Skip to content

Commit a05264f

Browse files
strakerstraker
committed
fix: do not allow postMessage with axe version of x.y.z
1 parent e994323 commit a05264f

12 files changed

Lines changed: 132 additions & 105 deletions

File tree

‎lib/core/utils/respondable.js‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -45,10 +45,7 @@
4545
var messageSource = _getSource();
4646
return (
4747
// Check the version matches
48-
postedMessage._source === messageSource ||
49-
// Allow free communication with axe test
50-
postedMessage._source === 'axeAPI.x.y.z' ||
51-
messageSource === 'axeAPI.x.y.z'
48+
postedMessage._source === messageSource
5249
);
5350
}
5451
return false;
@@ -152,7 +149,7 @@
152149
var topic = data.topic;
153150
var subscriber = subscribers[topic];
154151

155-
if (subscriber) {
152+
if (subscriber && source === window.parent) {
156153
var responder = createResponder(source, null, data.uuid);
157154
subscriber(data.message, keepalive, responder);
158155
}

‎test/core/base/audit.js‎

Lines changed: 34 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
/*global Audit, Rule */
22
describe('Audit', function() {
33
'use strict';
4+
var ver = axe.version.substring(0, axe.version.lastIndexOf('.'));
45

56
var a, getFlattenedTree;
67
var isNotCalled = function(err) {
@@ -117,7 +118,9 @@ describe('Audit', function() {
117118
audit._constructHelpUrls();
118119
assert.deepEqual(audit.data.rules.target, {
119120
helpUrl:
120-
'https://dequeuniversity.com/rules/axe/x.y/target?application=axeAPI'
121+
'https://dequeuniversity.com/rules/axe/' +
122+
ver +
123+
'/target?application=axeAPI'
121124
});
122125
});
123126
it('should use changed branding', function() {
@@ -133,7 +136,9 @@ describe('Audit', function() {
133136
audit._constructHelpUrls();
134137
assert.deepEqual(audit.data.rules.target, {
135138
helpUrl:
136-
'https://dequeuniversity.com/rules/thing/x.y/target?application=axeAPI'
139+
'https://dequeuniversity.com/rules/thing/' +
140+
ver +
141+
'/target?application=axeAPI'
137142
});
138143
});
139144
it('should use changed application', function() {
@@ -149,7 +154,9 @@ describe('Audit', function() {
149154
audit._constructHelpUrls();
150155
assert.deepEqual(audit.data.rules.target, {
151156
helpUrl:
152-
'https://dequeuniversity.com/rules/axe/x.y/target?application=thing'
157+
'https://dequeuniversity.com/rules/axe/' +
158+
ver +
159+
'/target?application=thing'
153160
});
154161
});
155162

@@ -161,7 +168,9 @@ describe('Audit', function() {
161168
selector: 'bob',
162169
metadata: {
163170
helpUrl:
164-
'https://dequeuniversity.com/rules/myproject/x.y/target1?application=axeAPI'
171+
'https://dequeuniversity.com/rules/myproject/' +
172+
ver +
173+
'/target1?application=axeAPI'
165174
}
166175
});
167176
audit.addRule({
@@ -172,7 +181,9 @@ describe('Audit', function() {
172181

173182
assert.equal(
174183
audit.data.rules.target1.helpUrl,
175-
'https://dequeuniversity.com/rules/myproject/x.y/target1?application=axeAPI'
184+
'https://dequeuniversity.com/rules/myproject/' +
185+
ver +
186+
'/target1?application=axeAPI'
176187
);
177188
assert.isUndefined(audit.data.rules.target2);
178189

