dequelabs / dequelabs/axe-core
axe-core emits errors instead of frame-tested violations for some types of iframes
- Dominant language
- JavaScript
- Stars
- 7.5k
- Forks
- 933
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 17
Description
Product: axe-core
Summary: When axe-core's default frameMessenger hits a postMessage error, it results in an `Error` leaking from `await axe.run()`, where it would ideally instead result in the scan completing with a [frame-tested](https://dequeuniversity.com/rules/axe/4.2/frame-tested) violation for the frame in question.
Some specific variants that can trigger the issue:
* A `file://` url that embeds an iframe which axe-core *could* normally reach will emit an error with message `allowedOrigins value "null" is not a valid origin`
* Any page that embeds an iframe which the browser prevents cross-origin access to (eg, a `file://` url that embeds an `https://` page) will emit a `SecurityError` with message `Blocked a frame with origin "null" from accessing a cross-origin frame.`
* In Chromium, the message is `Blocked a frame with origin "null" from accessing a cross-origin frame.`
* In Firefox, the message is `Permission denied to access property "DOMException" on cross-origin object`
Repro steps:
1. Download this [self-contained repro gist](https://gist.github.com/dbjorge/0ed95f6b3300df62baa6b731d153809e) to a local html file
2. Open it via a `file:///` url
3. Click the two "scan" buttons
4. Observe the errors displayed in the ``
Expectation: if the scan context includes iframes which the default postMessage implementation cannot communicate with, it should result in scans which complete with `frame-tested` violations, not errors emitted from `await axe.run()`
Actual: `await axe.run()` emits Errors in the two variants from the repro file
Motivation: Caused a regression in one of our sample projects when upgrading from 4.1.x to 4.2.x, see https://github.com/TroyWalshProf/SeleniumAxeDotnet/issues/154 and https://github.com/microsoft/axe-pipelines-samples/pull/552.
<pre><code>
axe-core version: 4.2.2
axe-webdriver, extension or other integration version: n/a
Browser and Assistive Technology versions:
* Browser versions: repros under each of the following:
* Microsoft Edge Version 91.0.864.48 (Official build) (64-bit)
* Google Chrome Version 91.0.4472.106 (Official Build) (64-bit)
* Firefox 89.0 (64-bit)
* **Note: SecurityException variant works manifests slightly differently in Firefox vs Chromium**
* AT versions: n/a
</code></pre>
Contributor guide
Assessment
This issue has not been assessed yet.