Skip to content

Commit fde6ab2

Browse files
strakerstraker
committed
fix: do not allow postMessage with axe version of x.y.z
1 parent 8982c1a commit fde6ab2

12 files changed

Lines changed: 136 additions & 104 deletions

File tree

‎lib/core/utils/respondable.js‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -45,10 +45,7 @@
4545
var messageSource = _getSource();
4646
return (
4747
// Check the version matches
48-
postedMessage._source === messageSource ||
49-
// Allow free communication with axe test
50-
postedMessage._source === 'axeAPI.x.y.z' ||
51-
messageSource === 'axeAPI.x.y.z'
48+
postedMessage._source === messageSource
5249
);
5350
}
5451
return false;
@@ -159,7 +156,7 @@
159156
var topic = data.topic;
160157
var subscriber = subscribers[topic];
161158

162-
if (subscriber) {
159+
if (subscriber && source === window.parent) {
163160
var responder = createResponder(source, null, data.uuid);
164161
subscriber(data.message, keepalive, responder);
165162
}

‎test/core/base/audit.js‎

Lines changed: 37 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
/*global Audit, Rule, Promise */
22
describe('Audit', function() {
33
'use strict';
4+
var ver = axe.version.substring(0, axe.version.lastIndexOf('.'));
45

56
var a, getFlattenedTree;
67
var isNotCalled = function(err) {
@@ -117,7 +118,9 @@ describe('Audit', function() {
117118
audit._constructHelpUrls();
118119
assert.deepEqual(audit.data.rules.target, {
119120
helpUrl:
120-
'https://dequeuniversity.com/rules/axe/x.y/target?application=axeAPI'
121+
'https://dequeuniversity.com/rules/axe/' +
122+
ver +
123+
'/target?application=axeAPI'
121124
});
122125
});
123126
it('should use changed branding', function() {
@@ -133,7 +136,9 @@ describe('Audit', function() {
133136
audit._constructHelpUrls();
134137
assert.deepEqual(audit.data.rules.target, {
135138
helpUrl:
136-
'https://dequeuniversity.com/rules/thing/x.y/target?application=axeAPI'
139+
'https://dequeuniversity.com/rules/thing/' +
140+
ver +
141+
'/target?application=axeAPI'
137142
});
138143
});
139144
it('should use changed application', function() {
@@ -149,7 +154,9 @@ describe('Audit', function() {
149154
audit._constructHelpUrls();
150155
assert.deepEqual(audit.data.rules.target, {
151156
helpUrl:
152-
'https://dequeuniversity.com/rules/axe/x.y/target?application=thing'
157+
'https://dequeuniversity.com/rules/axe/' +
158+
ver +
159+
'/target?application=thing'
153160
});
154161
});
155162

@@ -161,7 +168,9 @@ describe('Audit', function() {
161168
selector: 'bob',
162169
metadata: {
163170
helpUrl:
164-
'https://dequeuniversity.com/rules/myproject/x.y/target1?application=axeAPI'
171+
'https://dequeuniversity.com/rules/myproject/' +
172+
ver +
173+
'/target1?application=axeAPI'
165174
}
166175
});
167176
audit.addRule({
@@ -172,7 +181,9 @@ describe('Audit', function() {
172181

173182
assert.equal(
174183
audit.data.rules.target1.helpUrl,
175-
'https://dequeuniversity.com/rules/myproject/x.y/target1?application=axeAPI'
184+
'https://dequeuniversity.com/rules/myproject/' +
185+
ver +
186+
'/target1?application=axeAPI'
176187
);
177188
assert.isUndefined(audit.data.rules.target2);
178189

