse/WD-14707

[webteam-app]

Demo

Jenkins

demos.haus

[petesfrench]

@samhotep I am not sure the failing playwright tests are related to this PR (even though they are on a 'search' field). As they are failing on my other ubuntu.com PRs also

[samhotep]

@petesfrench LGTM!
The only worry I have is that disabling JS will also effectively disable the honeypot, but setting up the honeypot in the backend would probably require changes in the search module itself.

[samhotep]

You might want to remove this console log, to give the bot's maintainer no hints :)

[petesfrench]

I was wondering about this. Maybe all the code should be obscured in some way

[samhotep]

Can we minify the JS?

[petesfrench]

@samhotep So I originally wanted to do this from within the search module, but as they works of request there was no way to strip the second search field from the url and it was looking very ugly. An alternative may be some 3rd party middleware. But we can look into that depending on how this goes.

[samhotep]

@samhotep So I originally wanted to do this from within the search module, but as they works of request there was no way to strip the second search field from the url and it was looking very ugly. An alternative may be some 3rd party middleware. But we can look into that depending on how this goes.

Sounds good to me, its definitely out of scope for this PR