I think it does casually suggest that there should have been a test for the '/' literal, which seems simplistic. In addition to testing for google.com, a more

I think it does casually suggest that there should have been a test for the '/' literal, which seems simplistic. In addition to testing for google.com, a more robust test might be to assert that >90% (or some such threshhold) of results for a basket of random searches are not malware, as a sanity check. Of course it's possible that a large proportion of random search results suddenly become malicious. But in that situation I'd want some alert to trip anyhow and get someone figure out what was happening to the web!