@@ -182,11 +193,15 @@ describe('Audit', function() {
182193

183194
assert.equal(
184195
audit.data.rules.target1.helpUrl,
185-
'https://dequeuniversity.com/rules/myproject/x.y/target1?application=axeAPI'
196+
'https://dequeuniversity.com/rules/myproject/' +
197+
ver +
198+
'/target1?application=axeAPI'
186199
);
187200
assert.equal(
188201
audit.data.rules.target2.helpUrl,
189-
'https://dequeuniversity.com/rules/thing/x.y/target2?application=axeAPI'
202+
'https://dequeuniversity.com/rules/thing/' +
203+
ver +
204+
'/target2?application=axeAPI'
190205
);
191206
});
192207
it('understands prerelease type version numbers', function() {
@@ -207,24 +222,6 @@ describe('Audit', function() {
207222
'https://dequeuniversity.com/rules/axe/3.2/target?application=axeAPI'
208223
);
209224
});
210-
it('sets x.y as version for invalid versions', function() {
211-
var tempVersion = axe.version;
212-
var audit = new Audit();
213-
audit.addRule({
214-
id: 'target',
215-
matches: 'function () {return "hello";}',
216-
selector: 'bob'
217-
});
218-
219-
axe.version = 'in-3.0-valid';
220-
audit._constructHelpUrls();
221-
222-
axe.version = tempVersion;
223-
assert.equal(
224-
audit.data.rules.target.helpUrl,
225-
'https://dequeuniversity.com/rules/axe/x.y/target?application=axeAPI'
226-
);
227-
});
228225
it('matches major release versions', function() {
229226
var tempVersion = axe.version;
230227
var audit = new Audit();
@@ -258,7 +255,9 @@ describe('Audit', function() {
258255
audit._constructHelpUrls();
259256
assert.deepEqual(audit.data.rules.target, {
260257
helpUrl:
261-
'https://dequeuniversity.com/rules/axe/x.y/target?application=axeAPI&lang=de'
258+
'https://dequeuniversity.com/rules/axe/' +
259+
ver +
260+
'/target?application=axeAPI&lang=de'
262261
});
263262
});
264263
});
@@ -298,7 +297,9 @@ describe('Audit', function() {
298297
});
299298
assert.deepEqual(audit.data.rules.target, {
300299
helpUrl:
301-
'https://dequeuniversity.com/rules/axe/x.y/target?application=thing'
300+
'https://dequeuniversity.com/rules/axe/' +
301+
ver +
302+
'/target?application=thing'
302303
});
303304
});
304305
it('should call _constructHelpUrls even when nothing changed', function() {
@@ -313,7 +314,9 @@ describe('Audit', function() {
313314
audit.setBranding(undefined);
314315
assert.deepEqual(audit.data.rules.target, {
315316
helpUrl:
316-
'https://dequeuniversity.com/rules/axe/x.y/target?application=axeAPI'
317+
'https://dequeuniversity.com/rules/axe/' +
318+
ver +
319+
'/target?application=axeAPI'
317320
});
318321
});
319322
it('should not replace custom set branding', function() {
@@ -324,7 +327,9 @@ describe('Audit', function() {
324327
selector: 'bob',
325328
metadata: {
326329
helpUrl:
327-
'https://dequeuniversity.com/rules/customer-x/x.y/target?application=axeAPI'
330+
'https://dequeuniversity.com/rules/customer-x/' +
331+
ver +
332+
'/target?application=axeAPI'
328333
}
329334
});
330335
audit.setBranding({
@@ -333,7 +338,9 @@ describe('Audit', function() {
333338
});
334339
assert.equal(
335340
audit.data.rules.target.helpUrl,
336-
'https://dequeuniversity.com/rules/customer-x/x.y/target?application=axeAPI'
341+
'https://dequeuniversity.com/rules/customer-x/' +
342+
ver +
343+
'/target?application=axeAPI'
337344
);
338345
});
339346
});

‎test/core/export.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,6 @@ describe('export', function() {
55
assert.isDefined(window.axe);
66
});
77
it('should define version', function() {
8-
assert.equal(axe.version, 'x.y.z');
8+
assert.isNotNull(axe.version);
99
});
1010
});