@@ -182,11 +193,15 @@ describe('Audit', function() {
182193

183194
assert.equal(
184195
audit.data.rules.target1.helpUrl,
185-
'https://dequeuniversity.com/rules/myproject/x.y/target1?application=axeAPI'
196+
'https://dequeuniversity.com/rules/myproject/' +
197+
ver +
198+
'/target1?application=axeAPI'
186199
);
187200
assert.equal(
188201
audit.data.rules.target2.helpUrl,
189-
'https://dequeuniversity.com/rules/thing/x.y/target2?application=axeAPI'
202+
'https://dequeuniversity.com/rules/thing/' +
203+
ver +
204+
'/target2?application=axeAPI'
190205
);
191206
});
192207
it('understands prerelease type version numbers', function() {
@@ -207,24 +222,6 @@ describe('Audit', function() {
207222
'https://dequeuniversity.com/rules/axe/3.2/target?application=axeAPI'
208223
);
209224
});
210-
it('sets x.y as version for invalid versions', function() {
211-
var tempVersion = axe.version;
212-
var audit = new Audit();
213-
audit.addRule({
214-
id: 'target',
215-
matches: 'function () {return "hello";}',
216-
selector: 'bob'
217-
});
218-
219-
axe.version = 'in-3.0-valid';
220-
audit._constructHelpUrls();
221-
222-
axe.version = tempVersion;
223-
assert.equal(
224-
audit.data.rules.target.helpUrl,
225-
'https://dequeuniversity.com/rules/axe/x.y/target?application=axeAPI'
226-
);
227-
});
228225
it('matches major release versions', function() {
229226
var tempVersion = axe.version;
230227
var audit = new Audit();
@@ -280,7 +277,9 @@ describe('Audit', function() {
280277
});
281278
assert.deepEqual(audit.data.rules.target, {
282279
helpUrl:
283-
'https://dequeuniversity.com/rules/axe/x.y/target?application=thing'
280+
'https://dequeuniversity.com/rules/axe/' +
281+
ver +
282+
'/target?application=thing'
284283
});
285284
});
286285
it('should call _constructHelpUrls even when nothing changed', function() {
@@ -295,7 +294,9 @@ describe('Audit', function() {
295294
audit.setBranding(undefined);
296295
assert.deepEqual(audit.data.rules.target, {
297296
helpUrl:
298-
'https://dequeuniversity.com/rules/axe/x.y/target?application=axeAPI'
297+
'https://dequeuniversity.com/rules/axe/' +
298+
ver +
299+
'/target?application=axeAPI'
299300
});
300301
});
301302
it('should not replace custom set branding', function() {
@@ -306,7 +307,9 @@ describe('Audit', function() {
306307
selector: 'bob',
307308
metadata: {
308309
helpUrl:
309-
'https://dequeuniversity.com/rules/customer-x/x.y/target?application=axeAPI'
310+
'https://dequeuniversity.com/rules/customer-x/' +
311+
ver +
312+
'/target?application=axeAPI'
310313
}
311314
});
312315
audit.setBranding({
@@ -315,7 +318,9 @@ describe('Audit', function() {
315318
});
316319
assert.equal(
317320
audit.data.rules.target.helpUrl,
318-
'https://dequeuniversity.com/rules/customer-x/x.y/target?application=axeAPI'
321+
'https://dequeuniversity.com/rules/customer-x/' +
322+
ver +
323+
'/target?application=axeAPI'
319324
);
320325
});
321326
});

‎test/core/export.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,6 @@ describe('export', function() {
55
assert.isDefined(window.axe);
66
});
77
it('should define version', function() {
8-
assert.equal(axe.version, 'x.y.z');
8+
assert.isNotNull(axe.version);
99
});
1010
});

‎test/core/public/configure.js‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
describe('axe.configure', function() {
33
'use strict';
44
var fixture = document.getElementById('fixture');
5+
var ver = axe.version.substring(0, axe.version.lastIndexOf('.'));
56

67
afterEach(function() {
78
fixture.innerHTML = '';
@@ -68,7 +69,7 @@ describe('axe.configure', function() {
6869
assert.lengthOf(axe._audit.rules, 1);
6970
assert.equal(
7071
axe._audit.data.rules.bob.helpUrl,
71-
'https://dequeuniversity.com/rules/axe/x.y/bob?application=axeAPI'
72+
'https://dequeuniversity.com/rules/axe/' + ver + '/bob?application=axeAPI'
7273
);
7374
axe.configure({
7475
branding: {
@@ -78,7 +79,9 @@ describe('axe.configure', function() {
7879
});
7980
assert.equal(
8081
axe._audit.data.rules.bob.helpUrl,
81-
'https://dequeuniversity.com/rules/thung/x.y/bob?application=thing'
82+
'https://dequeuniversity.com/rules/thung/' +
83+
ver +
84+
'/bob?application=thing'
8285
);
8386
});
8487

@@ -101,7 +104,9 @@ describe('axe.configure', function() {
101104

102105
assert.equal(
103106
axe._audit.data.rules.bob.helpUrl,
104-
'https://dequeuniversity.com/rules/thung/x.y/bob?application=thing'
107+
'https://dequeuniversity.com/rules/thung/' +
108+
ver +
109+
'/bob?application=thing'
105110
);
106111
});
107112

‎test/core/public/get-rules.js‎

Lines changed: 22 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
describe('axe.getRules', function() {
22
'use strict';
3+
var ver = axe.version.substring(0, axe.version.lastIndexOf('.'));
34

45
beforeEach(function() {
56
axe._load({
@@ -46,7 +47,9 @@ describe('axe.getRules', function() {
4647
assert.equal(retValue[0].help, 'halp');
4748
assert.equal(
4849
retValue[0].helpUrl,
49-
'https://dequeuniversity.com/rules/axe/x.y/awesomeRule1?application=axeAPI'
50+
'https://dequeuniversity.com/rules/axe/' +
51+
ver +
52+
'/awesomeRule1?application=axeAPI'
5053
);
5154
assert.deepEqual(retValue[0].tags, ['tag1']);
5255

@@ -55,7 +58,9 @@ describe('axe.getRules', function() {
5558
assert.equal(retValue[1].help, 'halp me!');
5659
assert.equal(
5760
retValue[1].helpUrl,
58-
'https://dequeuniversity.com/rules/axe/x.y/awesomeRule2?application=axeAPI'
61+
'https://dequeuniversity.com/rules/axe/' +
62+
ver +
63+
'/awesomeRule2?application=axeAPI'
5964
);
6065
assert.deepEqual(retValue[1].tags, ['tag1', 'tag2']);
6166