‎test/core/public/configure.js‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ describe('axe.configure', function() {
33
'use strict';
44
var fixture = document.getElementById('fixture');
55
var axeVersion = axe.version;
6+
var ver = axe.version.substring(0, axe.version.lastIndexOf('.'));
67

78
afterEach(function() {
89
fixture.innerHTML = '';
@@ -94,7 +95,7 @@ describe('axe.configure', function() {
9495
assert.lengthOf(axe._audit.rules, 1);
9596
assert.equal(
9697
axe._audit.data.rules.bob.helpUrl,
97-
'https://dequeuniversity.com/rules/axe/x.y/bob?application=axeAPI'
98+
'https://dequeuniversity.com/rules/axe/' + ver + '/bob?application=axeAPI'
9899
);
99100
axe.configure({
100101
branding: {
@@ -104,7 +105,9 @@ describe('axe.configure', function() {
104105
});
105106
assert.equal(
106107
axe._audit.data.rules.bob.helpUrl,
107-
'https://dequeuniversity.com/rules/thung/x.y/bob?application=thing'
108+
'https://dequeuniversity.com/rules/thung/' +
109+
ver +
110+
'/bob?application=thing'
108111
);
109112
});
110113

@@ -127,7 +130,9 @@ describe('axe.configure', function() {
127130

128131
assert.equal(
129132
axe._audit.data.rules.bob.helpUrl,
130-
'https://dequeuniversity.com/rules/thung/x.y/bob?application=thing'
133+
'https://dequeuniversity.com/rules/thung/' +
134+
ver +
135+
'/bob?application=thing'
131136
);
132137
});
133138

‎test/core/public/get-rules.js‎

Lines changed: 22 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
describe('axe.getRules', function() {
22
'use strict';
3+
var ver = axe.version.substring(0, axe.version.lastIndexOf('.'));
34

45
beforeEach(function() {
56
axe._load({
@@ -46,7 +47,9 @@ describe('axe.getRules', function() {
4647
assert.equal(retValue[0].help, 'halp');
4748
assert.equal(
4849
retValue[0].helpUrl,
49-
'https://dequeuniversity.com/rules/axe/x.y/awesomeRule1?application=axeAPI'
50+
'https://dequeuniversity.com/rules/axe/' +
51+
ver +
52+
'/awesomeRule1?application=axeAPI'
5053
);
5154
assert.deepEqual(retValue[0].tags, ['tag1']);
5255

@@ -55,7 +58,9 @@ describe('axe.getRules', function() {
5558
assert.equal(retValue[1].help, 'halp me!');
5659
assert.equal(
5760
retValue[1].helpUrl,
58-
'https://dequeuniversity.com/rules/axe/x.y/awesomeRule2?application=axeAPI'
61+
'https://dequeuniversity.com/rules/axe/' +
62+
ver +
63+
'/awesomeRule2?application=axeAPI'
5964
);
6065
assert.deepEqual(retValue[1].tags, ['tag1', 'tag2']);
6166

@@ -67,7 +72,9 @@ describe('axe.getRules', function() {
6772
assert.equal(retValue[0].help, 'halp me!');
6873
assert.equal(
6974
retValue[0].helpUrl,
70-
'https://dequeuniversity.com/rules/axe/x.y/awesomeRule2?application=axeAPI'
75+
'https://dequeuniversity.com/rules/axe/' +
76+
ver +
77+
'/awesomeRule2?application=axeAPI'
7178
);
7279
assert.deepEqual(retValue[0].tags, ['tag1', 'tag2']);
7380
});
@@ -85,7 +92,9 @@ describe('axe.getRules', function() {
8592
assert.equal(retValue[0].help, 'halp');
8693
assert.equal(
8794
retValue[0].helpUrl,
88-
'https://dequeuniversity.com/rules/axe/x.y/awesomeRule1?application=axeAPI'
95+
'https://dequeuniversity.com/rules/axe/' +
96+
ver +
97+
'/awesomeRule1?application=axeAPI'
8998
);
9099
assert.deepEqual(retValue[0].tags, ['tag1']);
91100

@@ -94,7 +103,9 @@ describe('axe.getRules', function() {
94103
assert.equal(retValue[1].help, 'halp me!');
95104
assert.equal(
96105
retValue[1].helpUrl,
97-
'https://dequeuniversity.com/rules/axe/x.y/awesomeRule2?application=axeAPI'
106+
'https://dequeuniversity.com/rules/axe/' +
107+
ver +
108+
'/awesomeRule2?application=axeAPI'
98109
);
99110
assert.deepEqual(retValue[1].tags, ['tag1', 'tag2']);
100111
});
@@ -106,7 +117,9 @@ describe('axe.getRules', function() {
106117
assert.equal(retValue[0].help, 'halp');
107118
assert.equal(
108119
retValue[0].helpUrl,
109-
'https://dequeuniversity.com/rules/axe/x.y/awesomeRule1?application=axeAPI'
120+
'https://dequeuniversity.com/rules/axe/' +
121+
ver +
122+
'/awesomeRule1?application=axeAPI'
110123
);
111124
assert.deepEqual(retValue[0].tags, ['tag1']);
112125

@@ -115,7 +128,9 @@ describe('axe.getRules', function() {
115128
assert.equal(retValue[1].help, 'halp me!');
116129
assert.equal(
117130
retValue[1].helpUrl,
118-
'https://dequeuniversity.com/rules/axe/x.y/awesomeRule2?application=axeAPI'
131+
'https://dequeuniversity.com/rules/axe/' +
132+
ver +
133+
'/awesomeRule2?application=axeAPI'
119134
);
120135
assert.deepEqual(retValue[1].tags, ['tag1', 'tag2']);
121136
});

‎test/core/public/run-rules.js‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
/*global runRules */
22
describe('runRules', function() {
33
'use strict';
4+
var ver = axe.version.substring(0, axe.version.lastIndexOf('.'));
45

56
// These tests can sometimes be flaky in IE, allow for up to 3 retries
67
if (axe.testUtils.isIE11) {
@@ -206,7 +207,9 @@ describe('runRules', function() {
206207
{
207208
id: 'div#target',
208209
helpUrl:
209-
'https://dequeuniversity.com/rules/axe/x.y/div#target?application=axeAPI',
210+
'https://dequeuniversity.com/rules/axe/' +
211+
ver +
212+
'/div#target?application=axeAPI',
210213
pageLevel: false,
211214
impact: null,
212215
inapplicable: [],
@@ -241,7 +244,9 @@ describe('runRules', function() {
241244
{
242245
id: 'first-div',
243246
helpUrl:
244-
'https://dequeuniversity.com/rules/axe/x.y/first-div?application=axeAPI',
247+
'https://dequeuniversity.com/rules/axe/' +
248+
ver +
249+
'/first-div?application=axeAPI',
245250
pageLevel: false,
246251
impact: null,
247252
inapplicable: [],
@@ -493,7 +498,9 @@ describe('runRules', function() {
493498
{
494499
id: 'div#target',
495500
helpUrl:
496-
'https://dequeuniversity.com/rules/axe/x.y/div#target?application=axeAPI',
501+
'https://dequeuniversity.com/rules/axe/' +
502+
ver +
503+
'/div#target?application=axeAPI',
497504
pageLevel: false,
498505
foo: 'bar',
499506
stuff: 'blah',
@@ -530,7 +537,9 @@ describe('runRules', function() {
530537
{
531538
id: 'first-div',
532539
helpUrl:
533-
'https://dequeuniversity.com/rules/axe/x.y/first-div?application=axeAPI',
540+
'https://dequeuniversity.com/rules/axe/' +
541+
ver +
542+
'/first-div?application=axeAPI',
534543
pageLevel: false,
535544
bar: 'foo',
536545
stuff: 'no',

0 commit comments

Comments
 (0)