@@ -67,7 +72,9 @@ describe('axe.getRules', function() {
6772
assert.equal(retValue[0].help, 'halp me!');
6873
assert.equal(
6974
retValue[0].helpUrl,
70-
'https://dequeuniversity.com/rules/axe/x.y/awesomeRule2?application=axeAPI'
75+
'https://dequeuniversity.com/rules/axe/' +
76+
ver +
77+
'/awesomeRule2?application=axeAPI'
7178
);
7279
assert.deepEqual(retValue[0].tags, ['tag1', 'tag2']);
7380
});
@@ -85,7 +92,9 @@ describe('axe.getRules', function() {
8592
assert.equal(retValue[0].help, 'halp');
8693
assert.equal(
8794
retValue[0].helpUrl,
88-
'https://dequeuniversity.com/rules/axe/x.y/awesomeRule1?application=axeAPI'
95+
'https://dequeuniversity.com/rules/axe/' +
96+
ver +
97+
'/awesomeRule1?application=axeAPI'
8998
);
9099
assert.deepEqual(retValue[0].tags, ['tag1']);
91100

@@ -94,7 +103,9 @@ describe('axe.getRules', function() {
94103
assert.equal(retValue[1].help, 'halp me!');
95104
assert.equal(
96105
retValue[1].helpUrl,
97-
'https://dequeuniversity.com/rules/axe/x.y/awesomeRule2?application=axeAPI'
106+
'https://dequeuniversity.com/rules/axe/' +
107+
ver +
108+
'/awesomeRule2?application=axeAPI'
98109
);
99110
assert.deepEqual(retValue[1].tags, ['tag1', 'tag2']);
100111
});
@@ -106,7 +117,9 @@ describe('axe.getRules', function() {
106117
assert.equal(retValue[0].help, 'halp');
107118
assert.equal(
108119
retValue[0].helpUrl,
109-
'https://dequeuniversity.com/rules/axe/x.y/awesomeRule1?application=axeAPI'
120+
'https://dequeuniversity.com/rules/axe/' +
121+
ver +
122+
'/awesomeRule1?application=axeAPI'
110123
);
111124
assert.deepEqual(retValue[0].tags, ['tag1']);
112125

@@ -115,7 +128,9 @@ describe('axe.getRules', function() {
115128
assert.equal(retValue[1].help, 'halp me!');
116129
assert.equal(
117130
retValue[1].helpUrl,
118-
'https://dequeuniversity.com/rules/axe/x.y/awesomeRule2?application=axeAPI'
131+
'https://dequeuniversity.com/rules/axe/' +
132+
ver +
133+
'/awesomeRule2?application=axeAPI'
119134
);
120135
assert.deepEqual(retValue[1].tags, ['tag1', 'tag2']);
121136
});

‎test/core/public/run-rules.js‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
/*global runRules */
22
describe('runRules', function() {
33
'use strict';
4+
var ver = axe.version.substring(0, axe.version.lastIndexOf('.'));
45

56
function iframeReady(src, context, id, cb) {
67
var i = document.createElement('iframe');
@@ -198,7 +199,9 @@ describe('runRules', function() {
198199
{
199200
id: 'div#target',
200201
helpUrl:
201-
'https://dequeuniversity.com/rules/axe/x.y/div#target?application=axeAPI',
202+
'https://dequeuniversity.com/rules/axe/' +
203+
ver +
204+
'/div#target?application=axeAPI',
202205
pageLevel: false,
203206
impact: null,
204207
inapplicable: [],
@@ -233,7 +236,9 @@ describe('runRules', function() {
233236
{
234237
id: 'first-div',
235238
helpUrl:
236-
'https://dequeuniversity.com/rules/axe/x.y/first-div?application=axeAPI',
239+
'https://dequeuniversity.com/rules/axe/' +
240+
ver +
241+
'/first-div?application=axeAPI',
237242
pageLevel: false,
238243
impact: null,
239244
inapplicable: [],
@@ -485,7 +490,9 @@ describe('runRules', function() {
485490
{
486491
id: 'div#target',
487492
helpUrl:
488-
'https://dequeuniversity.com/rules/axe/x.y/div#target?application=axeAPI',
493+
'https://dequeuniversity.com/rules/axe/' +
494+
ver +
495+
'/div#target?application=axeAPI',
489496
pageLevel: false,
490497
foo: 'bar',
491498
stuff: 'blah',
@@ -522,7 +529,9 @@ describe('runRules', function() {
522529
{
523530
id: 'first-div',
524531
helpUrl:
525-
'https://dequeuniversity.com/rules/axe/x.y/first-div?application=axeAPI',
532+
'https://dequeuniversity.com/rules/axe/' +
533+
ver +
534+
'/first-div?application=axeAPI',
526535
pageLevel: false,
527536
bar: 'foo',
528537
stuff: 'no',

0 commit comments

Comments
 (0)